Trust by construction.
Outside actions wait for evidence. Failures close safely. Every access is provable.
The decision is sealed into the hash-chained audit trail. Changing the past breaks the chain.
An outside action, held at the gate. 1. A claim asks to leave for the payer. It has no authority yet. 2. The gate checks the evidence: clean edits, eligibility, enrollment and approval. 3. Two conditions are missing, so the claim is held. Blocked, not warned. 4. The route is enrolled and a person approves. Now it can run. 5. The decision is sealed into the hash-chained audit trail. Changing the past breaks the chain. Illustrative, synthetic data.
Three promises, built in.
Evidence-gated
Payer sends, eRx, lab orders and payments are blocked until evidence is accepted.
Fail-closed
If the audit write fails, PHI access fails. Missing eligibility holds the claim.
Provable
Hash-chained access logs, archived to six-year write-once storage.
Nothing leaves without proof.
Claims, prescriptions and payments are blocked, not warned, until the evidence is complete.
Every access, chained.
Each read links to the one before it. Altering the past breaks the chain.
Defense in every layer.
AWS PHI boundary
US region, under a BAA, encrypted with TLS in transit and KMS at rest.
Least privilege
SSO, enforced MFA and logged, time-boxed break-the-glass.
Separate authority lanes
Claims, eRx and payments each gated, with two-factor where law requires.
Records kept
Never silently purged. Point-in-time recovery and tested restores.
Threat detection
GuardDuty, Security Hub, Inspector, Macie and Config with a HIPAA pack.
AI stays on AWS
Patient data reaches models only through HIPAA-eligible AWS services.
Posture at a glance.
VAERION does not hold ONC certification, a SOC 2 report or HITRUST certification today. Any we earn will be listed here with issuer and scope.
Controls compliance can use.
42 CFR Part 2
Substance-use disclosures authorized, noticed and logged.
Consented support
Support sees screens only with consent, and can never sign or send.
Configurable access
Fields, pages, roles and per-user overrides, set by the practice.
Compliance workspace
Incidents, policies, access reviews and a calendar.
Credential watch
License and DEA expirations become tasks before they lapse.
Current code sets
CMS, FDA and MS-DRG files updated from official releases.
Certified for controlled-substance eRx.
VAERION Healthcare OS holds the DirectTrust EPCS Aggregator Certificate. Prescriptions go out from the chart on Surescripts.
- Reviewed against the DEA EPCS rule
- Identity-proofed, two-factor signing
- Verifiable on Credly
What we hold today.
Each with its issuer, date and scope.
DirectTrust EPCS Aggregator Certificate
Issued 14 July 2026 to VAERION Systems, Inc. for VAERION Healthcare OS v2.0.
Verify on CredlySurescripts approval via ScriptSure
Approved 16 July 2026 for new, renewal, change, cancel, fill, history, formulary and real-time benefit. Prescribers activated individually.
AWS Business Associate Addendum
PHI stays on HIPAA-eligible AWS services.
Clearinghouse BAAs
Stedi (primary) and Claim.MD (backup). Payer enrollments filed per practice.
Federal code sets
ICD-10-CM/PCS, HCPCS, NCCI and MS-DRG from official CMS releases, by date of service.
Applied for, not yet held
A dental-procedure code license (dental coding stays closed until granted) and ONC certification scoping.
Security team questions.
Will you sign a BAA?
Where is PHI stored?
What if a component fails?
Can we get a full audit trail?
Are you SOC 2, HITRUST or ONC certified?
Do you support SSO, MFA and RBAC?
Walk through our security.
Architecture, PHI boundary and evidence, with the engineers who built them.