Regarding this Submit Bill section:

Maybe I'm just overly paranoid - having dealt with medical claim data for years has re-enforced this though - but isn't it walking a fine line with HIPAA to accept individuals' procedure codes? It doesn't even appear to use SSL/TLS, so I doubt this is HIPAA compliant. I know a name isn't sent over, but it can be trivial to identify someone via their IP address, right? Why not at least go that extra step to protect this information?

Additionally, how do you make sure the information (ie. payment amount, etc.) is accurate?

Also, doesn't seem to work correctly on Win7 Chrome).