Practice growth
Cleaner claims: how AI-assisted coding reduces denials
Coding accuracy ties directly to denials and cash flow, a revenue feature disguised as a clinical one.
5 min read
Compliance is usually sold as a badge. A badge is a claim about an audit that happened once, somewhere else. A clause is a promise a buyer can hold a vendor to.
What a badge does not tell you
A badge tells you a third party looked at something on a date. It does not tell you what the vendor owes you when something goes wrong, or who your patients' data may be handed to. Clauses do.
The money is not imaginary. In its 2025 Data Privacy Benchmark Study, Cisco reported that 96% of respondents from the organizations surveyed said the benefits from privacy investment outweigh the costs. Separately, the majority of organizations surveyed — 53% — reported an estimated 1x to 2x return, with a 1.6x median, on investment from privacy spending. Two findings about two populations; neither is a rate attached to the other.
For one practice the return arrives the day a referring clinic or a careful patient asks what happens to the record, and there is something to show. What can be shown is what somebody signed. The security architecture is one half of it; the contract is the other.
Told within forty-eight hours
The processor shall notify the controller without undue delay, and in any event within forty-eight (48) hours, after becoming aware of a personal data breach affecting the controller's personal data. That is clause 8.1 of the published data processing agreement, quoted as it stands.
Clause 8.2 fixes the contents: to the extent available, the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, and the measures taken or proposed; what is not available at once may follow in phases. Clause 8.3 adds cooperation with the controller's own notifications.
We will not publish when your clock starts, or what your practice owes a supervisory authority once told — that belongs to the authority that binds you. What we publish is when ours starts: on becoming aware. The same window is written into the organisational controls as a documented incident-management and personal-data-breach procedure.
A claim that names its own limit
The agreement describes its information-security management system as "aligned to the ISO/IEC 27001:2022 control set" (Annex A), then says, in the next sentence, "No certification is claimed." Both halves are the point.
Around it sits ordinary document control: version 1.0, the processor named as a legal entity, governing law the Republic of Tunisia. The thirty-second test for a buyer is to look for the sentence that stops; a page without one has not said where its limits are.
Four things to ask for
Four rights are worth having in writing before a signature, and each arrives here with its boundary beside it. The useful exercise is counting how many of the four your current vendor will put in writing — the question applies to any practice management software in Tunisia, this one included.
| What to ask for | What the agreement says | Where it stops |
|---|---|---|
| The sub-processor list | A current list of the sub-processors engaged is made available to the controller on request (6.1) | Additions and replacements come with notice and a right to object on data-protection grounds; an unresolved objection lets you terminate the affected services (6.3) |
| Certified deletion | On request, the processor certifies deletion (11.3) | Clinical data carries mandatory retention and a prohibition on hard-deletion while that obligation subsists: retained, restricted, then securely deleted or irreversibly anonymised (11.2) |
| Audit and inspection | Compliance information is made available; audits and inspections by you or an auditor you mandate are allowed for (12.1) | Reasonable prior notice, business hours, once a year at most — unless a supervisory authority requires it or a breach has occurred — and satisfiable with relevant certifications, reports or summaries (12.2) |
| Where the data sits | For a controller operating in Tunisia, personal data including health data is hosted within Tunisia (10.1) | Per-jurisdiction deployment. AI runs on a model self-hosted in the applicable jurisdiction; no personal data goes to any external artificial-intelligence provider or third-party model (10.3) |
The verb here is read, not sign: the agreement is a public page, open before anything is signed.
What the record already logs
Every access to patient data passes two checks: a role-based guard, then a per-record ownership and permission check in the service layer. Every read and write is recorded in an audit trail, cross-doctor access included.
Cross-doctor access is consent-gated, per-doctor, explicit and revocable, and every such access is logged. Full audit logging records who viewed a record, who changed it and when, and the trail is searchable by the doctor.
Underneath: encryption in transit (TLS) and at rest, stored files reachable only through short-lived signed URLs. The most sensitive categories are encrypted at the field level with separate keys, isolated from the rest of the record. Clinical entities are soft-deleted while a retention obligation subsists; what that implies for a computerised patient record is treated elsewhere.
One limit, out loud: the full audit trail is not on the entry plan. It is Pro and Premium, and audit log search with the investigation UI is Premium only. We would rather write that gate down than let it be discovered after signature.
Worth remembering
A security promise is only as good as the sentence you can point at. Ask for the sub-processor list, the deletion certificate and the audit right in writing before you sign, and read the notification clause for its forty-eight (48) hour window and the four things the notice must describe. The management system is aligned to the ISO/IEC 27001:2022 control set; it claims no certification, and says so itself.
Frequently asked
In the event of a security incident, how and how quickly am I told?
Without undue delay, and in any event within forty-eight (48) hours of the processor becoming aware. The notice describes, to the extent available, the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, and the measures taken or proposed.
Can I audit you, or do I just have to believe you?
You can audit. The processor makes available the information reasonably necessary to demonstrate compliance, and allows for and contributes to audits and inspections by you or an auditor you mandate. The same clause sets the boundary: reasonable prior notice, business hours, once a year at most, unless a supervisory authority requires it or a breach has occurred.
Is every access to a patient record really logged?
Reads and writes both, cross-doctor access included. The limit is which plan lets you use it: the full audit trail is Pro and Premium, audit log search with the investigation UI Premium only. We would rather write that down than let it be discovered after signature.
What does this level of documentation cost me?
Nothing on top. The agreement, the terms and the privacy policy are public pages and apply on every plan. The rates are 69 DT for Essential, 159 DT for Pro and 269 DT for Premium, per doctor, per month, billed annually, with a 14-day trial. The detail is on the pricing page.
Trust is not a badge you display. It is a clause somebody was willing to initial. To go through the agreement clause by clause with the software open beside it, request a 30-minute demo — bring the security questionnaire your last vendor left half-answered, because the questions it asks are already written down.