We'd rather tell you exactly where we are than oversell it. Here's our current approach, and what's still in progress.
Data moving between your browser and our servers is encrypted over HTTPS, and stored data is encrypted at rest.
Front desk staff and therapists see only what their role needs — patient scheduling and authorization data, not billing systems or unrelated clinic accounts.
Patient and clinic data entered into MEDA is used to run your workflows — nothing more, nothing shared elsewhere.
MEDA doesn't require access to your clinical documentation or billing system. It handles scheduling, reminders, and authorization tracking as a separate layer.
We're migrating our infrastructure to a HIPAA-eligible cloud environment and working through the technical, administrative, and physical safeguards required under the HIPAA Security Rule.
Before any clinic enters real patient data, we'll have a signed Business Associate Agreement in place defining exactly how that data is handled and protected.
As we move out of early access, we plan to have our infrastructure and practices reviewed by outside counsel and a third-party security assessment.
We're finalizing clear, written policies for how long data is kept and how a clinic can request full deletion if they leave.
If security or compliance is the deciding factor for your clinic, we'd genuinely rather walk you through it on a call than have you guess from a page.
WJ MEDA