Healthcare
Exchange PHI with partners and payers. Keep every transfer on the record.
Sharetru sits beside your billing system, EHR and clearinghouse as the one place files cross your boundary: SFTP and the API for scripts and partners' servers, links and the web app for people. Sharetru's BAA comes with the HIPAA Support Package, and every transfer lands in one exportable log.
- SendRemittance, reports and records to named recipients, by link
- CollectClaims, charge documents and uploads into the folder you choose
- ConnectSFTP, FTPS, SCP and the REST API for scripted exchanges
- TrackWho moved what, when and by which protocol — exportable
15-day free trial · HIPAA Support Package with Sharetru's BAA · Every protocol and the API included
- Recipient
- a.ruiz@ridgeview.exampleLink tied to this address
- Files
- 835-remit-09.edi+ reconciliation.pdf · no size limit
- Expires
- In 14 daysor after 3 uses
- Access
- DownloadMFA required at sign-in
Activity
- Link sent by SharetruMon 09:12 · r.patel@yourcompany.com
- Guest signed in with MFAMon 14:40 · a.ruiz@ridgeview.example
- Downloaded 835-remit-09.ediMon 14:41 · on the file log
- Forwarded copy refusedTue 08:03 · a different address at sign-in
Illustrative. Names, files and times are invented.
Beside your systems
Where does Sharetru sit beside our EHR, billing system and clearinghouse?
Beside them, as the governed point where files cross your boundary — not in place of your EHR, practice-management system or clearinghouse connection. Your scripts and your partners' servers connect over SFTP, FTPS, SCP and the REST API; staff, clients and clinicians use share links and the web app. All of it shares one set of folders, permissions and logs.
Retiring a self-run SFTP server? Sharetru has no scheduler of its own: your billing system, cron or Task Scheduler keeps the schedule and connects to the same hostname your partners' servers use.
People
Share links and the web app over HTTPS — clients and clinicians register once as free guests
Systems
SFTP, SCP, FTPS and FTPeS for your scripts and your partners' servers
Software
A 60-endpoint REST API for files, users, shares, permissions and activity logs
The problem
Every PHI exchange was set up by someone, for one partner, in its own way
The billing team sends remittance one way, the lab feed runs another, and a clinician forwards a record however the referral arrived. Each choice made sense when it was made. Together they leave IT with no one place to set the rules, and the privacy officer with no one record to show.
Three problems, one cause: PHI leaves your boundary from too many places. Sharetru gives every exchange the same one.
See how an exchange works-
The legacy server
The SFTP server behind the claims exchange is nobody's job
Someone built it years ago. Now it needs patching, its certificate keeps expiring, the person who understands it is one resignation away, and its log answers none of the questions an auditor asks.
Fixed by a hosted endpoint with the same protocols, SSH keys and IP rules. Your scripts and your partners' clients point at a new hostname, and every session lands on one log.
-
The evidence gap
PHI leaves by email because the proper channel is slower
A business-associate audit finds attachments and personal cloud folders, and nobody can say who received a file, when, or whether it was forwarded.
Fixed by links your staff create under a policy your administrator set once — recipient domains, MFA and expiry — with every send, sign-in and download on the same record.
-
Partner sprawl
Each client and payer was onboarded differently, and nobody owns it when staff change
Credentials per partner, folder access by memory, links that outlive the contract. Offboarding a coder or a client means finding everything they could reach.
Fixed by workspaces and groups an administrator assigns, link ownership you hand to a colleague, expiry by days and uses, and dual authorization for every new user.
Send, collect, connect
How do we exchange files with the practices, payers and labs we work with?
Systems exchange files over SFTP or the API; people send and collect them by link — same folders, same rules, one log. An outbound share carries up to 50 files or folders with no total size limit; uploads to an inbound link land in a subfolder of the folder where the link was created.
Send the remittance package to the practice. Collect the charge documents back.
A revenue-cycle company closes the month for a family practice: the reconciled remittance goes to the practice administrator by link, the encounter documentation the coders still need comes back through an inbound link, and the practice's own system drops its daily charges over SFTP — all under the policy the company's administrator set.
Select the 835 reconciliation and the month-end report and name the share.
Add the practice administrator. Sharetru sends her the link, tied to her address; a forwarded copy is refused at sign-in.
Set download or view-only, days and uses, or keep the defaults your administrator chose.
She signs in as a guest and downloads. The download is on the file log, by account and time.
Open the practice's folder — Clients / Ridgeview Family Medicine / September — and create an inbound link there.
Send it to the practice. They see your site's inbound memo and sign in as guests.
They upload the encounter notes and superbills. Files land in that folder and on the log.
The link expires by days or uses — or stays open as a standing drop-off when your administrator allows it.
The practice's server signs in over SFTP with the key you issued, from the IP range you allowed.
It drops the day's charge file into its own workspace and can reach nothing else.
