Safety.
OptimIQ runs on protected health information and revenue decisions. The way we handle both is the product.
The most sensitive data and the most consequential decisions in the system.
A claim is a record of someone’s body. A prior authorization is a gate between a patient and care. A risk score becomes a budget. Mistakes here aren’t bugs. They’re harm.
OptimIQ exists to take this work off practices, run it cleaner than they could alone, and make every step auditable. That obligation runs through how we hire, what we build, what we ship, and how we respond when something goes wrong.
Five principles that shape every system we build.
Privacy, auditability, and clinical oversight aren’t bolted on after launch. They are the architecture.
How we prevent, detect, respond, and improve.
Prevent
We minimize PHI at the source, segment data by customer tenant, gate access by role, and review every model and every workflow against a written threat model before it touches production.
Enterprise-grade security and infrastructure at scale.
Operations leaders sign the contract. Compliance, security, and IT have to live with it. OptimIQ is built so all three can.
- BAA on file by default
- Audit logs across every PHI access
- Single sign-on with SAML 2.0 and OIDC
- Role-based access controls and least-privilege defaults
- Encryption at rest and in transit
- US-only data residency for in-scope customers
US data residency
HIPAA-aligned controls
Zero-retention model mode
SOC 2-style control mapping
Every control. Every subprocessor. Every recent event.
Public, dated, kept current. The strongest signal we can give that the controls described above are operating today.
The third parties we use to operate the platform.
Each subprocessor is under a BAA where PHI is in scope. Customers are notified at least 30 days before any change.
Saw something wrong?
Security researchers, customers, and members of the public can report a concern directly to our security team. We respond within one business day.
See it on your own data.
Tell us what your organization is fighting (open care gaps, documentation, denials, coverage) and we will walk you through the part of the platform that closes it.