The credentialing pipeline, the audit playbook, the data we collect, the rules we enforce, and the signals we monitor every day. Read the version that matches your role.
No fast track. No founder favors. A clinic doesn’t see a JetPatient patient until every stage closes — and then they’re monitored daily for the life of the partnership.
Accreditation tells you about the building. We check the people. Every surgeon performing JetPatient procedures clears the same six checks — re-verified annually against the issuing board’s registry, not against clinic attestation.
Accreditations cover paper. Our on-site audit covers reality. Here’s what we watch for during the 3-day audit, and the floors we enforce for every JetPatient partner facility.
Accreditation is a floor. Outcomes are the ceiling. Every JetPatient procedure feeds the same Outcomes Registry — 480k procedures and counting — so we can compare a partner clinic against the U.S. median for the same procedure on the same patient profile.
This section describes what the clinic pays. On the patient side, JetPatient adds a disclosed 15% platform fee to the clinic’s price, shown before commitment. The clinic receives its price in full.
Nothing a clinic pays JetPatient varies with the number or value of patients it receives. That is why placement on JetPatient cannot be bought.
If you’re considering applying, this is exactly what we’ll need from you, what we’ll verify ourselves with the issuing bodies, and how long each stage typically takes if there are no holds.
These are the hard floors. Any one of them auto-rejects at the stage where it’s observed. They’re the same floors a U.S. hospital network would use for a credentialing committee — we just publish them.
Once you’re live, the SaaS portal handles most of it automatically. These are the things you’re still on the hook for.
Drop your URL and your JCI certificate number. Copilot will scrape your site, registries, and license boards, and pre-fill 80% of the application before you sign in.
JetPatient is structured as a flat-fee SaaS platform, not a referral broker. We don’t take per-patient compensation from clinics, which keeps us outside the Anti-Kickback Statute exposure pattern and clean of the Corporate Practice of Medicine prohibitions in all U.S. states.
For your ERISA fiduciary review, every decision JetPatient makes — every clinic admit, every suspension, every patient routing, every credential refresh — is written to an immutable audit log. Quarterly attestation reports ship to your compliance team automatically.
For your fiduciary review, here is the canonical list of data sources behind every figure JetPatient surfaces in your dashboards, reports, and patient-facing surfaces.
For your benefits committee, your TPA, and your ERISA fiduciary review. Includes plan-document language, SBC carve-out template, AKS structuring memo, state CPOM safe-harbor mapping, HIPAA + state-privacy posture, sample BAA, SOC 2 Type II report, and the Outcomes Registry methodology white paper.
JetPatient builds AI into a regulated category — cross-border surgical care. Every model ships with a public model card naming its intended use, training data, performance targets, fairness audit, limitations, and operating status. Three principles hold for every surface.
Every AI surface carries a visible status badge: scripted demo, conceptual prototype, pre-production, or production. The badge is on the model card and on every page that surfaces the model.
Every JetPatient AI output feeds a human reviewer — a benefits coordinator, a surgeon, a nurse navigator. No model makes a clinical, financial, or coverage decision on its own.
Patient- and clinician-facing assistants ship with citations on clinical statements and an explicit refusal contract for out-of-scope queries. We'd rather refuse and route to a human than guess.
JetPatient handles cross-border surgical care — clinical records, AI inference, payments, identity. This is the security posture as it stands today, what's on the active roadmap, and how to request the formal procurement pack. We'd rather show the gaps than pretend they aren't there.
TLS 1.2+, HSTS preload (max-age=31536000; includeSubDomains; preload). Provider-managed certificates, automatic renewal. Plaintext HTTP requests redirected unconditionally.
CSP locked to self; script-src + style-src allow only allowed CDN origins and analytics; frame-ancestors 'none'. Telehealth surfaces get a scoped Permissions-Policy opening camera+mic only on that page.
X-Frame-Options: DENY, nosniff, strict-origin-when-cross-origin, COOP, CORP. Permissions-Policy locks camera, mic, geolocation, and payment by default.
HMAC-signed session cookie, fail-closed. Constant-time compare, 30-day TTL, HttpOnly + Secure. If JP_GATE_SECRET is unset, every gated request returns HTTP 503 with an operator-facing message.