Your billing job pulls the file on its schedule — cron, Task Scheduler or the API.
Both sessions are on the log: time, protocol, IP, account, command, file and bytes.
The same exchanges across healthcare
Providers and clinics
OutReferral records to a specialist
InResults and consult notes back
Pharmacy benefits and specialty pharmacy
OutReports to plan sponsors
InClaims files from PBMs and carriers
Labs and imaging
OutResults and studies to referring physicians
InRequisitions and prior images in
Transcription and coding
OutFinished notes back to the practice
InDictation and encounter files in
Health plans and TPAs
OutReports to employer groups
InEnrollment files from employer groups
Life sciences
OutStudy documents to sites and CROs
InSite data and safety reports back
How it works
How does a scheduled claims or remittance file move through Sharetru?
The file passes four Sharetru controls between your system and the partner's: credential, network rule, folder permission and the log line. Sharetru has no scheduler of its own. Your billing system, cron, Task Scheduler or Azure Data Factory keeps the schedule and connects to the same hostname your partners' servers use; nothing is installed on either side.
How one remittance file reaches a practice
Your billing job sends it. Sharetru checks it four times. The practice's server picks it up. The log writes itself.
Your scheduler stays yours.
Sharetru has no job engine, by design. cron, Task Scheduler, your billing system's export or Azure Data Factory keeps the schedule; point it at your Sharetru hostname and it runs as before.
Partners keep the clients they have.
Any standard SFTP, FTPS, FTPeS or SCP client connects, and plain FTP is available on Sharetru Commercial where a legacy system needs it. No agent to install, no portal to learn for system-to-system work.
Every session is on the record.
Each sign-in, upload, download, rename and delete is one log line with date, protocol, IP address, account, command, file and bytes — exportable as CSV, forwarded to your SIEM, or read through the API.
See it on your own Sharetru site — free for 15 days.Every protocol and the API included. Bring the SFTP script you run today.
Administrator controls
Which safeguards can an administrator set site-wide?
MFA, account lockout, session timeout, IP and country rules, link policy, retention and the auditor role are site-wide settings a site administrator sets once. Each is the kind of control a HIPAA Security Rule risk analysis names; the panel shows what you can set, not a compliance checklist.
The record
What can we show an auditor or a business-associate reviewer?
Four things: the file log of every action, the Shares list of every link, Sharetru's annual HIPAA assessment report and the BAA you executed. The first two are yours from the first day; the report is available under NDA during your trial.
- CSV
The file log: what happened
One line per event — sign-in, upload, download, delete, rename, share — with date, protocol, IP address, account, command, file name, bytes and status. Kept 72 months with the HIPAA Support Package.
Yours - CSV
The Shares list: what exists
One row per link, inbound or outbound: files, recipients, owner, uses and expiry. Extend, reassign or revoke a link from its row.
Yours - NDA
The HIPAA assessment report
A-LIGN assesses Sharetru's managed file transfer service against the HIPAA Security Rule every year and issues a report. Request it during your free trial; the mutual NDA in the Terms of Service covers it.
Under NDARequest it with your demo - BAA
Sharetru's Business Associate Agreement
The HIPAA Support Package includes Sharetru's signed BAA — Sharetru's own agreement, executed before the first ePHI moves. Redlines are handled as a Terms of Service amendment.
Yours, with the HIPAA Support PackageHow the BAA is requested
The SOC 2 Type II report is available the same way as the HIPAA report. Both name the subservice organizations behind the service; ask for the scope statement if your site runs on Sharetru Federal.
Where to get the record
- Logsfilter, export CSV
- SIEMforwarded by syslog
- REST APIactivity logs
- loghistory folderfull retention, by SFTP
Swipe sideways to see the whole row →
Illustrative file log · September remittance exchange
Illustrative entries. One line per event, never one per link. The real export carries date, protocol, process, port, IP address, user, command, arguments, file name, bytes and status.
Choose your platform
Sharetru Commercial with the HIPAA Support Package, or Sharetru Federal?
Sharetru Commercial with the HIPAA Support Package serves healthcare business associates and providers; Sharetru Federal is for work under a federal contract that requires FedRAMP Moderate. Same protocols, links, records and guest model on both.
PHI under HIPAA
For revenue-cycle, billing, transcription, pharmacy-benefit and benefits firms, providers, labs and life-sciences teams exchanging PHI and study files with partners.
- HIPAA Support Package: Sharetru's signed BAA, 72 months of logs, failed-login policies and disaster recovery — $100 a month on the plan page today
- SOC 2 Type II Attested; HIPAA audited annually by A-LIGN
- FIPS 140-2 validated encryption; AES-256 at rest; TLS 1.2 in transit
- Guest MFA by authenticator app, email or SMS; SSO for your staff
- Link sharing, view-only links and unlimited guests on Core and Complete; 15-day free trial
Federal health programs and contractors
For agencies and contractors whose contract requires a FedRAMP Rev 5 (Class C) Certified service (the new name for FedRAMP Moderate), or who hold CUI alongside PHI.
