The third parties that support the Corevia platform, what each one does, and whether it can access protected health information.
Effective: September 1, 2026 · Last updated: September 1, 2026
We publish this because every serious security review asks for it, and answering the question once in public is faster than answering it forty times in a questionnaire. It sets out every category of subprocessor that supports the Corevia platform, what each one does, whether it can touch protected health information, and the agreement that governs that access — which is what a reviewer is actually assessing.
Providers are identified by role rather than by name. The specific entities, and the underlying agreements, are provided under NDA as part of the security diligence pack: legal@coreviahealth.com. Customers under a Business Associate Agreement receive the named list, and notice of material changes to it, in accordance with the notice terms of their agreement.
Corevia Health, LLC is a California limited liability company.
| Category | Purpose | Can access PHI? | Agreement |
|---|---|---|---|
| Cloud infrastructure provider | Hosting, storage, networking and key management, United States regions only | Yes | BAA |
| Clinical data platform | FHIR R4 record storage and access control | Yes | BAA |
| AI services, in-account | Clinical documentation drafting and clinical assistance, running inside our own cloud account | Yes | Covered by the cloud BAA |
| Document data extraction | Reading identity documents during verification | Yes | Covered by the cloud BAA |
| Medical speech transcription | Visit audio transcription for the AI scribe | Yes | Covered by the cloud BAA |
| E-prescribing provider | Surescripts-certified electronic prescribing | Yes | BAA |
| National reference laboratories | Diagnostic laboratory services and result delivery | Yes | Direct agreement |
| 503A compounding pharmacy partners | Prescription compounding and fulfillment | Yes | Direct agreement |
| Transactional email delivery | Account and notification email | Limited | Covered by the cloud BAA |
| Payment processor | Card processing — on Corevia's merchant account where the clinical networks are used, otherwise on the customer's own | No | Corevia's or the customer's merchant agreement, per the arrangement below |
| Website delivery and analytics | Cookieless, aggregate measurement for coreviahealth.com only | No | Standard terms; no PHI in scope |
The AI services listed above run inside Corevia's own cloud account under that provider's Business Associate Agreement. No third-party model vendor, and no outside scribe service, receives protected health information — and nothing is used to train anyone's model.
The payment processor row is different in kind from every other row, because who the processor answers to depends on what the customer licenses.
Where Corevia's physician and pharmacy networks are used, Corevia is the merchant of record and processes payments. The processor relationship is ours, and it is disclosed here as a subprocessor for that reason. Corevia is compensated by platform fee rather than a share of transaction volume, so the commercial incentive that usually comes with sitting in the funds flow is absent by design.
Where the EMR and e-prescribing are licensed without those networks, the customer may keep their own processor account under their own merchant agreement — in which case that relationship is theirs, not ours: they select the processor, sign its terms, and are its counterparty.
In both arrangements the processor receives what it needs to take a payment and no protected health information from the clinical record. This is set out in more detail on the payments page.
Why this is by category rather than by company. What a security review needs to establish is which functions touch protected health information, on what legal basis, and whether anything sits outside a Business Associate Agreement. Every one of those questions is answered above. The specific corporate identities are commercial information, and several of them vary by customer — the compounding partners are chosen per tenant, and on EMR-only licenses so is the payment processor.
We provide the named list, and the underlying agreements, under NDA as part of the security diligence pack. Customers operating under a Business Associate Agreement receive it as a matter of course, together with notice of material changes. Ask at legal@coreviahealth.com.
Questions about this list, or a request for the underlying agreements as part of a security review: legal@coreviahealth.com
Corevia Health, LLC