Security & trust
Built to handle PHI from day one.
Patient care reports are some of the most sensitive records your agency keeps. Here’s how CARA protects them — and how we use AI responsibly.
Safeguards
How we protect your data.
A BAA in every contract
ProVerity acts as your HIPAA business associate. A signed BAA is in place before any patient data reaches CARA.
Encrypted everywhere
TLS on every external connection. Databases and file storage are encrypted at rest.
Access you control
Role-based permissions from viewer to administrator, plus a Medical Director role. Single sign-on and multi-factor authentication.
Tamper-evident audit log
AI findings, review decisions, sign-ins, role changes, and PCR access are recorded in a hash-chained log, so you can always answer who did what, and when.
Responsible AI
How CARA uses AI.
Humans decide.
CARA flags runs for review. A trained reviewer makes every decision, and the audit log shows who made it.
Grounded in your protocols and your data.
Findings come from your protocol rules applied to what the chart documents, and each one cites its source. Analytics answers are live queries against your data.
PHI minimized.
Identifiers such as Social Security numbers, phone numbers, addresses, and dates are filtered out before prompts reach an AI model, and search indexing runs on our own infrastructure.
Have a security questionnaire?
We’re happy to walk your IT, compliance, or legal team through our BAA, architecture, and controls. Mention it when you schedule your demo.
Common questions
What compliance teams ask us.
Do you train AI models on our data?
No. ProVerity does not train or fine-tune AI models on your data.
Who at our agency can see patient records?
Only signed-in users your administrator has approved, with permissions set by role — viewer, editor, protocol author, administrator, and Medical Director.
Can we audit who looked at a record?
Yes. Administrators can ask who accessed any PCR, and the answer comes straight from the tamper-evident audit log.
How does our ePCR vendor connect?
Over the NEMSIS web service, with credentials we generate for your agency. They’re delivered through a one-time link that expires after seven days, so passwords never travel by email.
Can we share a run outside our agency?
Yes — through time-limited links that require sign-in and can be revoked at any time. Every disclosure is recorded in the audit log.
Do analytics expose patient details?
No. Drill-downs from charts and tables show the underlying records with patient information masked.
How long do you keep our data?
For as long as you’re a customer. The last 90 days are available in CARA by default; longer history — a year or more — is available as an add-on.
Schedule a demo
See CARA on runs like yours.
We'll show you how CARA reviews every PCR, what your QA queue would look like, and how it fits alongside your ePCR. Tell us a little about your agency and we'll set up a time.
Schedule a demo →Ask anything. If CARA isn’t the right fit, we’ll tell you.