Identify information, access and responsibilities
List the types of information processed and the people or providers who may access them. Review permissions, staff access reviews, account recovery and how support requests are handled. Ask which party is responsible for each control and incident response step.
Request useful evidence
Discuss audit history, encryption, backup restoration, vulnerability management and incident notification. Check the scope and date of any assessment or certification offered. Do not assume that an infrastructure provider’s certification automatically covers every application or operating process.
Keep the public website separate from clinical care
Flor’s marketing forms and public assistant accept product questions and business contact details. They are not patient-record systems. Clinical privacy, security, contracts and operational readiness remain release-review items. No HIPAA, PIPEDA or provincial compliance certification is claimed here.
Privacy questions for US practices
Where HIPAA applies, assess the actual services, safeguards and responsibilities involved. Ask about business associate agreements and verify the precise products covered. A vendor label or encryption feature alone does not establish compliance.
Read the guidance from US Department of Health & Human Services ↗
Ask for service-specific evidence
Start with the actual information your practice would process and identify each service that handles it. Ask who can access the records, how access is removed, what recovery has been tested and which agreement assigns responsibilities. Keep evidence tied to the named product and environment. General statements about encryption or a cloud provider are not a complete answer to your clinic’s operational and legal questions.
| Check in the demonstration | Evidence to record |
|---|---|
| Product and service scope clearly named | Describe the observed result using fictional data. |
| Access and recovery evidence reviewed | Record the role, exception and any manual work required. |
| Contract responsibilities matched to the workflow | Agree on pass, follow-up or unavailable before rollout. |
Continue with patient portal software for connected care and clinical notes and documentation workflows to test the connected steps. The interactive Flor demo provides fictional examples for the discussion.
Questions for a US practice
Separate self-pay invoicing, superbills and electronic claims in your requirements. A working invoice does not establish payer connectivity. Ask for USD pricing, define staff and recipient access, and test the exact state, discipline and payer workflows relevant to your practice.
Where HIPAA applies, review the actual cloud services, responsibilities and agreements involved. HHS cloud-computing guidance is a starting point for those questions. A software label is not evidence that a particular clinic configuration satisfies its obligations.
A few common questions
Is Flor HIPAA compliant?
Flor does not make a general HIPAA compliance claim on this site. Where HIPAA applies, review the exact services, business associate agreements and safeguards with the team.
Does Flor guarantee Canadian data residency?
No patient-data residency promise is made here. Hosting and processing locations must be confirmed for the actual clinical service and contract.
Prepared for clinic owners in United States. Updated . These guides support product evaluation and do not replace professional or legal advice.