Security & trust
Built like it handles PHI. Because it does.
Nexoform was designed for HIPAA compliance from the first database table: isolation between practices, an audit trail on everything, and AI that answers to your team. Here is exactly what that means.
Data isolation
Your practice's data stays your practice's data
Every record in Nexoform is bound to a single practice, and that boundary is enforced in the data layer itself, not left to application code to remember. Automated tests attempt cross-practice access on every release; a build that leaks anything between tenants does not ship.
- Tenant isolation enforced at the query layer
- Automated cross-tenant access tests run on every release
- Encryption in transit and at rest
Access & audit
Every access has a name attached
Staff see what their role permits and nothing more. Every view, edit, and message is written to an audit trail, so a practice can always answer who saw what, and when. Patient consents, including recording consent for the ambient scribe, are captured and versioned in the same system.
- Role-based access for surgeons, nurses, staff, and admins
- Complete audit trail across clinical and billing records
- Consent capture built into the workflows that need it
AI safety
The AI works on a short leash
Clinical drafts wait for human approval. Patient-facing answers are constrained to patient-safe language, and anything the AI is uncertain about escalates to your team rather than guessing. Behind that sits an evaluation lab where AI behavior is scored against clinician-labeled gold standards before and after every change.
- Human review before AI clinical content reaches a patient
- Autonomy gates: the AI acts only where the practice has said it may
- Continuous evaluation against clinician-labeled test sets
- Urgent messages always route to a human, immediately
Data handling
Boring, documented, rehearsed
Security is mostly discipline: documented retention and incident-response policies, routine backups with restore drills, credential rotation, and a small, audited set of AI vendors. We will walk through all of it, including business associate agreements, during your evaluation.
- Documented data retention and incident response policies
- Routine backups with tested restores
- PHI is processed only by vendors under appropriate agreements
A note on candor: we describe our security posture in terms of what is actually built and tested, not certifications we have not earned. Ask us anything during your evaluation; detailed documentation is available under NDA.
Bring your compliance questions.
The demo includes whoever handles privacy and security at your practice. We would rather answer the hard questions first.