Compliance and security
HIPAA Compliance and Data Security
Handing patient data to a billing partner is a compliance decision before it is a commercial one. This page sets out exactly how we handle protected health information — the agreement we sign, the safeguards we operate, and what happens if something goes wrong.
Compliance & security
Your PHI is handled like it never left the practice.
Dermatology billing means constant contact with protected health information. Here is exactly how we protect it — and the paperwork we hand your compliance officer on day one.
BAA before any data moves
A signed Business Associate Agreement is executed with every practice before we touch a single claim, chart note, or remittance file.
Encrypted end to end
PHI is encrypted in transit (TLS 1.2+) and at rest (AES-256). No PHI is ever exchanged over email, SMS, or consumer file-sharing tools.
Least-privilege access
Role-based access with MFA on every account. Staff see only the practices they are assigned to, and access is revoked same-day at offboarding.
Full audit logging
Every view, edit, and export of PHI is logged and retained for six years, available to your compliance officer on request.
Trained, screened staff
Background-checked coders and A/R specialists complete HIPAA privacy and security training at hire and annually thereafter.
Vetted subprocessors
Clearinghouse, hosting, and communication vendors are BAA-covered and reviewed annually. Subprocessor list available on request.
The compliance process, step by step
No ambiguity about who can see what, when. Documentation is provided in writing at each stage so your practice keeps a clean audit trail.
- 01
Before engagement
Mutual NDA, BAA execution, and a security questionnaire your compliance officer can file.
- 02
During onboarding
Named users provisioned in your PM/EHR with least-privilege roles — we never share logins.
- 03
Ongoing operations
Quarterly access reviews, annual risk assessment, and a documented 72-hour incident notification workflow.
- 04
At offboarding
Access revoked within 24 hours and a written record-return or secure-destruction certificate issued.
The business associate agreement comes first
A medical billing company handling protected health information on a practice's behalf is a business associate under HIPAA, and the relationship is not lawful without an executed business associate agreement. We execute a BAA before any protected health information is exchanged — including during a free claims audit — and we will not accept clinical or claims data ahead of it, even to speed up an evaluation.
The agreement sets out permitted uses, our safeguard obligations, breach notification timelines, subcontractor terms and what happens to your data when the relationship ends. We will send our standard form for your review, and we will sign yours where your counsel prefers it.
Technical safeguards in place
- Encryption in transit using current TLS, and encryption at rest using AES-256, for all systems holding protected health information.
- Named individual user accounts. No shared logins, because a shared login destroys attribution in an audit log.
- Role-based access scoped to the minimum necessary for the billing function performed.
- Multi-factor authentication on all accounts with access to protected health information.
- Audit logging of access and activity, retained and reviewable.
- Secure file transfer for any data exchange. Protected health information is not accepted through website forms or ordinary email.
Administrative and workforce safeguards
- Annual HIPAA training for every member of staff with access to protected health information, with completion recorded.
- Background screening before access is granted.
- Confidentiality agreements covering all personnel.
- Documented access provisioning and, critically, prompt de-provisioning when a role changes or ends.
- A named privacy and security contact responsible for incident handling.
- Written policies covering minimum necessary use, sanctions, and periodic risk assessment.
Working inside your systems, not around them
Wherever possible we work inside your EHR and practice management system under accounts you create and control. That means your organization retains the audit trail, you can see exactly what we did and when, and you can revoke access immediately without depending on us to act. It also means we are not creating a second copy of your patient data in a system you cannot inspect.
Where a data extract is genuinely necessary, it is transferred over a secure channel, held only for as long as the task requires, and returned or destroyed under the terms of the business associate agreement.
Incident and breach response
Suspected incidents are investigated immediately and escalated to our named privacy contact. Where an incident involves your protected health information, we notify you without unreasonable delay and within the timeframe set in our business associate agreement, with the facts as established, the scope, and the remediation taken. We will support your own breach assessment and any notification obligations that follow from it.
What we do not claim
We describe the safeguards we operate. We do not display certification badges we cannot evidence on request, and if you ask us for documentation of any control described on this page, we will provide it or tell you plainly that we cannot. A vendor that will not do that is not one you should hand patient data to.
Frequently asked questions
Will you sign our business associate agreement?
Yes. We will sign your form or provide ours, whichever your counsel prefers, and we execute it before any protected health information is exchanged.
Can we send claim examples by email to get started?
Not with protected health information in them. Send us de-identified examples, or wait for the secure transfer route we provide once the agreement is executed.
Do you use subcontractors, and are they covered?
Any subcontractor with access to protected health information is bound by a written agreement carrying the same obligations we owe you, as HIPAA requires.
Who has access to our patient data?
Only the named staff assigned to your account, under individual accounts with role-based permissions scoped to the work they perform, logged and reviewable.
What happens to our data if we leave?
It is returned or destroyed according to the terms of the business associate agreement, and access is revoked on the effective date. Your data is yours.