Book a consultationRequest a quote

Compliance & Security

Your patients' data, protected at every step

We handle protected health information (PHI) only inside your systems, only after a Business Associate Agreement is signed, and only to the extent each task requires.

Please don't send patient information through this website.No patient names, dates of birth, member IDs, account numbers or claim details. If we need any of this to help you, we will arrange a secure channel under a signed BAA.
  • HIPAA-compliant processesWritten policies, reviewed every year
  • BAA with every clientSigned before we access any data
  • Role-based accessMinimum necessary, by task
  • Annual trainingHIPAA privacy and security for all staff
01

Business Associate Agreement

Before we see any patient information, we sign a Business Associate Agreement (BAA) with your practice. It sets out how we use, protect and report on PHI, and what happens to it if our engagement ends.

  • Signed before any system access is granted
  • Defines permitted uses of PHI for billing and related services
  • Commits us to breach notification within the timelines HIPAA requires
02

Administrative safeguards

Written privacy and security policies govern how our team handles PHI, with a designated privacy and security officer responsible for them.

  • Annual HIPAA privacy and security training for every team member
  • Confidentiality agreements signed by all staff
  • Regular risk assessments and policy reviews
03

Technical safeguards

We work inside your EHR and practice management systems rather than copying data out of them, using accounts you create and control.

  • Unique, named user accounts with multi-factor authentication where your systems support it
  • Role-based access limited to the minimum necessary for each task
  • Encrypted connections for all remote access
  • Access removed immediately when a team member leaves your account
04

Physical safeguards

Our team works from controlled environments with clear rules on devices, screens and printed material.

  • Company-managed devices with full-disk encryption
  • No local storage or printing of PHI
  • Clean-desk and screen-lock policies
05

This website

Our website is for practice owners and administrators. It never asks for, and never needs, patient information.

  • Forms collect practice details only
  • All pages are served over an encrypted (HTTPS) connection
  • Enquiries go directly to our team inbox and are not shared with third parties for marketing

FAQ

Security questions practices ask us

Are you HIPAA certified?

There is no official HIPAA certification. What matters is that a vendor follows HIPAA-compliant processes and signs a Business Associate Agreement. We do both, and we can walk you through our policies on request.

Will our patient data leave our systems?

As a rule, no. We work inside your EHR and practice management system. Where a task requires a file, such as an aging report, it is exchanged through a secure, encrypted channel agreed in advance.

Who on your team can access our data?

Only the people assigned to your account, with access limited to what each person's role requires. You can see and revoke every account at any time.

What happens to our data if we stop working together?

All access is removed on the end date, and any files we hold are returned or destroyed as set out in the BAA.

Free revenue review

Find out what your practice is leaving unpaid

Send us a few details and we will show you where claims, denials and A/R are costing you money.

Request a quoteBook a consultation