Lithos
Get sandbox accessBook a call
Security and compliance

Built for diligence

If you run patients through Lithos, your counsel and your compliance team will have questions. This page is for them, and anything it doesn’t answer we’ll put in writing.

Book a call Send your questionnaire
Audit logenc_51b0 · every action, who and when
Recording
  • 14:06:03prescription.signedEPCS · identity verified
  • 14:06:02encounter.completedDr. A. Patel, MD
  • 14:05:40chart.viewedDr. A. Patel, MD · TX
  • 14:02:12chart.preparedLithos · AI chart
  • 14:02:11encounter.createdYour app · API key ••3f
Every entry exportable through the APIExample data
BAASigned at onboarding, on every plan
SOC 2Type II audit underway
50 statesLicensure, consent and board filings kept current
Every actionLogged, and exportable through the API
50-state compliance

Compliant in every state, from day one

Licensure, prescribing rules, consent and board filings, kept current in all 50 states from day one. Adding a state is a settings change, not a project.

On every encounterall 50 states
  • Provider licensed in the patient's state
  • Async or sync, per state rules
  • State prescribing rules
  • Informed consent on file
  • Board filings current
  • Medical director oversight
New patient in Ohio→ OH-licensed provider
01

Know what’s allowed

Modality, prescribing and consent rules for each state and each medication, before you launch.

02

Get set up right

Providers licensed where your patients live, pharmacies that can ship there, protocols signed off.

03

Treat correctly

A licensed provider reviews every encounter, and anything unusual is escalated, not auto-approved.

04

Keep the record

Consent, decisions and prescriptions logged on every encounter, exportable whenever you need them.

HIPAABAA at onboardingSOC 2 Type II in progressHMAC-signed webhooksYour data, exportable anytime
What we commit to

Six things your compliance team will ask about

BAASIGNED AT ONBOARDING

HIPAA, with a BAA at onboarding

Lithos operates as a HIPAA business associate. A Business Associate Agreement is part of standard onboarding, not an enterprise add-on.

SOC 2Type IIControls designedEvidence collectionAuditor report

SOC 2 Type II underway

Our SOC 2 Type II audit is in progress. The report is shared with customers and prospects under NDA as soon as it’s available.

09:41:07encounter.createdenc_51b009:44:32encounter.in_reviewdr_2e1109:45:10encounter.completeddr_2e1109:45:11order.createdord_77c2

Every clinical action logged

Visits, prescriptions, benefits checks and orders: every clinical action is captured in an audit log you can export through the API.

export · any timeYoursanytime · even leaving

Your data is yours

You own all patient and operational data. Export it any time through the API, including if you decide to leave.

℞2FA · 428 916IDENTITY-PROOFEDPRESCRIBER

EPCS e-prescribing

Controlled-substance prescribing runs through EPCS with identity-proofed prescribers, as DEA rules require.

Patient recordrole-based · loggedONLY THE CARE TEAM

Access on a need-to-know basis

Clinical data access is role-based and logged. Patients are visible only to the providers and staff involved in their care.

Shared responsibility

What we cover, and what stays with you

Lithos carries the clinical and regulatory load as an extension of your team. Your team keeps the product, the brand and the relationship.

Lithos covers

The regulated clinical layer

Provider licensure and credentialingEvery encounter goes to a provider licensed in the patient’s state.
State complianceAsync and live-visit rules, prescribing rules, consent and board filings in all 50 states.
Clinical records and prescribingCharts, decisions and EPCS prescriptions, logged with who did what and when.
InsuranceMalpractice, general liability and cyber liability coverage for the care delivered through Lithos.
Medical oversightA medical director, or alongside yours if you have one.
Your diligenceQuestionnaires answered in writing, and the SOC 2 report under NDA when it’s ready.
You cover

Your product and your patients’ experience

  • Your product and its securityYour website, app or AI agent, and how patients sign in to it.
  • Consent captureYour app records the patient’s telehealth consent and sends the timestamp with the patient.
  • BillingPatients pay you through your own merchant account.
  • Your patient experienceHow care shows up in your brand, built on the events we send.
FAQ

Questions diligence asks

Can’t find yours? We’re happy to walk through your program.

Book a call
Do you sign a BAA?

Yes, with every customer, as part of standard onboarding. You don’t need an enterprise plan or a special request.

Where is the SOC 2 report?

Our SOC 2 Type II audit is underway. We share the report under NDA as soon as it’s available, and can walk your team through our controls before then.

Who is the practice of record?

Lithos is. Licensed providers review and treat under our protocols, and we handle state licensure and compliance. Your team runs the product and the patient relationship.

Is Lithos insured?

Yes. Lithos carries professional liability (malpractice) insurance covering every provider for the care delivered through Lithos, along with general liability and cyber liability coverage. Certificates of insurance are available on request.

Can we audit what happened on a given encounter?

Yes. Every clinical action is logged with who did it and when, and the log is exportable through the API.

What happens to our data if we leave?

You keep it. All patient and operational data is yours and exportable through the API at any time.

Will you complete our security questionnaire?

Yes. Send it over, and anything this page doesn’t answer we’ll put in writing.

Security and compliance

Bring us your diligence questions

Book a call with our team, or send your security questionnaire and we’ll answer it in writing.

Book a call Send your questionnaire