HIPAA applies to every claim we touch, because each one holds protected health information. This page is the short version of what the business associate agreement says. You can read it between patients.
Ask for the business associate agreement before you send us a single claim. We expect you to.
3% of collectionsNo setup feeNo contract
We are a business associate under HIPAA. Before we see any patient data, we sign a business associate agreement with your practice. You get a copy before the first day, not after.
The agreement states what we use the data for: billing, appeals, enrollment and reporting. We use it for nothing else, and we do not sell it.
When the engagement ends, we return or destroy your data, as the agreement sets out. Where that isn't feasible, its protections stay on whatever we keep.
Your dedicated biller and the cardiology coders assigned to your account can see it. So can the people who post your payments and work your denials. Anyone else sees it only when the agreement or the law requires it.
Access is by role, on named accounts with multi-factor authentication. It ends the day a person leaves your account. Any vendor that handles your data for us signs its own business associate agreement, as HIPAA requires.
We do not send patient information by ordinary email, and we ask you not to either. When a question needs a patient's name, it goes through your EHR or a secure message.
Mostly in your systems. We work inside your EHR and your clearinghouse, under user accounts you create and can remove.
What we hold on our side sits on encrypted systems in the United States. That means working files, reports and appeal packets. It is encrypted in transit and at rest, backed up, and open only to the people above. Workstations are encrypted and lock when idle.
We keep records for as long as the agreement and payer rules require. Then we destroy them.
If we discover a breach of your patients' data, we tell you without unreasonable delay and within the time the agreement sets. HIPAA's outer limit is 60 days after discovery. State law and the agreement can set shorter limits, and we meet the shortest.
Our notice says what happened, which records were involved, and what we did about it. You then decide on patient notification with the facts in hand.
Nobody can promise zero incidents. We can promise you hear about one from us directly, with the facts.
Questions about any of this go to matt@onlycardiologybilling.com. We answer them the same way we wrote this page.