generated: '2026-07-18'
method: searched
source: https://trust.carestack.com/
docs: https://www.carestack.com/
summary: >-
  CareStack publishes a compliance program covering healthcare and general
  information-security frameworks. Certifications/attestations below are surfaced
  on the CareStack trust center and marketing site. API-protocol conformance
  (OAuth2/OIDC/FHIR/etc.) is not asserted here because CareStack publishes no
  public OpenAPI or protocol specification (developer reference is behind portal
  sign-in); those entries are marked unknown rather than fabricated.
standards:
- id: hipaa
  conforms: true
  evidence: HIPAA compliance stated on carestack.com and trust.carestack.com
- id: soc2-type2
  conforms: true
  evidence: SOC 2 Type 2 certification listed on trust.carestack.com
- id: iso-27001
  conforms: true
  evidence: ISO 27001:2022 certification stated on carestack.com
- id: gdpr
  conforms: true
  evidence: GDPR compliance stated on carestack.com and trust.carestack.com
- id: oauth2
  conforms: unknown
  evidence: no public OpenAPI/spec; auth mechanism documented behind portal sign-in
- id: oidc
  conforms: unknown
  evidence: no public discovery document (/.well-known/openid-configuration returns 404)
- id: fhir-r4
  conforms: unknown
  evidence: dental EHR; no public FHIR endpoint or spec confirmed
- id: rfc9457-problem-details
  conforms: unknown
  evidence: no public OpenAPI to inspect error envelope