ClearPath

About

How It Works

For Practices & Centers

Research & Compliance

Book A Call

ClearPath

About

How It Works

For Practices & Centers

Research & Compliance

Book A Call

RESEARCH & COMPLIANCE

The boring stack is the competitive advantage.

ClearPath is built on three principles: deliver only what your practice approved, treat HIPAA as the floor, not the ceiling, and never make a claim we can’t trace to a citable source. Every product decision is grounded in primary clinical research — starting with our June 2026 survey of working CRNAs.

Where ClearPath sits in the regulatory landscape

REGULATORY POSITION

Patient communication, not clinical decision-making

ClearPath delivers pre-procedure instructions that your practice has written and approved. It does not analyze patient data to recommend diagnoses or treatments, and it does not choose medication holds or clinical protocols. Medications outside your approved rules are routed to your clinical team for review. The instruction engine is rules-based — no AI generates or changes what a patient is told.

DATA PRIVACY

HIPAA-aligned with BAA commitment

Patient information is treated as Protected Health Information from intake to deletion. Before any patient data flows through ClearPath, we execute a Business Associate Agreement with the practice or center and downstream BAAs with every vendor in our infrastructure stack that handles patient information, including hosting and messaging. Encryption in transit and at rest. Access controls auditable to the user.

HHS HIPAA Business Associate guidance

SECURITY MATURITY

Building toward SOC 2 Type II

We’re preparing for a SOC 2 Type II audit. Until certification, we operate to SOC 2 controls as a design discipline — documented access reviews, change management, incident response, and vendor risk assessment. We’ll share our control documentation with any prospective partner under NDA before pilot signing.

AICPA SOC 2 framework

The goal is never to claim more than we can defend. The goal is to make every claim defensible.

Where ClearPath sits in the regulatory landscape

REGULATORY POSITION

Patient communication, not clinical decision-making

ClearPath delivers pre-procedure instructions that your practice has written and approved. It does not analyze patient data to recommend diagnoses or treatments, and it does not choose medication holds or clinical protocols. Medications outside your approved rules are routed to your clinical team for review. The instruction engine is rules-based — no AI generates or changes what a patient is told.

DATA PRIVACY

HIPAA-aligned with BAA commitment

Patient information is treated as Protected Health Information from intake to deletion. Before any patient data flows through ClearPath, we execute a Business Associate Agreement with the practice or center and downstream BAAs with every vendor in our infrastructure stack that handles patient information, including hosting and messaging. Encryption in transit and at rest. Access controls auditable to the user.

HHS HIPAA Business Associate guidance

SECURITY MATURITY

Building toward SOC 2 Type II

We’re preparing for a SOC 2 Type II audit. Until certification, we operate to SOC 2 controls as a design discipline — documented access reviews, change management, incident response, and vendor risk assessment. We’ll share our control documentation with any prospective partner under NDA before pilot signing.

AICPA SOC 2 framework

The goal is never to claim more than we can defend. The goal is to make every claim defensible.

What you're trusting us with, and what our commitment is to you

Hosting

Hosted on Microsoft Azure in U.S. regions, using HIPAA-eligible services under a signed BAA. Patient information is encrypted at rest and in transit, and never leaves the covered production environment.

Access controls

Role-based access with the principle of least privilege. Multi-factor authentication required for all ClearPath team members. Patient data is never accessible to anyone outside the practice’s or center’s authorized clinical team and the minimum ClearPath staff necessary for support. Every access is logged.

Data retention

We keep patient information only as long as needed to provide the service and as your agreement with us requires. When an engagement ends, we return or destroy your patients’ information within 30 days and certify it in writing. Compliance records we’re legally required to keep, such as consent records and security logs, are retained for the period the law requires. Your practice remains the keeper of the medical record.

Breach notification

If we discover a breach involving your patients’ information, we notify your practice without unreasonable delay and within the timeframes required by our BAA and Texas law, with what happened, what information was involved, and what we’re doing about it. We support your notification obligations to patients and regulators under HIPAA and Texas law.

Use of data

Patient data is used only to deliver and support the pre-procedure service your practice engaged us for. We do not sell data. We do not use it for marketing or share it with advertisers or business partners. We do not use patient data to train AI models. We de-identify information only as HIPAA allows, and use de-identified data only with your written permission.

Text messaging and consent

No patient receives a text until they’ve given consent. Patients can reply STOP at any time to end messages, or HELP for your contact information, and agreeing to texts is never a condition of care. Our messaging program is registered with U.S. carriers. Medication and dosing details are never written in the text itself — they open on a secure, expiring page that requires the patient’s date of birth. We don’t collect patient email, and no third-party tracking runs on patient-facing pages.

Your protocols. Your authorship. Your liability boundary stays intact.

ClearPath does not author medical guidance. We deliver the procedural guidelines approved by your practice, your physicians, and your clinical leadership. Every instruction a patient sees traces to a protocol you approved or a clinical decision your team made. We don’t override clinician judgment. We deliver it.

What we don't do

Diagnose. Recommend treatments. Generate independent medical advice. Override your clinical judgment.

What we do

Deliver your practice’s protocols to the right patient at the right time, in plain language, with the right clinical context.

Where authorship lives

With your physicians, your anesthesiologists, your CRNAs, and your nursing leadership. We encode what they’ve already decided.

Your protocols. Your authorship. Your liability boundary stays intact.

ClearPath does not author medical guidance. We deliver the procedural guidelines approved by your practice, your physicians, and your clinical leadership. Every instruction a patient sees traces to a protocol you approved or a clinical decision your team made. We don’t override clinician judgment. We deliver it.

What we don't do

Diagnose. Recommend treatments. Generate independent medical advice. Override your clinical judgment.

What we do

Deliver your practice’s protocols to the right patient at the right time, in plain language, with the right clinical context.

Where authorship lives

With your physicians, your anesthesiologists, your CRNAs, and your nursing leadership. We encode what they’ve already decided.

TAKE IT WITH YOU

The ClearPath Compliance Brief

A two-page summary of our regulatory positions, security architecture, and clinical-guidance boundaries. Shareable with your compliance officer, IT director, and clinical leadership. Email me and I’ll send the current version directly.

Request the Compliance Brief

Book A 15-Minute Call

If you book a call, you'll hear from me directly — not from an automated sequence.

ClearPath

Ashlee@clearpathpreop.com

LinkedIn

ClearPathPreop.com

© 2026 ClearPath Health, Inc. · Dallas, TX

Privacy Policy

Terms and Conditions

Cookie Policy

ClearPath is pre-procedure patient communication and workflow software. It delivers instructions approved by your practice and does not diagnose, treat, or replace clinical judgment. All medical decisions remain the responsibility of the patient’s practice, surgery center, and licensed healthcare providers. All rights reserved.