TPA Checker: Security and Privacy Sheet
Made by The Admin Doctor. Describes version 5.4.4.
TPA Checker works on your clinic's own computer. It does not upload patient files, and the program's code is readable text that your IT person can inspect. Every statement below is something the program actually does, and each one has a way to check it.
Where your clinic's data goes
Patient data stays on the clinic computer. The TPA file and CMS export you choose are read there, and results are saved to a folder on the same computer.
- Patient names, ID numbers, amounts, the files themselves and the results are never sent to the vendor or to anyone else.
- The "Hide patient names in the results" option keeps names out of the result files.
- If a file's format is not recognised, the optional "masked sample" saves only column headings, the kind of content in each column and row counts. You see exactly what it contains before deciding whether to send it.
What the vendor holds about your clinic: clinic name, billing email, licence code and payment status. For each computer, the licence check also records a scrambled computer ID and the computer's name, so that a licence can be limited to 3 computers. The server also sees the internet address a request comes from, as every website does. Card payments are handled by HitPay; the vendor does not receive card numbers.
What the program connects to
The program can reach two internet addresses. The code refuses any other address, including when a server tries to redirect it elsewhere.
| Address | When | What is sent |
|---|---|---|
| tpa-checker-8q4m.pages.dev | When the program opens (licence check), and when you press "Check for updates" | Licence check: clinic code, scrambled computer ID, computer name. Updates: nothing about your clinic; it downloads program files |
| clinic.platomedical.com | Only when you use "Record payments in CMS" | The payment entries you approved, to your own Plato database, using the key you type at that moment |
Every connection is written to a plain log, tpa_network_log.txt, with the time, address, purpose and result. It never records contents, codes or keys. You can read it under Help > Network connections. Your IT person can confirm it with the firewall: only these two names need to be allowed.
One-time setup is separate. The first run installs Python (through winget) and the program's add-on packages from the public package registry. On Windows these packages are pinned to exact versions with fingerprints, so a swapped package is refused. On Mac they are pinned to version ranges only.
Signed updates and checking your copy
The program only updates when you press "Check for updates"; it never installs anything on its own. Each release comes with a list of file fingerprints (SHA-256) signed by the vendor's private key. That key is held by the vendor and is never placed on the update server.
The program holds the matching public key and refuses an update if the signed list is missing or altered, if any file's fingerprint differs, if the update contains an unexpected file name, or if the version is not newer. The previous version is kept so it can be rolled back.
To check your own copy, open Help > Verify program files. It compares every program file on the computer with the signed list and shows "All program files match", or names the files that differ. Do not use a copy that reports a difference unless you changed the file yourself.
Limit: signing protects against tampering on the server or in transit. It does not help if the vendor's signing key itself were stolen.
Virus scans
Each release zip is scanned on VirusTotal, a public service that runs a file through dozens of antivirus engines. A clean result means no engine recognised the file as malicious. It is not proof that a file is safe.
| Version | Windows download | Mac download |
|---|---|---|
| 5.3 | 0 of 65 engines flagged | 0 of 62 engines flagged |
| 5.4.1 | 0 of 65 engines flagged | 0 of 65 engines flagged |
| 5.4.2 | 0 of 65 engines flagged | 0 of 65 engines flagged |
| 5.4.3 | 0 of 66 engines flagged | 0 of 65 engines flagged |
| 5.4.4 | 0 of 65 engines flagged | 0 of 66 engines flagged |
A few engines may time out or say they cannot process a zip file. That does not count as a detection.
Keys, passwords and posting to Plato
- Your Plato key is typed in each time you post. It is held in memory for that action only and is never saved to disk or to the connection log.
- Posting is previewed first. The program shows every payment it would record, needs the approval code from that preview, rechecks each invoice's outstanding balance, and reads each invoice back afterwards. Repeating a post does not create duplicates.
- The licence is checked against a server reply that is digitally signed and tied to the computer. A licence file copied to another computer does not work.
- Result files stay in a folder on the clinic computer, and can be made free of patient names.
What this sheet does not claim
- No independent audit yet. The code has not been reviewed by an outside security firm.
- No Windows publisher certificate yet. Windows may show an "unknown publisher" notice the first time you start the program.
- No promise the program is free of mistakes. It cross-checks its own reading and stops with a failed check rather than guessing, and it shows the expected bank deposit so you can compare it with your bank. Please still check results before posting.
- Your computer's own security remains yours: keeping Windows or macOS updated, and an antivirus running.
How your IT person can check
- Read the program files. They are plain text (
tpa_match.py,tpa_gui.py,tpa_update.py). - Run Help > Verify program files.
- Open Help > Network connections, and allow only those two addresses on the firewall.
- Open the VirusTotal links above.
Questions
Security questions: theadmindoctorsg@gmail.com