Governance and security
Carrie’s Compliance Posture
01Clinical Governance
Every Program Carrie runs follows the same review chain before it ever reaches a patient.
Authored by Specialists
- Programs are written by clinicians credentialed in the relevant specialty or condition
- Highly specialized scripts are adjustable to your specific needs
Versioned and Immutable
- Programs are released like a software update and locked
- Changes ship as new signed-off versions
Human Oversight Team
- Licensed clinicians verify every flagged concern
- Escalations arrive to team as an SBAR: Situation, Background, Assessment, Recommendation
Safety Agent Guardrails
- The safety framework is built to ensure urgent concerns are prioritized
- Emergencies are quickly caught and escalated
Concern Grading & Routing
Routine response, consistent with the care plan. Logged; no action required.
Documented to chart
Minor barrier or adherence gap - a missed dose, transport issue, etc.
Queued for care team
Clinically significant change reported - symptom escalation, abnormal reading, etc.
Reviewed same day
Possible emergency detected
Clinician review < 1 hour
02Data & System Security
The security model follows the same minimize-and-isolate logic as the clinical one: touch only what a Program needs and leave a record that can’t be altered.
Encryption
- Data is encoded while moving between systems and while stored
- Pipeline: Call → transcription → documentation
PHI Minimization
- Carrie handles only the necessary personal health information (PHI) required by a given Program
- Nothing more is read, stored, or passed downstream
Audit Logs
- Every conversation produces a full recording and an audit log
- Recordings cannot be edited, only replayed exactly for review
03Compliance Ledger
The frameworks and agreements Carrie operates under:
| Framework | What it covers |
|---|---|
| HIPAA / HITECH | The federal rules governing how protected health information is handled, disclosed, and secured. Carrie is built to operate within them, not around them. |
| SOC 2 Type II | Independent, time-tested verification of security controls across the platform - the practices are aligned to SOC 2 Type II control criteria. |
| Business Associate Agreements (BAA) | Signed with every vendor in the stack, holding each one to the same privacy obligations Carrie itself is held to. |
| Telephone Consumer Protection Act (TCPA) | Outbound calling complies with federal TCPA rules, with STIR/SHAKEN caller verification so patients can trust the call is legitimate and comes from your practice. |
| Patient Consent | Patient consent follows the practice’s standard and procedural consents. |
04Interoperability
Carrie reads context in through the FHIR Connect Engine and writes evidence back out the same way - the record of what happened always lands back in the EHR. The EHR owns the record. Carrie supports the relationship.
Upstream Context
Read with provider intent as defined in the Programs.
FHIR Connect Engine
Downstream Evidence
Carries out Programs protocols.
EHR integrations
Evaluating Carrie for your practice?
We’ll walk your security and compliance teams through the architecture directly — audit logs, BAA terms, SOC 2 controls, and how a Program gets from written protocol to a patient’s phone.