How we protect patient data

We sign a BAA first

MedBil is a business associate under HIPAA. We sign a Business Associate Agreement before accessing any of your data — not after onboarding, not once the engagement is underway. If your counsel wants to use your own form rather than ours, that is fine.

Encryption

Data is encrypted in transit and at rest. [VERIFY — state the specific standards in use, for example TLS 1.2 or above in transit and AES-256 at rest. Do not publish this section until the standards are confirmed.]

Role-based access, least privilege

Access to protected health information is granted by role and limited to what that role needs. A coder working your cardiology claims does not have access to another client's data, and does not have administrative access to yours.

Access is provisioned when someone joins a team and removed when they leave it, on the same day.

Audit logging

PHI access is logged — who accessed which record, and when. Logs are retained and reviewed. If you need an accounting of disclosures for a patient request, we can produce it.

Staff training

Every member of staff completes HIPAA training at onboarding and on a recurring cadence. [CLIENT INPUT — state the cadence, for example annually, and who delivers the training.]

Remote work controls

Most billing work is now performed at least partly remotely, which is a real risk that deserves a real answer rather than silence.

[CLIENT INPUT — describe the actual controls: managed devices, full-disk encryption, VPN requirement, screen lock policy, prohibition on local storage of PHI, prohibition on personal devices, physical workspace requirements.]

Breach notification

If we discover a breach or an unauthorised use or disclosure affecting your data, we notify you without unreasonable delay and within the timeframe set out in the BAA, with what we know, what we are doing about it, and what your own notification obligations are likely to be.

[CLIENT INPUT — state the notification timeframe committed to in the standard BAA.]

Subcontractors

Any subcontractor who could touch protected health information is bound by terms at least as protective as those in our BAA with you. [CLIENT INPUT — state whether subcontractors are used at all, and for what.]

Independent assessment

SOC 2 Type II: [VERIFY]. This claim does not appear anywhere on this site until a report exists and the auditing firm and report period can be named here. A badge without a report behind it is not evidence of anything, and we are not going to display one.

What we ask of you

Please do not send protected health information through the forms on this site. The A/R analysis works from claim-level and payer-level data and does not need patient identifiers. Once a BAA is in place we will give you a secure route for anything that does contain PHI.

Questions

Your IT or compliance team is welcome to walk through any of this with us before you commit to anything. Use the contact page and say what you need to review.