- FedRAMP Rev 5 (Class C) Certified IaaS, PaaS and SaaS — package F1311222650 on the FedRAMP Marketplace
- FIPS 140-3 validated encryption — the current federal standard
- Guest MFA locked to authenticator apps only — no email or SMS codes
- Optional dynamic watermarking on files a guest views through a link: merge fields such as the viewer’s address and the time, plus your own text
- U.S.-citizen staff and U.S. data residency; 12 months of log retention
FAQ
Questions healthcare teams ask before they move PHI
HIPAA and the paperwork
Is Sharetru HIPAA compliant?
There is no HIPAA certification; what Sharetru has is an independent assessment against the HIPAA Security Rule by A-LIGN, every year, with a report. Your own compliance depends on how you deploy and use the service, so the report, the SOC 2 report and the BAA are all available to review during your trial.
Do you sign our BAA?
Sharetru provides its own Business Associate Agreement as part of the HIPAA Support Package and does not sign customer-drafted BAAs. Redlines are treated as an amendment to the Terms of Service and may need a higher-tier plan. Execute it before the first ePHI moves; until it is signed, Sharetru assumes no HIPAA liability for your data.
Can we read the HIPAA and SOC 2 reports before we buy?
Yes — request the HIPAA assessment report and the SOC 2 Type II report during your free trial, under the Terms of Service NDA. Bring your security questionnaire to the same call; the answers describe the service as you will deploy it.
How it fits
Does Sharetru replace our clearinghouse or EHR?
No — Sharetru is the exchange point beside them, not a clearinghouse, an EHR or a practice-management system. Your clearinghouse connection stays where it is. Sharetru carries the files that move by SFTP, API or link between you and the partners that connection does not cover.
Does Sharetru schedule transfers?
No — Sharetru has no scheduler; your billing system, cron or Task Scheduler keeps the schedule and connects over SFTP or the API. Retention rules run inside Sharetru once a day; everything else that moves on a timer is driven from your side.
A payer requires PGP-encrypted files. Can Sharetru do that?
Not inside Sharetru: files are encrypted in transit and at rest, but Sharetru does not hold PGP keys or encrypt file contents for you. If a trading partner requires PGP or AS2, encrypt before upload and decrypt after download — and raise it on the first call, so it never surprises anyone at the end of a trial.
Do our clients and the clinicians we work with need Sharetru accounts?
People who receive or send files by link register once as free guests and sign in with the address the link was sent to. Staff and systems that own folders or connect over SFTP or the API are registered users and count toward your plan.
Can patients or employees send us documents without an account?
Yes — an inbound link lets a person upload into the folder you choose after a short guest registration. Uploads land in a subfolder of the folder the link was created in; uploaders do not see one another's files, and every upload is on the log.
Can an SFTP connection use MFA?
SFTP authenticates with an SSH key or a password; MFA codes apply to the web app and to share links. For a system account, pair the key with an IP-range restriction and a protocol restriction, so the account works from one place, one way.
The record
Can an auditor see the logs without being able to change anything?
Yes — the auditor role sees logs and reports and changes nothing. Give it to your compliance officer or an outside assessor for the review period and remove it afterwards.
Where is our data stored, and who can reach it?
In U.S. data centers, run by the subservice organizations named in the SOC 2 and HIPAA reports. Sharetru Federal adds U.S.-citizen staff and U.S. data residency as contractual controls for CUI.
What about backups and disaster recovery?
Backups run every night, and the HIPAA Support Package adds disaster recovery; ask for the current recovery objectives for your platform during the trial. The contingency-plan controls on your side — your copies, your exports — stay yours.
Life sciences
We're a pharma, biotech or device company. Does Sharetru support 21 CFR Part 11?
Sharetru has not been assessed against 21 CFR Part 11 and has no electronic-signature feature. What it offers life-sciences teams is a governed exchange point for files moving between you and CROs, sites, labs and contract manufacturers, with every action logged and exportable. Whether a transfer system is in scope for your validation, and the validation itself, stay with you.
See it work
See a remittance exchange from the SFTP drop to the log export.
We run a complete exchange on a live Sharetru site with sample files: a billing job drops a remittance file over SFTP, the same file goes to a test practice by link, and we show the record it leaves behind — and where the BAA and the HIPAA report come from.
Replacing a self-run SFTP server, an MFT platform or a process that grew on its own? Talk through how you move files today, 30 minutes, no slides. Or read the HIPAA compliance page.
Sources. Facts on this page come from the Sharetru plan comparison, the Knowledge Base (Business Associates Agreement, Account Lockout Policies, File Retention, timeout settings, the log file reference and the Link Based File Sharing guides), the developer documentation and the scope of Sharetru's annual A-LIGN assessments. Product screens, names, files and log entries on this page are illustrative.