Security
Nothing consequential happens without your signature.
Capstan prepares. You send, submit and attest. Every action is written to a Ledger no one can edit.
Custody, with controls.
Capstan holds your record. Nothing about your book is ever mixed with anyone else’s. Your records live in your own store, under your own key. Encrypted and access-controlled. That is the defense: not that nobody holds your records, but that they are held to a standard you can inspect.
The book on a laptop is the risk.
That spreadsheet is protected health information, unencrypted, walking around in a bag. Lose the laptop and federal law calls it a breach: written notice to every affected client within 60 days, and to the government. Penalties are assessed per violation, which can mean per record, with annual caps above $2 million. Small practices, not just carriers, have settled for 6 figures. The fine is survivable. The letters to your own book usually are not.
Sources: HIPAA Breach Notification Rule, 45 CFR §§ 164.400–414; civil money penalties, 45 CFR § 160.404, adjusted annually for inflation.
Built for HIPAA.
Your part, made smaller.
- Encrypted with your own key
- Covered by a signed BAA
- Every action written to a Ledger no one can edit
- Nothing goes out until you send it
Who opens your book.
AWS logs every time your book is opened, and you see that log. Forwarded messages are read once, on arrival, to file them. When access ends, it ends within minutes.
Omni Key™ is not a bot.
It types your confirmed client facts into forms: 1 click fills every field it recognizes, and you point to the rest. It reads form labels and field types to know where each value goes, and reads none of your client data, stores nothing, submits nothing and uses no AI. It never touches logins, CAPTCHAs or bot checks. You press submit.
Capstan hands it a 1-time fill, and it never signs in to Capstan. It runs in Chrome on your laptop. Before a Medicare fill, Capstan checks for a Scope of Appointment.
What comes in, and what doesn’t.
Calls are recorded with consent. Capstan can send from your Gmail. It can’t read it. Texts stay on your phone line; Capstan doesn’t read or store them. Mail that isn’t from a client or about insurance is deleted on arrival.
Your record, yours to take.
Your records and your system’s blueprint, in open formats — yours to export and destroy. Leaving costs $500. Leave with everything: every record, every file, and the template that rebuilds your system anywhere. Then your data is deleted and its keys destroyed. Only the Ledger’s entry kinds, times, actors and hashes remain, holding no client data.