Branch scope
A reviewer starts with the records and branches within their assigned scope.
Security & compliance
Confidence starts
with clear answers.
Understand who can access information, how a review is recorded, and what your agency needs to evaluate before connecting a system.
Review context
Reviewers see the evidence, responsibility and follow-up attached to their work.
Administration
Administrators manage who can enter the workspace and which records are connected.
Start with the security reviewBefore connecting agency records, review access controls, data handling, contractual responsibilities and supporting assurance documentation with our team.
Access follows responsibility.
The product experience separates agency and branch records and gives people access appropriate to their role. Security review should establish the operating controls behind that experience.
Agency separation
Keep records scoped to the organization and branch they belong to.
Role-based access
Give reviewers and administrators the access their responsibilities require.
Protected connections
Manage source-system credentials within the authenticated setup process.
Traceable activity
Keep actions, ownership, and supporting evidence attached to the review.
Encryption, authentication, access reviews, backups, incident response, retention, and service-provider controls belong in the technical evaluation before production use.
People make the consequential decisions.
AI-assisted review presents a finding with its source information and uncertainty. Your team reviews that context and decides what to do. A suggested action is not an automatic change to a patient record, source system, claim, or care decision.
- Visible source context behind each finding
- A clear distinction between suggestions and completed actions
- Recorded ownership, decisions, and follow-up
Match the review to your requirements.
Agency obligations depend on the services, jurisdictions, payer relationships, data, and workflows involved. Define that scope before evaluating the product.
| Review area | What to establish |
|---|---|
| HIPAA & ePHI | Applicable safeguards, responsibilities, data flows, and business associate agreements before handling protected information. |
| EVV | The applicable program and state requirements, source-system responsibilities, and which records the review uses. |
| Payer & agency rules | Which authorization, credential, documentation, and billing requirements apply to the intended workflow. |
| Evidence & retention | Access, record retention, exports, audit history, deletion, and incident-handling responsibilities. |
HHS describes the role of business associate agreements and HIPAA security safeguards. CMS provides guidance on Medicaid EVV requirements. These resources do not attest to Oververa’s compliance.
Evidence before assurance claims.
No SOC 2, HITRUST, ISO certification, penetration-test result, uptime commitment, or universal regulatory approval is claimed on this website. AWS service eligibility or a cloud agreement alone does not establish the compliance of the complete application.
A production security review must evaluate actual controls, contracts, operational practices, and evidence for the environment your agency would use.
Discuss your requirementsA clearer next step
starts here.
Walk through authorizations, visit records and follow-up with us.
Request a demo