Security settings, quarterly access reviews, a signed BAA, consent history, data requests and a PHI access log with anomaly flags, all in one place, with a public trust page you control.
| Control | State | Owner | Status |
|---|---|---|---|
| MFA required for finance roles | Enforced | D. Whitfield | Pass |
| Idle timeout | 30 minutes | D. Whitfield | Pass |
| Quarterly access review | Q4 due Oct 15 | A. Rivera | Due soon |
| Business associate agreement | v3 signed Jan 2026 | D. Whitfield | Pass |
| PHI access anomalies | 0 open | J. Brooks | Pass |
Capabilities
Require MFA by role, set an idle timeout, restrict sign-in to your IP ranges (Enterprise), and limit invites to your email domains. Before you enforce a policy, see who it would lock out.
Snapshot every member each quarter, decide keep, change or remove with a reason, and complete with CSV evidence. Sign the BAA in-app with a typed name and title; new versions supersede old ones and the subprocessor list is always current.
Consent history is append-only and written through to each patient's preferences. Data requests get a 30-day clock, one extension, identity verification and an export. Every PHI read is logged with a reason and flagged when it looks unusual.
| Who | What | Reason | Flag |
|---|---|---|---|
| J. Brooks | Statement run · 212 patients | statements | Bulk read |
| P. Okafor | Check-in · 1 patient | front-desk | Normal |
| Collections agent | Balances · 0 names | none | Tokens only |
A public page describing Treso's controls, and optionally your practice's: who to contact, what's enforced, which agreements are in place. Vendors and payers stop asking for the same questionnaire.
Who uses it
Permissions carry a location scope and an approval limit. The same limits apply to agents acting in this module.
Questions
Yes. The business associate agreement is signed in-app during onboarding, and a copy is stored with your agreements.
Patient identity is stored in an encrypted vault, separate from financial data, and referenced everywhere else by a token. Names and dates of birth are read only with a logged reason.
No. Agents work on tokens and amounts; patient text never enters a model prompt. The PHI log would show it if it did.
Works with
An operating account where deposits land, cards and bills are funded, and every movement is on the ledger.
Learn moreText-to-pay, card on file, payment plans, memberships and financing, posted back automatically.
Learn moreClose, reconciliation, collections, policy, procurement and support agents that propose; people approve.
Learn morePre-launch
The demo opens Compliance as Dana, who works in it every day at a synthetic dermatology practice. Owner, location manager, front desk, billing, provider, controller and CPA are each one click away, and nothing in it is real.