Short version: We sign a Business Associate Agreement (BAA) with every client before we access any patient information. We only access what each task needs, use named accounts in your systems, and follow the administrative, physical and technical safeguards of the HIPAA Security Rule. There is no such thing as "HIPAA certified," and we will never claim to be.
Why we are a business associate
Under HIPAA, a business associate is a person or company that performs services for a covered entity, such as a medical practice, involving the use or disclosure of protected health information (HHS). Billing, coding, scheduling, document management and patient communication all qualify. So does building a website or automation that collects patient information.
That makes ClaimCoders a business associate of every practice we support, with direct obligations under HIPAA.
The Business Associate Agreement
Before any access is granted, we sign a BAA with your practice. The BAA sets out what we may and may not do with protected health information, the safeguards we must maintain, how we report incidents and what happens to data when our work ends. We can sign your template or provide ours; HHS publishes sample BAA provisions that both follow.
We also require a BAA from any subcontractor or vendor of ours that would handle your patients' information.
How we handle patient information
- We work inside your systems. Billing, scheduling and documents are handled in your EHR, practice management system and phone tools, so patient data stays in systems you control.
- Minimum necessary access. Each team member gets only the permissions their tasks require, in line with HIPAA's minimum necessary standard.
- Named accounts, never shared logins. Every action can be traced to a person, and you can switch off access at any time.
- Multi-factor authentication wherever your systems support it.
- Training. Everyone on our team completes HIPAA privacy and security training before accessing client systems, and again every year.
- Secure workstations. Encrypted devices, automatic screen locks and no patient information on personal devices or personal email.
- No patient information in email. We use your secure messaging or a BAA-covered channel instead.
- Written policies and a risk assessment that we review at least once a year.
Marketing and patient privacy
Our digital work follows the same rules. We keep advertising pixels off pages where health information could be exposed, in line with HHS guidance on online tracking technologies, route patient forms through BAA-covered tools, and keep clinical details out of marketing messages and automations.
If something goes wrong
If we discover a security incident or possible breach involving your patients' information, we notify you without unreasonable delay and within the timeframe in your BAA, share what we know and help you meet your obligations under the HIPAA Breach Notification Rule.
Questions
Your privacy officer or attorney may want to see our policies before signing. Email hello@claimcoders.com and we will share them under NDA as needed.