Outsourcing clinical work means trusting a partner with your patients’ most sensitive information. Caldera operates under written HIPAA safeguards, the stricter 42 CFR Part 2 rules wherever substance use disorder records are involved, and licence verification against every issuing state board — with a BAA signed before we go live.
Behind every control is a concrete outcome for your business and your patients. Here's what our controls buy you.
Nurses work in locked-down environments with role-based, least-privilege access, provisioned at hire and revoked the day someone leaves — so patient data is only ever seen by the people who need it.
Licences are verified directly with the issuing board at hire and re-verified at renewal, and no nurse takes a call for a state where their licence or compact privilege isn't active — so you're never exposed to unlicensed practice.
HIPAA-trained teams for healthcare, GDPR- and CCPA-ready processes for consent and data-subject requests, and the DPAs and BAAs your compliance team needs — signed before we go live.
Great security starts with trained people. Every credential below is earned, maintained, and applied to how we handle your patients.
State Board of Nursing
Telehealth is practised where the patient is, not where the nurse is. Every RN we place holds an active, unencumbered licence in the states their programme covers, verified against the issuing board and re-checked at renewal.
Interstate Commission of Nurse Licensure Compact Administrators
A compact privilege lets a nurse whose primary residence is in a compact state practise in every other compact state without a separate licence. It is the fastest route to multi-state coverage, and we verify it the same way we verify a single-state licence.
State Board of Nursing
Some programmes — structured follow-up calls, adherence coaching, monitoring outreach — sit properly within LPN scope. Where that is the case we staff LPNs, supervised by an RN, and we do not ask an LPN to perform assessment or triage that requires an RN.
American Heart Association or equivalent
Required of every nurse on our clinical roster and kept current. It is rarely used on a telehealth call, and it is not optional.
Beyond our people's training, these are the regulatory obligations we work under and the internal controls we operate before any patient data reaches us.
45 CFR Parts 160 and 164
Protected health information is handled under written policies covering administrative, physical and technical safeguards. We sign Business Associate Agreements before any programme goes live, and nurses work in locked-down environments with access limited to the patients on their panel.
Controls we operate — not an external certification
Nurses can reach only the patients on their own panel. Access is provisioned at hire, reviewed on any role change and revoked the day someone leaves; portal activity is logged. These are internal controls we operate and can walk you through — not an audited certification.
42 CFR Part 2
Where a programme touches substance use disorder treatment records, the stricter Part 2 consent and redisclosure rules apply on top of HIPAA, and our behavioral health nurses are trained to them.
Individual state boards of nursing
Every licence is verified directly against the issuing board at hire and re-verified at renewal. Nurses do not take calls for a state where their licence or compact privilege is not active.
We hire for empathy and potential, then invest in paid training and clinical supervision — so our nurses can handle sensitive conversations with care and confidence. If that sounds like you, there’s a place for you here.
Every program we run carries the full weight of our controls behind it. Tell us what you need — we'll show you exactly how your patients' data stays protected.