Business Associate Agreement first
We do not access any protected health information until a mutual HIPAA Business Associate Agreement is signed.
Access
Access to practice systems is role-based, limited to the minimum necessary, and tied to named team members. Access is removed promptly when no longer needed.
Handling
Work is performed inside the practice's own PM/EHR and clearinghouse wherever possible. Data in transit is encrypted, and activity is logged for audit.
AI tools
AI tools that process PHI are used only under a BAA with the vendor, with minimum-necessary data and human review of every output. Practice data is not used to train public models.
Standards
Our safeguards follow the HIPAA Privacy and Security Rules (45 CFR Parts 160 and 164).