Health Worth handles information differently depending on whether you use an anonymous estimate, the local fictional-record demonstration, or the CMS sandbox.
The short version: Anonymous estimates require no account and create no persistent patient profile. Optional CMS sandbox data is temporary, protected, and automatically deleted.
Three separate data pathways
Anonymous estimates
No account or login is required. Your procedure, five-digit ZIP code, and price basis create the estimate. Health Worth does not create a persistent patient profile from those inputs, and anonymous estimate inputs are not placed in the CMS sandbox session store.
A shareable URL may contain the procedure, ZIP code, price basis, and selected time horizon needed to recreate the estimate.
Anyone who receives that link may view the same estimate.
The link excludes local synthetic-record fields, CMS sandbox records, tokens, and session identifiers.
Health Worth does not claim that ordinary web requests are never present in hosting or infrastructure logs.
Local synthetic FHIR demonstration
This optional demonstration uses one fictional record and no real patient data. The fixture and mapped fields are retained only in memory during the active browser session.
It does not contact an insurer, payer, provider, EHR, or patient record.
Refreshing, closing the page, or selecting disconnect clears the imported state.
Imported fields are excluded from shared URLs, analytics, and downloaded reports.
CMS Blue Button sandbox
This optional pathway uses CMS sandbox authorization and synthetic Medicare records—not real patient information. Production payer authorization and retrieval of real patient data are not implemented.
Authorization material, access tokens, and the minimum normalized synthetic claim information are retained temporarily in a protected shared server-side session store.
Sensitive session contents are encrypted while stored. The browser receives only a Secure, HttpOnly cookie and never the access token.
The random session identifier is stored as a one-way hash.
The session is deleted on disconnect, after 15 minutes of inactivity, or one hour after connection—whichever occurs first.
No persistent Health Worth account or longitudinal patient profile is created.
CMS session information is excluded from shared URLs, analytics, and downloaded reports.
How the anonymous shareable link works
A link such as ?procedure=knee-replacement&zip=60601 contains the values needed to recreate an anonymous estimate. Share it only with people you want to see that estimate.
What Health Worth does not do
Sell estimate or sandbox information to advertisers or data brokers.
Create a persistent patient profile from these pathways.
Put imported records or CMS session information into shared links or reports.
Retrieve real patient data from production payers.
Scope
Health Worth is a decision aid, not a clinical or insurance system. This page is not a HIPAA, SOC 2, ISO, clinical, or other certification.
Ongoing security review
Health Worth regularly evaluates its security and application practices as technology, threats, and industry standards evolve. Our security and application standards are formally reviewed at least annually and following material changes to our technology or data environment. Our application security practices are informed by recognized industry guidance, including the OWASP Top 10.
This describes our internal review practice. It is not a certification, audit, or attestation of any kind.
