Less data. More intention.
A practical approach to protecting business accounts and keeping clinical information out of delivery workflows.
Start with less.
Our sandbox accepts business account details and synthetic delivery metadata: opaque order references, order value, purchase type, and delivery issue category. Do not submit real patient information, medication names, prescriptions, diagnoses, addresses, or clinical documents.
Access has a purpose.
Accounts use one-time email codes through Amazon Cognito, without a password. Merchant API requests are scoped to the authenticated account. Super administrators manage reviews and agreement assignments. API keys are stored as hashes and can be rotated. Client admin access is time-limited and records the actual operator. Bank changes and agreement signing stay with the company owner.
Private cases, controlled files.
Claim links use a private credential that can be reset and revoked. Synthetic evidence is stored privately, and a completed upload is pinned to the accepted file version. Downloads require an authorized request and use links valid for at most two minutes. Staff-only files and notes are excluded from customer and company-owner views.
These controls support sandbox testing. They are not approval to upload patient data. File screening, production retention rules, and the full healthcare data flow still require review before real customer evidence is accepted.
Bank details stay controlled.
Full bank account details are encrypted with AWS KMS before storage. Dashboards show masked summaries, and full-detail views require an authorized account and create an audit event. Cross Coverage’s receiving instructions are private until an administrator explicitly shares them with reviewed clients. Automatic ACH processing is not active yet.
A clear record.
Order creation, key rotation, document assignment, acceptance, and claim updates create audit events. An accepted agreement records the document’s content fingerprint, version, authenticated account, signer name, and timestamp.
Healthcare requires more than hosting.
This sandbox is not approved to process protected health information. Before healthcare data processing is enabled, Cross Coverage needs the appropriate business associate agreements, a documented risk assessment, retention and incident procedures, and a review of the exact production data flows. AWS eligibility alone does not make an application HIPAA compliant.
See HHS guidance on cloud services and AWS’s HIPAA guidance.
Need help with your account?
Contact your Cross Coverage account representative. For a delivery issue, use the delivery help portal or contact your merchant. Do not send clinical information through support channels.