Where would your documentation stand up if CDPHE walked in tomorrow?

What happens to what you type here

1. Nothing is uploaded. The questions, your answers and your result are computed inside this page. The only request it makes is for the typeface, before you answer anything — it carries nothing about you, and you will see it in the network tab because we would rather you did.
2. Closing the tab erases it. Your answers live in this browser tab only, so you can resume if you refresh — and they are gone when you close it.
3. We never ask for a member. Every question is about how your agency works, not about a person. No name, date of birth, address or record number belongs in any answer here — and none is requested.
4. So there is no health information here to protect. That is a stronger position than a badge: there is nothing on this page for us to lose.

And when you send us real notes

The live audit reads your actual service notes. Here is every step, in order, so you can check it rather than take our word for it.

1. You pick the file. It is not uploaded. Your browser opens it locally. Nothing has left your computer at this point.
2. Identifiers are found and replaced on your device. Names, dates of birth, addresses, phone numbers, emails and record numbers become pseudonyms — MEMBER-01, CAREGIVER-03.
3. The key stays with you. The map from MEMBER-01 back to a real person is generated on your device and never transmitted. We cannot re-identify your file, because we never receive what would let us.
4. Pseudonyms are numbered by order of appearance, not alphabetically. An alphabetical rank is itself derived from the name — MEMBER-01 would tell you whose name sorts first. Ours tells you nothing.
5. You review it before anything is sent. You see every replacement that was made, and anything the pass wasn't sure about, and you approve it. Nothing moves until you do.
6. Service dates survive; birth dates do not. A date of service is what makes a note auditable, so it stays. A labelled date of birth is removed.
7. What we receive is the de-identified text. No names, no birth dates, no addresses, no record numbers — and no way to work backwards to them.

You can check every word of that. Turn your wifi off and run the de-identification anyway — it completes, because that step never needed the network. Or leave your browser's network tab open and watch it stay empty until the moment you press send.

We don't put a compliance badge on this page. That isn't caution, it's accuracy: no authority certifies software as HIPAA-compliant, and a vendor asserting it about itself tells you nothing you can check. What we'll do instead is describe the mechanism precisely enough that your compliance officer can reach their own conclusion — and for contracted clients, whose real data does flow through the product, we sign a Business Associate Agreement before go-live.