How Prado protects patient health information, payments, and the people who use the platform.
Patient health information is handled as PHI, with a Business Associate Agreement in place for covered entities.
Data is encrypted in transit and at rest.
Our infrastructure runs on SOC 2 Type II and HIPAA-eligible services. [Confirm Prado's own SOC 2 status.]
Role-based access, single sign-on for organizations, and least-privilege access for our team.
Prado acts as a business associate to the clinicians and organizations that use it. We sign a Business Associate Agreement before any patient record is entered, and we maintain HIPAA administrative, physical, and technical safeguards.
Clinicians verify credentials through the national NPI registry or a reviewed credential upload before they can send plans to patients. Food merchants are reviewed for licensing and food safety before their menus go live.
Card payments and payouts are processed by [payment processor], a PCI DSS Level 1 service provider. Prado does not store full card numbers. Bank and tax details are sent to the processor for identity verification.
Employers who offer Prado as a benefit receive aggregate reporting only, with small-group suppression. They never see who enrolled or any associate's health information.
We log and monitor access to production systems, run vulnerability scanning [and annual penetration testing], and maintain an incident response plan with breach notification timelines that meet HIPAA requirements.
We support security questionnaires and vendor reviews for health systems, telehealth platforms, and employers. Request our security documentation or report a concern at [security@getprado.com].
Talk to our team about security questionnaires, a BAA, and vendor review for your organization.
Talk to our team →