Home/Resources/Security & Privacy
Security & privacy, agreed before work begins
Protecting confidential practice and patient information is a priority in planning every engagement. Here is how we set that up.
How we protect information
Six commitments that apply to every engagement, whatever the scope.
Agreements first
Confidentiality terms and, where applicable, a HIPAA business associate agreement are agreed before any patient information is shared.
Authorized access only
Access to your systems is limited to the named people on the engagement. Permissions are approved by your practice and removed when no longer needed.
Your approved systems
Work is carried out in the systems your practice approves, so records stay where you keep them.
Minimum necessary
We ask for the information needed for the assigned task, not more.
A secure channel for patient information
Patient information is shared only through the secure channel agreed with your practice, never through a general inquiry form or email.
You keep financial control
Funds remain under your practice’s control, and bank details and financial authorization stay with you.
HIPAA and business associate agreements
When a billing or administrative partner handles protected health information for a practice, HIPAA treats that partner as a business associate. Before any patient information is shared, we agree a written business associate agreement with your practice, together with the access, communication and handling safeguards that go with it.
For more on how HIPAA protects health information, visit HHS.gov.
Certifications and audit reports
Many practices ask whether a vendor is “HIPAA certified.” There is no government-issued HIPAA certification: the U.S. Department of Health and Human Services does not certify organizations, so treat any badge that suggests otherwise with care. What matters is a signed business associate agreement, documented safeguards and a partner who will answer your questions.
If your practice requires a specific third-party assessment or audit report, tell us in the first discussion and we will confirm what we can provide. See the HHS guidance on certification.
Safeguards across an engagement
Security is not a single step. It is set up at the start, kept up while work is under way and closed out when scope changes.
Before work begins
- Confidentiality and business associate terms as required
- Named people, roles and system permissions
- Approved communication methods and information-handling requirements
- Key contacts and escalation paths
While work is under way
- Work recorded in approved systems
- Status shared at the agreed frequency
- Questions routed to named contacts
- Changes to access approved by your practice
When scope changes or ends
- Access reviewed and removed when no longer needed
- Open items and records handed back as agreed
- Final reporting on completed and pending work
- Continuing obligations set out in the agreement
A shared responsibility
Good outcomes depend on both sides doing their part.
What we do
- Agree access, communication and handling requirements in writing
- Work only within the assigned scope
- Use approved systems and channels
- Keep you informed of completed, pending and decision-ready items
What we ask of your practice
- Approve who needs access, and tell us when that changes
- Share patient information only through the agreed channel
- Keep clinical documentation accurate and complete
- Keep notice and portal contacts current
Please keep patient details out of general inquiries
Use the contact form to tell us about your practice type, approximate provider count and the services you need. Do not include patient names, medical records, insurance identifiers or other confidential patient information.
Once we are working together, we will agree on the secure channel for exchanging patient information.
Frequently asked questions
Can I send patient details in the contact form?
No. Please do not include patient names, medical records, insurance identifiers or other confidential patient information in a general inquiry. We agree a secure channel with you before any patient information is exchanged.
Can we send you our own security or vendor questionnaire?
Yes. Share it during the first discussion and we will respond as part of onboarding.
Who has access to our systems?
Only the named people assigned to your engagement, with permissions your practice approves. Access is reviewed when scope changes and removed when no longer needed.
Where does our data live?
In the systems your practice approves. We do not move your records elsewhere unless you agree to it in writing.
What happens if there is a security concern?
Escalation contacts and communication expectations are agreed at onboarding, so both sides know who to call and what to share.
Have security questions?
Send us your questions or your vendor questionnaire and we will respond during the first discussion.