HIPAA Compliance

We sign a BAA with every client practice before handling PHI. This is a legal requirement for a billing partner, not an optional extra, and we will not begin work without one in place.

[VERIFY] Restate your actual technical and administrative safeguards here — encryption in transit and at rest, role-based access controls, audit logging, workforce training cadence, and incident response. Describe what you genuinely do, at the level of specificity you can evidence in an audit.

Where we rely on third parties for infrastructure or security services, each is bound by contract to handle data only as instructed, and every one that could touch PHI is covered by its own agreement.

We work with the minimum PHI required to bill and to resolve a claim. Staff access is scoped to the accounts they work on.

Every claim carries a record of what was coded, from what documentation, when it was submitted, and every action taken on it afterwards. This is what makes an account defensible under a payer or RAC audit.

Our coders hold AAPC and AHIMA credentials. We give the current number, and the specific certifications, on request rather than publishing a figure that drifts out of date between hires.

Do not submit patient health information through any form on this site, or to the voice assistant. Claim-level financial data — an AR aging report, a denial export — is what we need for an audit, and it does not contain PHI. For anything that does, we establish a secure channel first.

If a breach affecting your PHI occurs, we notify you without unreasonable delay and within the timeframe set by the HIPAA Breach Notification Rule and your BAA, with what we know, what we are doing, and what it affects.

Compliance and security questions go through the Contact page marked “Compliance”, and are routed to the person who owns HIPAA compliance at Medway.