Safe and responsible AI

Off-the-shelf AI is one click to set up. That’s the part they show you.

A consumer-grade AI agent looks like a bargain until you ask what it can reach, what it remembers, and who has agreed to protect your patients’ data. Here is what a clinic owner finds out the hard way, and how Tabflows handles each one.

Hire us

Portal message

Today, 8:14 AM

Hi, could you send my refill for lisinopril to the pharmacy on 5th? Also I still have the cough from last visit.

Thanks so much!

Hidden instruction. You won’t see it. The agent will.

Five things nobody mentions at setup

An off-the-shelf agent installs in a click. These are the questions that come after, usually once something has already gone wrong.

It reads everything, and believes everything

An off-the-shelf agent can read every patient message, email and fax that comes in. A hidden instruction inside one of them can talk it into handing over patient records, and nobody in the clinic sees it happen.

With Tabflows. Our workflows never reach into your EHR on their own, and what our AI prepares goes to your team. A person decides whether to use or send it.

It remembers everything, somewhere

It can save every conversation and everything it reads. Which computer that lives on, and who else can open it, is anyone’s guess.

With Tabflows. In our systems, patient data is encrypted at rest and in transit, kept separate for each clinic, and handled as PHI under our BAA. We never use it to train general or cross-customer AI models.

You talk to it in a chat app

Consumer-grade agents often live in a chat app like WhatsApp, Telegram or iMessage. Unless your clinic has a BAA with the company behind that app, the moment a patient’s name goes into that chat, you are exposed.

With Tabflows. You use Tabflows in our Chrome extension and web app. Signing in to either puts your clinic under our BAA.

It needs your passwords

Many agents ask for your EHR login so they can sign in on their own, and it often ends up saved on a laptop. Whoever has the laptop has your patient records.

With Tabflows. We don’t require or store your EHR logins. Tabflows works in the browser session you are already signed into.

Nobody else has agreed to anything

There is usually no BAA with your clinic, and nobody whose job is keeping it safe for you. The person who clicked install is now the security department.

With Tabflows. Our BAA puts duties on us in writing: safeguard the patient data we handle, hold every vendor that handles it to the same terms, and tell you about any breach of that data we become aware of. Decisions about patient care stay with your clinic.

How we handle patient data

Encrypted at Rest. Patient data is encrypted at rest with AES-256 across our core data stores — primary database, file storage, and block storage.

Encrypted in Transit. Connections between your browser and our servers are encrypted with TLS, with TLS 1.3 supported, so data is protected on the wire.

Least-Privilege Access. Patient data is partitioned by practice, and direct production access is limited to a small, authorized group.

No credentials stored. We don’t require or store your EHR or third-party logins. Our tools work with the session you already signed into.

BAA from sign-in. Signing in puts your clinic under our standard BAA. Every vendor that handles patient data for us agrees in writing to protections at least as strict.

Not used to train shared AI. We don’t use your patients’ data to train general or cross-customer AI models.

Tabflows vs. an off-the-shelf AI agent

Question		Off the shelf
Easy to set up	YesWe set it up with you	YesOne click
When it works in your EHR	YesWhen you ask	NoWhenever it decides
Where it keeps what it sees	YesEncrypted, under our BAA	NoAnyone’s guess
Where you talk to it	YesExtension, web app	NoOften a chat app
Your EHR logins	YesNever stored	NoOften on a laptop
Who keeps improving it	YesOur tech team	NoYou do
A BAA for your clinic	YesFrom sign-in	NoUsually none

What we won’t claim

No software can promise to catch every breach. Ours included.

Breaches happen on laptops, in inboxes and on networks that no single tool can see. We don’t claim to see them.

What we can tell you is exactly what our part does. AI that prepares work for your team to review. Patient data encrypted and handled under our BAA. No stored EHR logins. A tech team that keeps improving the setup.

Have questions? We got answers

Have more questions? Reach out to our friendly support teamQuestions? We're here to help

Put AI to work. Don’t find out the hard way.

Tell us what you want off your plate. We’ll tell you what it will touch, where the data will live, and who on your team reviews it.

Hire us