How we handle your PHI.
NorthStar Claim sits on the revenue cycle, so it sees clinical text, claim payloads and remittance data. These are the controls we operate on that data — stated plainly, with the agreements that back them.
- PHI stored
- None
- Processed in memory
- BAA
- Included
- On every paid plan
- Automation
- Advisory
- A human approves before submission
The controls
Six things your security reviewer will ask about, answered up front.
BAA on every paid plan
We sign a HIPAA Business Associate Agreement before any PHI touches the platform. There is no self-serve path that skips it.
Read the BAAPHI processed, not warehoused
Clinical text and claim payloads are read in memory to produce an output. We do not persist them as a patient record, and there is no secondary use of your data.
Encrypted in transit and at rest
TLS on every connection, encryption at rest for the operational data we do keep — claim metadata, decisions, audit entries and billing records.
Access scoped to you
Accounts are bound to your organisation and role. Platform staff access is limited, logged, and granted only for support you have asked for.
Every decision is logged
Each automated action records the model version, the input it saw and the output it produced, so a denial or a coding proposal can be reconstructed after the fact.
Human in the loop
Suggestions — codes, hold-and-fix decisions, appeal drafts — are advisory until a person on your team approves them. Nothing is submitted on your behalf automatically.
What we don't claim
You will not find a wall of certification badges here. Compliance is a documented process, not a logo, so we'd rather show you the paperwork.
- No certification badge appears on this site that we cannot hand you the report for.
- We publish no live infrastructure telemetry on a marketing page — status is reported where it belongs, on the status endpoint.
- We do not claim ownership of, or a right to train on, your claims or clinical data.