Security & Compliance
Built for healthcare from the ground up
You are trusting us with your residents’ and families’ most sensitive information. We treat that the way a healthcare organization has to — with real safeguards, a real paper trail, and a signed agreement in place before a single call is handled.
A signed Business Associate Agreement is in place before any of your patient information ever flows through Opara AI.
The BAA is the legal backbone of HIPAA. Ours is executed as part of onboarding — not an afterthought — and you receive an executed copy for your own records and surveys. And it does not stop with us: every outside service that touches protected health information on our behalf operates under its own signed BAA, so the chain of accountability is unbroken from your front desk to the last vendor in the path.
How we protect the information
Not a marketing checkbox — the specific controls that stand between a caller’s health details and anyone who shouldn’t see them.
Encrypted in transit and at rest
Every call, transcript, and record is encrypted while it moves and while it is stored. Nothing sensitive sits in the clear.
Every facility is walled off
Your data is isolated from every other facility at the database level — not just in the app. One facility can never see another's calls, contacts, or residents.
Two-factor for administrators
Accounts that can reach patient information require two-factor sign-in, so a stolen password alone is not enough to get in.
Access is logged
Access to patient information is recorded with who, what, and when — the trail a survey or investigation needs.
The AI knows its limits
Our AI is built to never disclose a resident's health information to a caller, and it does not connect outside callers directly into resident rooms. When a situation needs a person, it hands off cleanly.
Your data stays yours
You can export your data at any time, and when a relationship ends we return or securely destroy protected health information on a defined timeline.
A real program, not a promise
Documented, tested, and available for your team to review.
Behind the product is a written compliance program: a risk assessment, an incident-response and breach-notification process, a contingency and backup plan we actually test, access reviews, and a register of every vendor and their agreement.
Our systems are put through ongoing security review and testing, and protected health information is deliberately kept off any infrastructure that is not covered by a signed agreement.
Your compliance or legal team is welcome to review the details. We share our security packet and executed agreements under a mutual NDA — just ask.
Have your compliance team take a look
We would rather answer the hard questions up front. Book a walk-through and bring whoever needs to sign off.