HIPAA Notice and PHI Handling

Business Associate Agreement

We execute a written Business Associate Agreement with every client practice before any protected health information is transmitted, accessed, or processed. The BAA sets out permitted uses and disclosures, safeguards, subcontractor flow-down obligations, breach notification timelines, and return or destruction of PHI at termination.

Permitted use of PHI

We use PHI only to perform billing, coding, claims submission, denial management, appeals, prior authorization, patient accounts receivable, credentialing, and reporting services for the practice, and only as permitted by the BAA and the Privacy Rule. We do not sell PHI and we do not use PHI for marketing.

Safeguards

• PHI is encrypted in transit using TLS and encrypted at rest.
• Access is role-based and granted on a least-privilege, need-to-know basis, with unique credentials per user and multi-factor authentication on administrative access.
• Access to systems containing PHI is logged, and logs are retained and reviewed.
• Workforce members complete HIPAA privacy and security training and sign confidentiality agreements.
• Access is revoked promptly on role change or separation.
• PHI is never requested or accepted through website forms or unencrypted email.

Minimum necessary

We request and use only the minimum PHI necessary to perform the contracted service. Claims audits are performed on de-identified or limited data sets wherever a full data set is not required.

Subcontractors and subprocessors

Any subcontractor that may create, receive, maintain, or transmit PHI on our behalf is bound by a written agreement imposing restrictions and conditions at least as protective as those in our BAA with the practice. A current list of subprocessors is available to clients on request.

Incident and breach notification

We maintain an incident response process covering detection, containment, investigation, and notification. Where a breach of unsecured PHI is discovered, we notify the affected covered entity without unreasonable delay and within the timeframe specified in the BAA, with the information required for the practice to meet its own notification obligations.

Retention, return, and destruction

PHI is retained only for the period required to perform services and to meet legal retention obligations. On termination, PHI is returned to the practice or securely destroyed in accordance with the BAA, and the practice receives written confirmation.

Certifications and evidence

We publish only the compliance claims we can evidence. Practices evaluating us may request our security overview, workforce training attestation, subprocessor list, and current risk assessment summary under NDA as part of vendor due diligence.

Contact

Privacy or security questions, including requests from a covered entity's compliance officer, can be directed to us at (631) 366-8765.