Security & trust
Built for clinical environments.
PrefCA keeps surgical preference data accurate and access tightly scoped. Here's how we approach security, privacy, and HIPAA-aware handling — described as practices, not certifications. For specifics on a Business Associate Agreement or your facility's requirements, reach out anytime.
HIPAA-aware by design
Preference cards describe surgical setup — instruments, supplies, positioning — not patients. PrefCA is designed so cards don't require protected health information, keeping PHI out of the workflow.
Scoped, role-based access
Facilities own their cards. Staff access is scoped by role and organization, and a doctor can read a card only when its facility has shared it with them and access remains available.
Encrypted in transit and at rest
Traffic is served over TLS, and data is stored on managed, encrypted infrastructure with isolated tenancy per organization.
Card version history
Card versions are recorded so authorized team members can review how content has changed.
Data handling you control
Photos and video are intended for room and tray context, not patients, and are served only to users with access to that card. Authorized facility teams control card content, and facility admins manage sharing with the named doctor.
PHI safety boundaries
Because cards aren't patient records, users should not enter patient identifiers into card fields, notes, or uploads. The product is shaped to make the no-PHI path the natural one.
Frequently asked questions
- Who owns the data in a preference card?
- Each preference card belongs to a facility. Authorized facility teams maintain it, and the facility can share it with the doctor named on the card. Each organization's data is scoped to that organization.
- Does PrefCA store protected health information (PHI)?
- Preference cards describe surgical setup — instruments, supplies, positioning, photos of the room and tray — not patients. PrefCA is designed so cards don't require patient identifiers. Users should not enter PHI into card fields, notes, or uploads.
- How does card sharing and access work?
- A facility admin can share a card with its named doctor or revoke that share. Naming a doctor on a card does not itself give them access. Staff access is scoped by role and organization.
- Are photos and video safe to upload?
- Photos and short video are intended for setup, instruments, and room context — not patients. They're stored on managed, access-controlled storage and served only to users with access to that card. Avoid capturing identifiable patients in any upload.
- How is staff training and competency handled?
- Each card can generate a competency quiz from its own content. Facilities assign it to staff and review quiz results and staff attempt history. Training results are scoped to the facility and its staff.
- What does the AI review do with our content?
- AI features help draft and review card content from the inputs you provide. They operate on card content (setup, instruments), and you stay in control — every suggestion is editable and nothing changes without your review.
- What is PrefCA's HIPAA posture?
- PrefCA is built with HIPAA-aware practices — scoped access, encryption in transit and at rest, and card version history — and is designed to keep PHI out of preference cards. We describe these as practices rather than a formal certification; for specifics on a Business Associate Agreement or your facility's requirements, contact us.
- How do we get help or report a concern?
- Reach our team at support@prefca.com for product questions and security@prefca.com for security concerns. We'll route compliance and legal questions to the right people.
Ready when you are
Try PrefCA with a free account.
No credit card. Facility teams can create their first card. Surgeons can view the cards their facilities share with them, free.