All production secrets are held in the hosting provider’s secret store, never in source. Build-step preflight (check-env.js) fails the deploy if a required secret is missing or under length. Documented rotation runbook.
Every mutation against the Network Spine (cases, outcomes, payments, messages, artifacts, flags) writes an audit row keyed by actor, timestamp, namespace, and action. Daily backups, 14-day retention.
When live AI is unavailable, every endpoint returns 200 with a labelled SAMPLE response — never a silent failure. Clinic cohorts below the publish threshold show PENDING, never demo numbers behind a small pill.
CI build runs npm run check:env:strict && npm test — any failure kills the deploy. A separate CI runner executes end-to-end smoke tests + First-Patient Journey chain against every preview deployment.
For procurement, security reviews, and enterprise diligence: email trust@jetpatient.com with the company name, the use case, and the artifacts you need. We typically respond within two business days with:
Real-time health for every public JetPatient endpoint and AI surface. Reads come straight from the production Functions — what you see is what visitors are seeing right now. AI endpoints that return a labelled SAMPLE response count as healthy: that's the documented graceful-fallback path, not a failure.
A row is marked down only on 5xx, timeout, or unreachable. SLA targets per surface live in the (private) ops dashboard at /admin/ops.html; the public version ships with the Drift, Fairness & Audit Console (above).
JetPatient ships in numbered “blocks” — each one a focused, testable, verifiably-green increment. Updated in the same PR that ships the block. For the full internal release notes on any specific block, email trust@jetpatient.com.
Built the public Trust hub: status, security, changelog, honesty/badge explainer. Shipped a canonical jp-trust-badge component that renders consistent LIVE/CACHED/SAMPLE/PENDING/VERIFIED badges with rich tooltips. The team's discipline around labelling sample-vs-live data is now productized as a reusable component and public source-of-truth page.
Removed the in-source fallback for the gate signing secret; auth.js + gate.js now return HTTP 503 with an operator-facing message when JP_GATE_SECRET is unset or under 32 chars. Promoted the First-Patient Journey simulator into a unit-test spec + a vanilla-Node HTTP companion that runs against every deploy-preview via the CI runner.
First-Patient Journey Audit closed: a P0 Scribe defect (transcripts sent as String instead of Array, silently 400'd every clinician click since Block 18) and a P1 credibility risk (clinic profiles substituting demo cohort data when real cohort was empty). Added a 24-check consumer-contracts test suite across 13 endpoints.
One-click routing for every AI workbench output: Scribe SOAP notes auto-route to the patient inbox as encounter_summary threads; high-risk Risk Engine results auto-route as risk-alert threads; Navigator turns become case-timeline entries. Every routed artifact carries a sourceArtifactId so the audit trail traces thread → artifact → AI usage → audit log.
Every AI workbench result auto-saves to NS.PATIENT_ARTIFACTS with an AR-prefixed ID. The 3-most-recent results sit in a history strip beside the workbench. Risk Engine gains side-by-side comparison of consecutive runs. Patient Passport gains a 6th “Recent AI activity” card.
New NS.FLAGS namespace + flags.js Function + jp-flags.js client (60s sessionStorage cache, fails-open false) + /admin/flags.html admin surface. SHA-256 sticky bucketing for percentage rollouts.
Every clinic profile gains a real outcome cohort engine reading NS.OUTCOMES with an inline SVG recovery-curve chart (30/90/180/365 day trajectories with 25th/75th percentile bands).
State machines for quote, payments, BNPL, settlements, disputes, insurance. Stubbed adapters for Stripe, CareCredit, Affirm, Klarna, Splitit, GreenSky — every transition wired but no real money moves yet. The integration surface for the partnership track to fill in.
New callAnthropicWithFailover (2-retry exponential backoff [500,1500]ms → NS.LLM_CACHE SHA-256 prompt cache → sample). Every AI response carries source ∈ {live, cache, sample, no_key, failed}. recordAiUsage writes per-call telemetry.
Daily backups (NS.BACKUPS, 14-day retention), audit log (NS.AUDIT), client error reporting (NS.CLIENT_ERRORS wired to 94 pages). Fixed a critical latent rate-limit bug where 5 of 7 LLM endpoints had been silently bypassing Claude since Block 9.
Our network team will walk through any of this with you in detail — whether you’re a patient considering care, a clinic considering joining, or a benefits team scoping a carve-out.