Security and HIPAA

As your billing partner, we are a business associate under HIPAA. We sign a Business Associate Agreement with your practice before we access any patient information, including for a billing review that needs patient-level reports.

The vendors we rely on to handle patient information sign BAAs with us too. That includes the AI services our billers use.

Every member of our team gets an individual account in your systems. We do not share logins. Each person has access only to what their work requires, and access is removed when it is no longer needed.

We use multi-factor sign-in wherever the system supports it, and sessions time out when they are left idle.

Patient information is encrypted when it moves between systems and when it is stored. Devices our team uses to access patient information use full-disk encryption and screen locks.

We only use AI services that sign a Business Associate Agreement and whose terms do not allow our data to be used to train their models. Consumer AI tools are never used with patient information.

Each AI task receives only the information it needs. When a task does not need a name or date of birth, it does not get one.

Work on your account is logged, so there is a record of who accessed what and when. Our team completes HIPAA training before getting access and every year after that.

We keep a written incident response plan. If a security incident affects your patients’ information, we notify you as our Business Associate Agreement and the HIPAA Breach Notification Rule require, and we work with you on next steps.