1. Our Commitment
Medbilling RCM handles sensitive billing and claims data on behalf of physician practices and hospital systems. We treat that responsibility seriously. This page describes the safeguards we have in place to protect client data and the compliance standards we follow.
Our security practices apply to all systems that process, store, or transmit Protected Health Information (PHI) during client engagements. This public website does not collect or store PHI. For details on what the website collects, see our Privacy Policy at medbillingrcm.com/privacy-policy.
2. HIPAA Compliance
Medbilling RCM operates as a Business Associate under the Health Insurance Portability and Accountability Act (HIPAA). We comply with the HIPAA Privacy Rule, Security Rule, and Breach Notification Rule.
Business Associate Agreements. We execute a BAA with every client before any PHI is shared. The BAA defines how we handle, store, and protect PHI throughout the engagement.
Workforce training. Every team member who handles PHI completes HIPAA training. Training covers the Privacy Rule, Security Rule, and breach notification requirements.
Policy review. Our compliance officer reviews and updates internal security policies on a regular basis. Updates reflect changes in HIPAA guidance, client requirements, or operational processes.
3. Administrative Safeguards
Administrative safeguards are the policies and processes that govern how our team interacts with PHI.
- Security management. We maintain written security policies that cover access, incident response, and risk assessment.
- Workforce access management. Access to PHI is granted based on job function. Team members receive only the minimum access needed to perform their role.
- Contingency planning. We maintain documented procedures for responding to system outages or data loss events.
4. Technical Safeguards
Technical safeguards protect PHI through the systems and technology we use.
- Encryption. Data is encrypted in transit using TLS and at rest using AES-256 encryption.
- Access controls. All accounts that touch PHI require multi-factor authentication (MFA). We use role-based access control (RBAC) to limit access by job function.
- Audit logging. We maintain audit logs of access to systems that store or process PHI. Logs are reviewed for unauthorized access or unusual activity.
- Transmission security. PHI is transmitted only through encrypted channels. No unencrypted connections are permitted.
5. Physical Safeguards
Physical safeguards protect the hardware and facilities where PHI is accessed.
- Workstation security. Team members who access PHI use secured workstations with screen locks and restricted USB access.
- Device and media controls. Devices that store PHI are encrypted. Before disposal or reassignment, all data is securely wiped.
6. Breach Notification
We maintain a documented Incident Response Plan for handling security events.
If a breach of unsecured PHI occurs, we notify affected clients within the timeframe required by HIPAA's Breach Notification Rule. We assist clients in meeting their own notification obligations to patients and to the U.S. Department of Health and Human Services (HHS).
All suspected incidents are investigated, documented, and resolved. We track root causes and apply corrective measures to prevent recurrence.
7. Regulatory Compliance
Beyond HIPAA, we follow additional regulations based on client specialty and jurisdiction.
- CMS guidelines. We follow the Centers for Medicare and Medicaid Services billing and documentation requirements applicable to our clients' claims.
- State privacy laws. Where state laws impose stricter privacy requirements than HIPAA, we follow the stricter standard. Specifics are addressed per client and engagement.
- 42 CFR Part 2. For clients in behavioral health, we apply the additional privacy protections required for substance use disorder records.
8. Data Handling at Termination
When an engagement ends, we provide a full data export in standard formats. After the client confirms receipt, we delete all PHI from our systems within 60 days. Deletion follows NIST 800-88 guidelines for media sanitization.
A certificate of data destruction is available on request.
9. Questions
For compliance questions or to request a copy of our BAA, contact us: