The practice keeps clinical authority
Your licensed team defines the care model, approves clinical policy, receives escalations, and makes final patient-care decisions.
Security, authority, and data boundaries
Keep consequential decisions with the people accountable for them.
Kept Count makes work, exceptions, ownership, and review history visible. Your organization keeps clinical judgment, compliance oversight, coding decisions, and final claims authority.
Why the boundary matters
The person on the other end of this work is someone's patient, not a record in a queue.
That is the reason authority stays with the people who are accountable for it, at every handoff below.
The control model
Clear ownership at every handoff.
The practice keeps claims authority
Kept Count prepares review-ready evidence. It does not choose final codes, submit claims, receive collections, or release unsupported lines.
Exceptions stay visible
Missing consent, conflicting facts, unresolved requirements, and held billing lines remain visible with an owner and reason.
Access is role- and tenant-scoped
Provisioned users work within assigned roles and organizational boundaries; audit evidence records important actions and changes.
Recount stays bounded
Recount prepares the next contact and can draft attributable notes from the record the worker can already see. It does not approve clinical decisions, release billing lines, send messages, rank the worklist, or replace the named human owner. Covered use requires the appropriate agreements and a dedicated environment; public evaluation stays synthetic.
Partner reporting stays purpose-limited
Provider teams retain patient-level authority while community, sponsor, and network views are limited to approved aggregate or assigned operational information.
CMS and OIG audit-response readiness
Make compliance work reviewable, not invisible.
Assign owners, preserve a dated decision trail, surface missing or contradictory evidence, and track holds and corrections so your compliance team can monitor the process and prepare for record requests. Kept Count supports this workflow; it does not replace the practice's compliance program or audit plan.
Kept Count can
Organize candidate evidence, monthly work, consent records, exceptions, supervision, QA, and billing-support packets.
A responsible practice reviewer must
Confirm program fit, patient facts, clinical appropriateness, coding, coverage, and the final decision to submit or withhold a claim.
Kept Count does not
Guarantee reimbursement, certify compliance, replace counsel or a compliance officer, auto-submit claims, or make clinical decisions.
Primary requirements and guidance
Data boundary
Synthetic until the covered environment is ready.
The public tour and evaluation experience use synthetic or de-identified examples. Real patient information must not enter the system until the contract, BAA, covered-vendor, security, and practice-acceptance gates are complete.
No PHI in public forms
Readiness and walkthrough requests are for business contact and implementation information only.
Production is a gated decision
The practice and Kept Count clear technical, contractual, security, clinical, and billing gates before activation.
How assurance works
Vendor coverage is one layer. Kept Count carries the whole system.
A vendor BAA or SOC 2 report does not by itself make a customer HIPAA compliant. Each customer’s production environment runs inside a covered boundary that is set up, evidenced, and reviewed with the customer before activation. The public demo uses synthetic data.
Covered vendor layer
BAAs and covered accounts
Supabase and Vercel offer HIPAA-capable services under specific paid plans, signed BAAs, and configuration requirements. Kept Count activates and evidences the exact covered accounts and projects for each deployment before any PHI is used.
Kept Count layer
Operational HIPAA program
Risk analysis, policies, training, access reviews, incident and recovery procedures, vendor management, and customer activation controls remain Kept Count responsibilities. HHS does not recognize a shortcut “HIPAA certification.”
Independent assurance
Assessment, testing, and SOC 2
The assurance program covers an independent HIPAA assessment, penetration testing, and a scoped SOC 2 examination by an independent CPA firm. Current documentation is shared during the security review.
Before production activation
Five gates before real patient data enters the system.
These are procurement and implementation controls, not badges. Evidence is reviewed with the responsible owners before the practice authorizes real-data use.
- 1A signed services agreement and appropriate business associate agreement
- 2A covered production environment with required vendor agreements and controls
- 3Practice-approved consent, supervision, escalation, documentation, and claims policies
- 4Named clinical, compliance, operations, security, and billing owners
- 5Role provisioning, workflow acceptance, and launch evidence
Bring your compliance, security, and billing questions.
We will walk through the control boundary, the evidence path, and the exact decisions your practice would retain.