Home / Security / Local
HIPAA compliant · OperatoryView on your own serverHIPAA compliant. Patient data stays in your office.
OperatoryView runs on a computer you own, reads your practice software read-only, and keeps what it stores on that computer. We sign a Business Associate Agreement with your practice.
Read-only
Through your practice software's official API. It cannot write to it.
On your server
The Board runs on a computer in your practice, not in our cloud.
Encrypted
In transit on your network and at rest on your server. A recovery key you print once lets you move to a new server.
BAA
We act as your business associate for what OperatoryView handles.
How OperatoryView meets HIPAA
We are your business associate for what OperatoryView handles, and we meet the safeguards HIPAA asks of one.
A Business Associate Agreement
Your practice accepts our BAA before it starts, and we keep to it.
Access controls
Each PC sees only what it needs, and only PCs set up with your office password, or the Administrator account, can connect.
An audit log
Every time a patient's record is opened or looked up by the assistant, it records who, from which PC, and when.
Encryption
In transit on your network and at rest on your server.
Minimum necessary
First name and last initial on the Board, privacy mode for screens patients can see, and no patient identifier in the analytics.
Policies and breach notice
Written security policies, a risk analysis and training, and notice to your practice within the deadlines our BAA sets.
No agency certifies software as HIPAA compliant, and your practice keeps its own compliance program. This page shows what OperatoryView does for it.
How your practice connects
Three steps, read-only from end to end, and we are not in the middle of any of them.
Your practice software on your server
Your schedule and patient records stay where they are.
Its official API, read-only
OperatoryView reads through the keys issued to your practice, over your practice software's own connection. No copy of your schedule reaches us.
OperatoryView on every PC
Over your own encrypted network. Only PCs set up with your office password, or the Administrator account, can connect.
The one exception: OperatoryView adds a single change notification to your practice software, so your Board updates within seconds of a change. It is one settings entry that points at your own OperatoryView server, and it never changes a patient's record or your schedule.
We connect to your server remotely only with your permission, during setup or support you schedule.
What leaves your network
Four things, and nothing else. Only the AI assistant can carry patient details, and only when someone asks it something.
Your practice software's own API service
OperatoryView reads your schedule, completed procedures, payments, adjustments, insurance payments and the hours each provider and room is scheduled, using your practice's keys. The information comes back over your practice software's own connection. We are not in the middle of it and never see it.
License and certificate service
Your license key, a hashed practice identifier, an installation ID, the software version, the number of operatories, the date your installation's certificate expires, a timestamp, the computer's local network address, the board address you chose, the administrator's username (never a password), a few coded status words about the software itself, and a certificate request that contains only the installation's name.
Update check
The current software version, so OperatoryView can update itself outside office hours.
AI report and assistant, if you use them
The report sends office, provider and room totals; never patient names, identifiers or clinical details. The assistant sends the question and what it looks up to answer it, which can include patient details the PC asking may see. Both are powered by Claude, in our cloud on HIPAA-eligible services under a BAA, and nothing they send is stored by the AI service or used to train AI models.
How we protect it
Only what each PC needs
Admin and front desk PCs see a patient's full details; an operatory PC sees what a room needs.
A record of every look
Every time a record is opened or looked up by the assistant, the audit log records who, from which PC, and when, for up to 18 months.
Privacy mode
Patient names are removed entirely on screens a patient can see.
Kept as long as you choose
Messages and their files are kept for the time your admin sets, 1 year by default and anywhere from 30 days to 7 years, and are in your encrypted backups. Assistant chats are deleted after 30 days and left out of backups. Your own patient alerts and team notes stay until someone removes them.
Verified updates
Every update is verified as ours before a file is replaced, and undoes itself if the board does not come back.
Written policies
Security policies, a risk analysis and a training record for everyone who works on OperatoryView.
Looking for the cloud version, for cloud practice software? See cloud security.
Questions from your compliance lead?
Ask for the written data-flow statement, or book a demo and we will walk through it with them.