EHR & Health Data Systems · EHR Vendor (Ambulatory/Practice) · Structural / no discrete incident
Tebra (formerly Kareo / PatientPop)
Headline
No breach, DOJ, OCR, FTC or state AG action against Tebra was verified this pass.
Not independently verified. Verification status: Unverified - heuristic first draft. Publish state: draft unverified.
No breach, DOJ, OCR, FTC or state AG action against Tebra was verified this pass. The finding is structural, in the contract small practices sign. Tebra's customer Terms of Service (effective July 1, 2026) cap Tebra's total liability at what the practice paid in the prior six months and require any claim against Tebra to be brought within six months. They allow claims only on an individual basis (no class actions) and waive jury trial, after mandatory non-binding mediation in Orange County. The agreement renews automatically unless written notice is received at least 60 days before the term ends, the practice 'cannot cancel' mid-term, and there are no refunds for stopping early. If a practice asks for its data after its coverage ends, Tebra may charge $100 an hour, and exports come only as Excel or CSV.
- Severity
- Evidence tierUnassigned
- Claims confirmed
- Last verified2026-10-15
Primary source. www.tebra.com/tebra-terms-of-service — Unverified - heuristic first draft.
Terms
Arbitration
Customer Terms of Service: no arbitration. Non-binding AAA mediation in Orange County comes first, then exclusive venue in C.D. Cal. or Orange County Superior Court. Individual-only claims (class waiver), jury waiver, a six-month liability cap and a six-month claim deadline. Patient Portal Terms: no arbitration, individual-only claims, and a $500 liability cap.
Data sharing
Website Privacy Policy effective Jan 20, 2025; a separate Platform Privacy Policy and California Supplemental Notice exist. Detailed sharing practices not reviewed this pass.
Fees and billing
Customer agreements renew automatically for equal terms, with non-renewal notice required at least 60 days in advance. No mid-term cancellation and no refunds. A reactivation fee applies after payment-related suspension. Post-termination data help costs $100/hour (30-minute minimum). Data is retained at least 60 days after termination and then disposed of. An account is deemed abandoned after 30 days without logins combined with unpaid fees.
Contacts
Privacy contact. Tebra Privacy, 888-775-2736; rights requests 1-844-422-7336 or https://www.tebra.com/privacy-web-form/
Legal notice. Tebra Technologies, Inc., 1111 Bayside Drive, Corona Del Mar, CA 92625. This is the address printed in the vendor's privacy notice, which is not necessarily the registered agent for service of process. For formal legal notice, check the notice clause in the practice's signed customer agreement and the Secretary of State registered-agent record in the state of incorporation.
Mailing address. Not recorded.
Evidence
No claims have been itemized for this row yet.
Sources
| Source | Claim | Tier | Status | Quote |
|---|---|---|---|---|
| Company customer agreement · 2026-07-01 www.tebra.com/tebra-terms-of-service | whole row | Unassigned | confirmed | “ANY CLAIM BY CUSTOMER AGAINST TEBRA MUST BE BROUGHT WITHIN SIX (6) MONTHS” Quote basis: not recorded. |
| Company terms of use (patient) · 2023-10-16 www.tebra.com/patient-portal-terms-service | whole row | Unassigned | confirmed | “does not exceed five hundred dollars ($500)” Quote basis: not recorded. |
| Company policy page · 2026-10-14 www.tebra.com/term-termination-return-data-faq | whole row | Unassigned | confirmed | “Tebra may charge the Customer the standard rate of $100 an hour (minimum 30 minutes)” Quote basis: not recorded. |
| Company privacy policy · 2025-01-20 www.tebra.com/privacy-policy/ | whole row | Unassigned | confirmed | “Tebra Technologies, Inc. (formerly known as Kareo, Inc.)” Quote basis: not recorded. |
| Trade press · 2024-12 histalk2.com/2024/12/08/morning-headlines-12-9-24 | whole row | Unassigned | confirmed | “Ambulatory health IT vendor Kareo, which merged with PatientPop in 2021, officially takes on the Tebra brand name.” Quote basis: not recorded. |
Source vault
Link status: Candidate - not yet fetched
| Document | Last fetch | |
|---|---|---|
| Privacy policy https://www.tebra.com/privacy-policy/ | Not fetched yet | NOT CONFIRMED |
| Terms of service https://www.tebra.com/tebra-terms-of-service | Not fetched yet | NOT CONFIRMED |
| Website https://www.tebra.com/ | Not fetched yet | — |
| Primary source https://www.tebra.com/tebra-terms-of-service Verification: Unverified - heuristic first draft | Not fetched yet | — |
Enforcement
No enforcement actions are linked to this row.
State statute
Headquarters on file: CA. Provisions of CCPA/CPRA on file:
| Provision | Type | Source |
|---|---|---|
| Right to Deletion Cal. Civ. Code § 1798.105 | hard | source |
| Right to Correction Cal. Civ. Code § 1798.106 | hard | source |
| Right to Know / Access Cal. Civ. Code § 1798.110 | hard | source |
| Right to Limit Use of Sensitive Personal Information Cal. Civ. Code § 1798.121; Cal. Code Regs. tit. 11, § 7027 | hard | source |
| Right to Data Portability Cal. Civ. Code § 1798.130(a)(3)(B)(iii) | hard | source |
| Privacy Policy / Privacy Notice Requirements Cal. Civ. Code § 1798.130(a)(5); Cal. Code Regs. tit. 11, § 7011 | hard | source |
| Sensitive Personal Information — Categories Cal. Civ. Code § 1798.140(ae) | hard | source |
| Service Provider and Contractor Contract Requirements Cal. Civ. Code § 1798.140(ag); Cal. Code Regs. tit. 11, § 7051 | hard | source |
| Applicability Threshold (2025 CPI-Adjusted) Cal. Civ. Code § 1798.140(d) | threshold | source |
| Privacy Risk Assessment — Mandatory for High-Risk Processing (Eff. Jan. 1, 2026) Cal. Civ. Code § 1798.185(a)(15); Cal. Code Regs. tit. 11, §§ 7150-7157 | hard | source |
| Right to Opt Out of Sale or Sharing Cal. Civ. Code §§ 1798.120, 1798.135 | hard | source |
| Sale vs. Sharing Distinction Cal. Civ. Code §§ 1798.140(ad), 1798.140(ah) | hard | source |
| Enforcement — CPPA and AG; Civil Penalties (2025 CPI-Adjusted) Cal. Civ. Code §§ 1798.155, 1798.199.90; Cal. Bus. & Prof. Code § 17206 | hard | source |
| Notice at Collection Cal. Code Regs. tit. 11, § 7012 | hard | source |
| Cybersecurity Audit — Annual Independent Audit Requirement (Eff. Jan. 1, 2026) Cal. Code Regs. tit. 11, §§ 7120-7124 | hard | source |
| Automated Decision-Making Technology (ADMT) — Notice, Opt-Out, and Access Rights Cal. Code Regs. tit. 11, §§ 7200-7222; Cal. Civ. Code § 1798.185(a)(16) | hard | source |