Trust
The paperwork answers, before you ask for them.
HIPAA-compliant data handling. Supports CAP-accredited workflows. CLIA-ready reporting. The details, in plain English rather than badges — and we’ll answer your compliance officer in writing before you upload anything.
Three questions you’d ask on a call. Here they are early.
Where does patient data live, and who can read it?
Data handling is HIPAA-compliant, and we’ll put the specifics in writing before you upload anything — including whether we’ll sign what your compliance officer needs.
What do I hand an inspector?
A branded PDF report per accession, versioned when amended, with who changed what and when. Controlled records — CT cutoffs, permissions — carry an audit trail, and every table exports to CSV.
Can I evaluate this without PHI?
Yes, and you should. Sign in to a deliberately blank demo lab, or use the de-identified sample manifest we supply, and go all the way to a released report without a single patient on our side.
HIPAA-compliant data handling
Patient data is encrypted in transit and at rest, and access follows your lab’s own permission grid: your administrators decide who can order, accession, review, approve and release, and the grant itself is a controlled record — who gave which permission, and when, has an answer in the audit trail.
Our side of the fence is structural, not procedural. The lab application and the platform administration are two separate apps, isolated by role: a platform administrator cannot pay for a lab’s report, approve its runs, or delete its orders. Platform staff can look, never act as the lab.
And before you upload a single record: send us what your compliance officer needs — a questionnaire, an agreement, a specific question about storage or access — and we answer in writing, including whether we’ll sign what they need signed.
Supports CAP-accredited workflows
Accreditation belongs to your lab. What the software contributes is a sequence an assessor can follow: QC passes before review opens, every live result is called before release, and the release gate names exactly what is missing rather than letting a report slip past it.
Controlled records carry an audit trail — who changed an assay’s CT cutoffs, who granted which permission, and when. Separation of duties is visible rather than pretended: when the approver and the releaser are the same person, the record says so in writing and lets you through, because staffing is your policy, not ours. And an amendment makes version 2 with a typed reason, who amended it, when, and a supersedes line on the face of the document.
CLIA-ready reporting
Seven fields before any report can release: lab name, laboratory director, CLIA number, address, phone, lab email, logo. Take one away and the release gate refuses — and names the field. Fax, website and tax ID stay optional, because blocking a lab’s first report over a fax number would be theatre.
For labs outside the United States the same gate holds for your license number (CLIA in the US) — it prints on every report, next to your director’s name, on your letterhead.
Where your data lives
Your lab’s records live in one production environment, behind the sign-in at app.pcrlabpro.com. The demo lab at demo.pcrlabpro.com is a separate build that runs entirely in your browser on fictional data — nothing you do there reaches our servers, and nothing there is a patient. The companies that touch production data, and in what role and region, are listed on the subprocessors page.
Your data on the way out
Every table in the app exports to CSV, whenever you like — orders, accessions, runs, results, reports. The export is spreadsheet-injection hardened, so a cell that arrives looking like a formula leaves as text, not as code your spreadsheet runs. Reports leave as branded PDFs. You are never locked in by your own records, and the exit is always open.
Evaluate without PHI
Two doors, neither needing a patient. The demo lab is fictional end to end — walk a working lab or start from a blank one. Or take the de-identified sample manifest and result file on the manifest-format page and run the whole loop in your own account: order, accession, run, release, all the way to a signed PDF, before a single real specimen is involved.
Who touches data, and where to report a problem
The subprocessor list — name, role, data touched, region — lives at /legal/subprocessors, linked from the footer of every page. Found something that worries you, in the product or in this page’s claims? Write to support@pcrlabpro.com — a person reads it, and security reports go to the front of the queue.
We’ll answer your compliance officer in writing.
Send the questions before you send any data. Or start with the free report — the demo doors and the sample files mean the evaluation never needs a patient.