Session and account controls
Auth.js sessions, billing-company account context, role checks, and practice-access checks happen server-side.
Security
Security and BAA posture.
Medi handles PHI for billing companies and the practices they bill for. This page states the controls plainly, including the certifications we have not earned yet. A buyer reviewing Medi should be able to verify the posture without a demo.
Plain boundary
BAA before PHI. No certifications we have not earned.
We sign a Business Associate Agreement before any production PHI workflow goes live. We do not claim SOC 2 or HITRUST certification because we are not yet certified (SOC 2 Type II is on the roadmap, but not earned yet). Medi is reviewable through contractual BAA, documented controls, audit logging, and implementation due diligence.
BAA before any PHI workflowServer-side Auth.js sessions and access guardsSeven-year audit log retention, beyond the six-year §164.316(b)(2)(i) minimum
Controls
What an IT reviewer can verify.
Concrete controls your IT team or compliance reviewer can map to HIPAA Security Rule technical safeguards (§164.312). The list is what Medi actually does, not what a certification badge would imply.
Practice-scoped access
Every workspace is organized around client practices. Users only reach the practice, provider, claim, payment, and report surfaces their role and account access allow. Restricting an offshore biller to four of eight clients is native, not a workaround.
Audit logging aligned with HIPAA §164.312(b)
PHI access is logged in the application with user identity, tenant ID, timestamp, and action. Audit rows are hash-chained per record so tampering is evident; the implementation review documents how to verify the chain. Logs are retained seven years, beyond the six-year documentation retention minimum in 45 CFR §164.316(b)(2)(i). SSNs are encrypted at rest.
Transport and browser protections
HTTPS is enforced in production with HSTS, frame protection, strict referrer handling, and a content security policy tuned for the public site and authenticated app. TLS itself is terminated by the hosting platform (Vercel) and follows the TLS versions it supports, not a floor Medi sets in its own code.
Review packet
Security review packet.
The shape of a buyer-side security review for a billing company, owner, or IT reviewer before production work starts.
Certification status, stated plainly
Pre-certification: SOC 2 Type II and HITRUST are on the roadmap but have not been earned yet. Medi is reviewable through contractual BAA, documented controls, audit logging, and the implementation due-diligence process — not through certification badges we cannot show.
Subprocessor and infrastructure review
The processors that touch PHI are named right here: hosting (Vercel), database (Neon), clearinghouse (Stedi), and the AI vendor behind PHI-bearing features (OpenAI). Implementation review covers current BAA status for each processor before go-live.
Implementation review
What gets confirmed before your team runs live work.
Business Associate Agreement signed before any production PHI workflow
Role and practice-access review during implementation
Audit log review for PHI-sensitive workflows
Subprocessor and infrastructure review before go-live