Compliance & Trust
Built for PHI from the first line, not bolted on after.
An OS that holds charts, prescriptions and payments only works if it is defensible. Vitality's model keeps a licensed physician at every decision point and treats compliance as an architectural constraint, not a checkbox.
🔐 HIPAA / PHI posture
One record, role-based access (staff CRM vs. patient portal are separate authenticated surfaces, a patient login only sees a chart once it's clinically linked). Every action is attributed and timestamped on the record, creating a native audit trail instead of scattered logs across a dozen vendors.
🩺 Physician oversight on async
Asynchronous consults are structured questionnaires + labs/photos that route into a Provider Review queue. Peter DeBry, MD (board-certified obesity medicine, NPI 1831137991) validates eligibility before any prescription, the "reviewed within 24 hours" promise is a real gate, not marketing.
💳 Payment tied to approval
For lines like Bloom, "your card isn't charged until you're approved." Payment and subscription creation happen against the patient record on physician approval, so money and medicine are never decoupled, and revenue reconciles to a visit by design.
🧾 Self-pay + insurance
Transparent self-pay pricing ($149 first month → $199/mo, no dose surcharge) plus a real clearinghouse layer: coverage on file, coded visits/superbills generated from signed notes, and a fee schedule, the billing surface an EHR/RCM vendor used to own.
📍 Scope-aware by state
Services are explicitly limited to patients located in Nevada, with a Nevada-licensed physician. The system encodes scope-of-practice as a rule, containing regulatory risk while multi-state expansion is staged deliberately.
🤖 AI with a human in the loop
The AI scribe (Dictate Consult), automations (async-intake), and plan generation accelerate clinicians, but clinical decisions, Rx, and coding remain physician-owned actions logged to the chart.
✅ LegitScript certified
The clinic carries full LegitScript certification. Every NPI and DEA license, and all GLP-1 and controlled-substance sale and marketing, is verified as compliant, legal and above board, and is reflected properly inside the EHR. It is the credential that lets the clinic advertise and prescribe on major platforms without friction.
🧱 Segregation of duties
Role-based access is enforced by design. Front-desk, admin, billing and clinical roles each see only what their job requires, and certain admins explicitly cannot open provider or clinical views, separating operational access from PHI-heavy clinical data.
📥 One-click audit report
The admin console generates and downloads a complete audit report on demand: who accessed what, when, and what changed. If an audit ever comes, the evidence is a button rather than a fire drill.
🔧 Self-healing AI loops
Automated loops continuously monitor the ecosystem, catch and self-fix bugs, and hold the system in a known-good, compliant state. Reliability runs as an always-on background process rather than a maintenance scramble.
