Is Strkr HIPAA compliant for physician practice use?
Yes. Strkr is HIPAA compliant with a signed Business Associate Agreement available for all physician practice customers. The BAA covers all Strkr services touching PHI (patient records, communication, SMS through Strkr Messaging, email through the native SMTP flow, integrations with EHRs and patient portals). HIPAA technical safeguards include encryption at rest and in transit, role-based access controls scoped to minimum necessary, audit logging on every PHI access, and session timeout for inactive users. HIPAA administrative safeguards include workforce training requirements, incident response procedures, and periodic access review. For practices with heavy aesthetic and elective work (dermatology, plastic surgery, LASIK, bariatric) where marketing to the patient panel is a core workflow, the BAA explicitly covers the marketing campaigns with PHI minimum-necessary scope. Strkr is also pursuing SOC 2 Type II certification which continues through 2026-Q4 for additional security attestation. GDPR and CCPA compliance covers international and California patients.
What EHR integrations ship for physician practices?
Native integrations for the common ambulatory EHRs: Epic (via MyChart FHIR APIs for the ambulatory practice shape), Cerner PowerChart (now Oracle Health), athenahealth athenaOne, eClinicalWorks, Allscripts Professional and TouchWorks, DrChrono, Kareo (now Tebra), Practice Fusion, NextGen, Greenway Health, AdvancedMD, SimplePractice (behavioral health specific), TherapyNotes (behavioral health specific). The integration surfaces demographics, appointment history, procedure history, and encounter notes (where available) into Strkr for the relationship-management context. Writeback capability varies by EHR vendor; Epic FHIR writes are limited by scope. For hospital-affiliated practices using an enterprise EHR, the integration surfaces the ambulatory practice slice without exposing the enterprise-wide clinical data. KMS-encrypted credential storage with the integration debugger surfacing every sync event.
How does Strkr handle TCPA consent for SMS appointment reminders?
TCPA compliance for SMS requires express written consent from the patient before promotional or appointment reminder messages. Strkr's consent workflow captures the consent through the intake form (with the specific TCPA language), the patient portal, or the paper intake stored as a signed document. The consent record stamps the patient profile with the executed consent date and scope (appointment reminders, recall campaigns, marketing content). SMS messages respect the consent scope with the audit log tracking every outbound message. For patients who opt out via STOP keyword, the opt-out stamps the profile immediately and blocks future messaging. For practices moving from paper-based consent to digital capture, the backfill workflow handles the transition without re-consenting existing patients.
How does the referring physician cultivation workflow work?
Each referring physician record carries practice affiliation, specialty, NPI number, referral volume by quarter, last liaison visit, upcoming visit, specific clinical interests, personal preferences, and cultivation state (scored 0 to 100). The physician liaison owns a territory of referring physicians with structured cultivation cadence (quarterly visit minimum, clinical update distribution, speaker program invitations). Weekly liaison review surfaces overdue cultivation, declining referral volume signals, and upcoming visit targets. The liaison visits capture structured notes (clinical discussion, specific interest surfaced, next-step commitments). Quarterly review ties referral volume trends to cultivation activity for the practice administrator conversation. For practices without a dedicated liaison role, the physicians themselves run the cultivation with the same structured cadence (particularly in specialty practices where the physician relationships drive the referrals).
Can the practice send marketing to the patient panel under HIPAA?
Yes with the appropriate consent and HIPAA scope. Marketing communications using PHI require patient authorization under HIPAA (except for narrow exceptions like appointment reminders and treatment-related communications that fall under the HIPAA Privacy Rule exceptions). Strkr's marketing campaign module captures patient authorization through the digital or paper intake with the authorization record stamped on the profile. Campaigns respect the authorization scope with minimum-necessary PHI exposure (typically patient name and procedure interest, not clinical detail). For aesthetic and elective practices where marketing to the patient panel is a core workflow (dermatology aesthetic services, LASIK, bariatric, cosmetic dentistry, plastic surgery), the authorization workflow runs through intake with specific scope agreed. For practices sending educational content without PHI (newsletter, blog content, general practice updates), authorization is not required because no PHI flows in the message.
How does Strkr handle scope of practice for mixed-credential teams?
Each clinician record carries credentials (MD, DO, NP, PA, PT, OT, LCSW, LPC, LMFT, DNP, PsyD, PharmD) and specific authorities (prescribing authority, scope of practice limitations per state, supervision requirements for PAs and some NP configurations). Intake routing respects the scope so patients needing medication management route to prescribers rather than therapists, patients wanting therapy route to therapists rather than medication-focused prescribers. For practices with supervisory relationships (PA supervised by MD, resident supervised by attending), the supervision chain surfaces in the clinical workflow for countersignature and oversight. Marketing communications respect scope so a message about medication management does not route to a LCSW's patient panel. For practices crossing state lines (telehealth, multi-state operations), the per-state scope rules apply to the patient encounter.