Compliance
The boring pages are the ones that protect you.
This page says what we do with student data and how we verify the people we send to your campus. Plain language first, technical detail below it.
Who can see student information
Providers see only the students they serve. District staff see their own district. Access follows role, not convenience. Student records are encrypted, and personally identifiable information is masked wherever a role does not need it.
Who our providers are, verifiably
Every provider's license is verified against the issuing state board before work begins. Every provider completes DPS fingerprinting and the background checks Texas requires of people who work in schools. Your district sees the credentials before the first session.
Notes that survive audits
Every session ends with a note the provider signs and your campus accepts. Notes carry the fields Medicaid documentation standards expect. When the auditor calls, the record already exists, in order, signed.
Where your data lives
Student data is stored encrypted and stays inside the platform. It is not sold, shared for marketing, or exported to anyone outside the engagement it belongs to.
For your technology director
The technical layer
- Encryption at rest
- Student personally identifiable information is encrypted at the field level using AES-GCM. Encryption keys are managed separately from the data they protect.
- Role-scoped access control
- Access is scoped by role and by relationship: a provider's session can read only the students on that provider's active engagements; district roles are scoped to their district. There is no global read role in normal operation.
- SB 9 fingerprinting and Do-Not-Hire checks
- Providers complete DPS fingerprinting as Texas Senate Bill 9 requires for contracted service providers, and are screened against the TEA Do-Not-Hire registry before assignment.
- License verification
- Licenses are verified against the issuing authority for each discipline: TDLR for speech-language pathology, ECPTOTE for occupational therapy, BHEC for behavioral health licenses, and SBEC for educator certifications.
- SHARS-aligned documentation fields
- Session documentation carries the fields SHARS billing and audits expect, including service type, time in and out, delivery mode, and provider credential, so district Medicaid claims reconcile against our records.
- Audit logging
- Reads and writes of student records are logged with actor, timestamp, and context. The log is append-only and reviewable.
If your technology director or business office has questions this page does not answer, put them in a room with us. Book a call and bring the hard questions.