Compliance as a service
Compliance handled, so you can launch
HIPAA with an in-product BAA, LegitScript, Surescripts-certified e-prescribing, SOC 2 (pending) and a PCI-compliant payment vault — built into the platform instead of bolted on before launch.
Certifications
The certifications buyers ask for first
The four answers every partner, pharmacy and payment processor needs before they say yes.
Patient data is encrypted at rest and in transit, and your business associate agreement is signed inside the dashboard and tracked per clinic, not chased over email.
Bask is LegitScript certified, and eligible plans include a discount code toward your own brand's certification.
E-prescribing runs on Surescripts-certified software, so prescriptions reach the pharmacy the way regulators expect.
SOC 2 (pending) on every plan, and card details stay in a PCI-compliant vault that never touches your servers.
Controls
Controls a reviewer can check
Logs, permissions and visit rules you can show an auditor, not just describe.
Every action on the record
Audit, user, activity and session logs, plus a log of every call made with your API keys — each entry with the actor, the change, the source IP and the result.
Access down to the permission
Over 100 discrete permissions instead of four fixed roles, so each person on your team sees only what their job needs.
The right visit for every state
Visits are asynchronous by default, and the software switches to a synchronous visit wherever the state or the treatment requires one.
Isolated by construction
Which store a request belongs to is decided on the server, never trusted from the browser, and every patient call checks that the patient and the store match.
Multi-factor sign-in
Require a second factor for your team on Enterprise, on top of encrypted sessions.
Separate keys
Publishable keys for the browser, secret keys for your server, and admin keys that can't read patient data.
Agreements in one place
BAAs and clinic service agreements signed in-product, with their status visible per clinic.
FAQ
What Bask covers, and what stays with your brand.
Yes. Patient data is encrypted at rest and in transit, and you sign a business associate agreement with Bask inside your dashboard.
Bask is LegitScript certified as a platform. Your brand may still need its own certification to advertise, and eligible plans include a discount code toward it.
Yes. Prescriptions are sent through Surescripts-certified software.
Visits are asynchronous by default. The software knows which states and treatments require a synchronous visit and switches the visit type automatically.
Yes. Audit, user, activity and session logs record every action with the actor, the change, the source IP and the result, including calls made with your API keys.
Launch without the compliance backlog
Start on a platform that already answers the questions your partners will ask.