Security & HIPAA
This is patient data. The architecture treats that as the starting constraint — not a feature added afterward.
● HIPAA-aligned · BAA per operator · SOC 2 Type II in progressHow your data is protected
Your data stays yours
Every operator gets a separate database with its own credentials. One customer’s data is unreachable from another’s session — enforced at the connection, not by a filter.
Read-only, always
OpsClara reads your records to answer questions. It cannot change, add, or delete anything in your data.
Every access is logged
Each question — and each time a resident’s name is viewed — is written to an audit trail tied to the person who asked.
Encrypted end to end
Your data is encrypted in transit from PointClickCare and at rest in your private database, on a HIPAA-eligible cloud.
Least-privilege access
Access is scoped to the signed-in user — by facility, region, and role — so people see only what they are authorized to see.
You own the data
You remain the covered entity. OpsClara acts as your business associate under a signed BAA, and holds a working copy only to answer your questions.
How your data reaches us
OpsClara connects through your existing PointClickCare Data Relay. An encrypted copy of your data is delivered to your private database and refreshed automatically every hour. Nothing changes inside PointClickCare — your workflows, users, and permissions are untouched.
Our commitments with your data
- We never use your patient data for advertising or marketing.
- We never sell your data.
- We never use your patient data to train external AI models.
- We access it only as needed to provide the service you asked for, under your BAA.
Business Associate Agreement
You remain the HIPAA covered entity. OpsClara signs a Business Associate Agreement with each operator, and maintains a BAA with each of our own subprocessors. A BAA template and security questionnaire are available on request — email hello@opsclara.com.
Subprocessors
We use a small, deliberate set of providers, each under a BAA or data-protection agreement where they may handle covered data:
- Microsoft Azure — cloud hosting (HIPAA-eligible).
- Anthropic (Claude) — the AI assistant that answers your questions.
Certifications: We are pursuing SOC 2 Type II. When it is complete, we will provide the report on request — not just display a badge.
Questions
Security or compliance questions, or need our documentation for your review? Email hello@opsclara.com.