What we are, legally, and what follows from it

A company that positions itself as the layer moving diagnostic data between unaffiliated organizations acquires obligations that a billing vendor does not have. Naming them publicly is the point of this page.

Business associate, in every direction

Metaclinic is a business associate of the laboratories and practices it serves, operating under an agreement per customer, and it uses subcontractors who are business associates in turn. Obligations flow down the chain by contract and by regulation. Where a customer's agreement is narrower than the default release model on this site, the agreement wins and the platform is configured down, not the other way around.

The actor question

The information blocking rules apply to three kinds of actor: health care providers, developers of certified health IT, and health information networks or exchanges. That last definition is broader than most vendors assume. An entity that determines, controls, or has the discretion to administer any requirement or agreement enabling electronic health information to be exchanged among more than two unaffiliated organizations is inside it.

The practical consequence is that our defaults have to be defensible as exceptions rather than as product decisions. Where we do not fulfill a request, the reason is recorded against a named exception: preventing harm, privacy, security, infeasibility, health IT performance, content and manner, fees, licensing, or the exchange framework exception. A refusal without a recorded exception is a violation with extra steps.

Substance use records

The 2024 alignment of Part 2 with HIPAA simplified consent but did not make these records ordinary. A single patient consent can now cover treatment, payment, and operations, the redisclosure notice requirement persists, and the penalty structure now mirrors HIPAA. Part 2 data is segregated at the storage layer, excluded from bulk views and exports by default, and cannot be released by a general medical authorization.

State overlays

HIPAA is a floor. Louisiana and Texas both impose additional constraints on specific categories, and a national platform that applies one rule set is non-compliant somewhere by construction. Overlays are evaluated by state of service rather than by tenant headquarters, because the location of care governs and a Texas practice's Louisiana patient is a Louisiana question.

Security controls

• Encryption in transit and at rest, with key management separated from application credentials.
• Least privilege by default and no standing administrative read access to clinical data.
• Immutable audit logging of access and disclosure, retained on the schedule the longest applicable requirement sets.
• Annual risk analysis, documented remediation, and workforce training tied to role rather than to a calendar reminder.
• Incident response with defined breach assessment steps, notification timelines, and a named decision-maker.
• Subcontractor review before any new processor touches protected health information, including the ones that arrive as a convenient integration.

Built, committed, and not started

Pages on this site describe controls in the present tense only where the control is enforced in software today. Where a page describes something the platform is committed to rather than running, it says so on the page. This section is where the distinction is named, because a site that states its own obligations is only worth reading if it also states what it has actually finished.

• Enforced today. Service attestation — a charge cannot be created until the service is a recorded event, the record it rests on is attached, the rendering clinician's identity is verified, and that clinician signs against that specific version, with every step written to an append-only log.
• Enforced today. Clinical care management — treatment plans are tracked expectations with due windows, closed by the diagnostic events that satisfy them, with gaps surfacing as worklist conditions rather than at chart review.
• Enforced today. Letters of medical necessity — drafts are assembled from the patient's own record against the named criteria of the policy in question, every assertion cited to its source, gaps declared rather than filled, and the treating clinician's signature required before anything leaves.
• Not started. The agent configuration plane — a published design for a capability that does not exist. It is kept out of the top navigation for that reason and says so in its own first note.

Where a page describes a capability this list does not name, ask. The answer will be specific rather than reassuring, and it will distinguish what runs today from what is on the roadmap.

The paperwork, without a sales call

A business associate agreement is a precondition of the work, not a negotiation to be reached after a discovery call. It is executable here. So is a mutual non-disclosure agreement, if an evaluation needs to cover interface details or volumes before either side has committed to anything.

Sign the BAASign a mutual NDA

Both open in Dropbox Sign. A countersigned copy is returned to the address you sign with. Neither one obligates you to buy anything, and a signed BAA on file is what lets a technical evaluation touch real data instead of fixtures.

What is on this page and what is not