What's true today, stated plainly

The public demo uses synthetic data only. No real patient, member, or claimant information has been used in any blueHealthcare demo, screenshot, or public material.

No live PHI has been processed by any blueHealthcare product to date, and no customer pilot is signed.

The blueHealthcare launcher enforces role-based authorization: a session belongs to a named user with a role, and every access is written to an append-only, hash-chained audit log with daily signed checkpoints.

Care-team-scoped access control — restricting a user to records for patients on their own care team — is enforced for all 15 clinical record types the role matrix marks as care-team-scoped today. We report this as measured, not a guess.

A startup safety guard still refuses to run the platform in a production posture until the clinic has also recorded an explicit go-live sign-off — a named person and a time — which should wait until the rest of the go-live checklist is done: e-prescribing and lab interfaces where needed, verified backups, a support contact, and a security review.

blueHealthcare sells verified access to review tools — never data. No product in this line has, or plans, any surface for exchanging patient, member, or claimant records for money, in either direction.

Every product signs its output with Ed25519 and ships a standalone, dependency-light verifier that checks the signature with no server, no database, and no network connection. Tamper one byte of a signed packet and verification fails — this is a genuinely testable claim, not a marketing one.

A signed receipt proves what the software ran and recorded. It does not prove an underlying real-world claim, conclusion, or coverage determination is true.

available No VPN required. Sign in over the open internet through your organization's own identity provider — single sign-on via OpenID Connect, with the token cryptographically verified against your provider's published keys before any session is created.

available Short sessions. A session ends at whichever comes first: 12 hours from sign-in, or 15 minutes of inactivity.

being built Stronger sign-in for signing decisions. A step-up sign-in requirement before the decisions that matter most is in progress, not yet enforced everywhere it should be.

planned Support access, on your terms. Any support access to your environment would be granted by you, time-limited, and logged — not a standing door we hold open.

available Nothing phones home. The platform and launcher run on your own infrastructure and bind to loopback by default; they don't call an outside analytics or telemetry service on their own.

• No SOC 2 report, HIPAA Business Associate attestation, or equivalent third-party audit exists yet.
• No signed customer pilot exists yet.
• No product has processed real PHI.
• No non-US or community-edition deployment exists yet.
• No clinic has recorded an explicit go-live sign-off yet; the platform refuses to boot in a production posture until one is (see Access control above).

We would rather under-claim here than have this page say something the product can't back up.

• We don't claim HIPAA compliance, a clinical-validation result, or any certification — none has been sought or completed.
• We don't claim the clinical platform is ready for real patients: care-team scoping is fully enforced across all 15 record types the role matrix marks as care-team-scoped, but going live also requires the clinic to record an explicit go-live sign-off, which should wait until the rest of the go-live checklist is done.
• We don't claim a signed receipt is backed by anything outside the machine that produced it — a company-wide signing identity is a rotation event still ahead of us; until it runs, a receipt resists accidental tampering, not a deliberate insider with local write access.
• We don't claim any uptime, speed, or scale figure — none has been measured.
• We don't claim AI makes a better decision than a human reviewer, or that any product decides anything at all.

Two conditions gate two different products, and neither has been reached yet.

Before we handle real cases, for blueChart or blueClaims: the signed human-decision record built and checked; a company-wide signing identity in place, with no over-claimed assurance level; a security program a buyer's own security team accepts for a pilot; a signed confidentiality agreement and data-handling terms for the real cases; risk-transfer coverage counsel and a broker approve; a named support and incident-response path; and no HIPAA, certification, or clinical-validation claim unless it is actually true.

Before we handle real patients, for the clinical platform: everything above, plus the clinic's own explicit go-live sign-off — a named person and a time — recorded only once the rest of the go-live checklist is done: care-team access rules enforced on all 15 clinical record types (done), e-prescribing, and the lab interface tested with the clinic's own reference lab, for any US clinic deployment.