Privacy

• These pages set no cookie. They load no analytics, advertising or tag manager.
• Fonts, images and the home page film come from Practice Pillar's own address, and the content security policy allows no other source. The film is fetched only when you press play.
• The pricing estimate, the hire-cost calculator and the Good Faith Estimate due-date calculator run in your browser. The numbers and dates you enter are not sent or stored.
• The status page shows whether Practice Pillar and its database are answering. It shows nothing about you or any practice.
• The demo request form sends what you type to Practice Pillar's support address by email, through Resend. Practice Pillar keeps a record that the message was sent, with its subject line, which names your practice, and not the message itself.
• Vercel serves these pages, so it receives your request, including your network address.

• When a practice keeps client information in Practice Pillar, the practice is the covered entity under HIPAA. Hyrax LLC, doing business as Computing America, which provides Practice Pillar, is its business associate.
• The practice's own Notice of Privacy Practices governs how it uses and shares its clients' information. Practice Pillar does not replace that notice.
• A client who wants a copy of a record, a correction or a list of disclosures asks the practice. The practice answers from its record in Practice Pillar.
• Practice Pillar never sells client information. It shares none with a payer or a platform beyond what a claim needs, and it never uses client information to train a model.
• A screen that takes client information stays closed until every service it depends on has signed a business associate agreement.

Pricing shows which parts are open to practices now.

• Staff accounts, with their sign-in details. Passwords are stored only as a scrypt hash.
• Signing in sets a cookie that keeps you signed in, and scripts on the page cannot read it. A session lasts at most 8 hours.
• Records of how the practice runs, such as the planner, scorecards and meetings. They hold nothing that identifies a client, initials at most.
• Inquiries, which hold who a person is and how to reach them. Every time someone opens an inquiry, the audit log records it.
• The clinical record and billing, for a practice that uses them. Clinical and billing text is encrypted field by field, and each practice has its own keys.
• An audit log of every change and every refused attempt, kept by record ID and never by description. The application can add to it and cannot edit or delete it.

Security has the controls behind each of these.

• A practice can export every record at any time, and for 90 days after it cancels.
• Each kind of record has a retention period. The law sets the minimum, and a practice can lengthen it.
• Records are archived rather than deleted by hand. A retention run destroys a record only after its period has run, and a legal hold stops it.

• What happens to a practice's records after those 90 days is not settled yet.
• Not every service on this page has signed a business associate agreement. Until one has, the screens that would send client information through it stay closed.

Email practicepillar@computingamerica.com with a question about this page. For a client's own record, ask the practice.

Or write to Hyrax LLC, doing business as Computing America, 1400 Preston Rd #443, Plano, TX 75093.