HIPAA notice

Who this notice is for

This notice is written for the physician groups, facilities and other providers who use our services, and for their compliance officers and counsel. It explains how Revise Medical, LLC handles the PHI those providers share with us.

If you are a patient, you may have found this page because your provider works with us on a claim. Your provider is the covered entity responsible for your health information. Under 45 CFR 164.520, your provider gives you its Notice of Privacy Practices, which describes your rights and how to use them. This page does not replace that notice. We never bill or contact patients.

Our role as a business associate

Under HIPAA, a business associate is a person or company that creates, receives, maintains or transmits PHI on behalf of a covered entity to perform a service for it (45 CFR 160.103). Payment and claims work for a provider is one of those services. That is our role for every client.

What follows from it:

• We sign a BAA with each client before any PHI moves. The BAA sets what we may do with PHI. We may use or disclose PHI only as that contract permits or requires, or as law requires (45 CFR 164.502(a)(3)).
• The BAA contains the terms HIPAA requires (45 CFR 164.504(e)): safeguards, reporting, subcontractor terms, help with patient rights, access by HHS to our records, and return or destruction at the end. HHS publishes sample BAA provisions. You can request ours on the BAA page.
• We are directly liable under HIPAA for the Security Rule and for parts of the Privacy and Breach Notification Rules, not only under our contract with you. HHS lists those duties in its fact sheet on direct liability of business associates.
• We are not a covered entity, so we do not issue our own Notice of Privacy Practices. When a BAA asks us to carry out one of the provider’s Privacy Rule duties, we follow the rule that applies to the provider.

HHS guidance on the role is at hhs.gov/hipaa: business associates.

What PHI we receive and why

We work out-of-network claims under the No Surprises Act: we assess eligibility, run the 30-business-day open negotiation, file and argue IDR, and collect awards. To do that we receive claims data from the provider or its billing company:

• Claim files (837) and remittance advice (835).
• Explanations of benefits, payer correspondence and qualifying payment amount disclosures.
• The fields inside them: patient name and date of birth, member and claim numbers, payer and plan, dates and place of service, procedure and diagnosis codes, billed, allowed and paid amounts.
• Clinical documentation only when a brief needs it to show the acuity of the patient or the complexity of the service, and then only the pages that show it.

We use this PHI to decide which claims qualify, to calculate offers, to prepare notices and briefs in the provider’s name, and to track payment of awards. We do not ask for PHI we have no use for.

Minimum necessary

HIPAA requires reasonable efforts to limit PHI to the minimum necessary for each use, disclosure and request (45 CFR 164.502(b), 164.514(d); see HHS minimum necessary guidance). We build that into the product:

• Patient identifiers are hashed in working tables and appear in full only where a document requires them.
• Identifiers are encrypted at the column level inside the database.
• Staff see only the organizations and tasks their role covers.
• A notice or brief carries only the fields the payer or the IDR entity needs to match and decide the claim.
• Logs, alerts and internal tools work from claim IDs and amounts, not names.

Permitted uses and disclosures

We disclose PHI only to the parties below, only for the purpose shown, and only as the client’s BAA allows. A BAA may also let us use PHI for the proper management and administration of our business, for example with our auditors or counsel, under 45 CFR 164.504(e)(4). Where it does, those recipients are bound to keep it confidential.

The federal IDR process is run by the Departments of Health and Human Services, Labor and the Treasury. Its rules and portal are at cms.gov/nosurprises.

What we never do

• We do not sell PHI (45 CFR 164.502(a)(5)(ii)) or use it for marketing.
• We never bill, call or write to patients.
• We never put PHI in application logs, email bodies, push notifications or analytics.
• We never send PHI to a vendor that has not signed a BAA with us.
• We never use one client’s PHI to work another client’s claims. Each organization’s data is isolated.
• We never hold client funds. Payers pay awards to the provider.

Safeguards

The HIPAA Security Rule requires administrative, physical and technical safeguards for electronic PHI (45 CFR 164.308, 164.310, 164.312; see the HHS Security Rule summary). The controls below are our program as designed and being built. We do not accept client PHI until the BAA is signed, and the trust center shows where each control stands.

Administrative

• A written HIPAA risk analysis and policies, drafted with counsel before the first client data arrives.
• A named security and privacy lead, accountable for the program.
• Security and HIPAA training for every workforce member before they get access, and again each year.
• Role-based access with least privilege, and quarterly access reviews.
• An incident response plan, and a BAA with every vendor that touches PHI.

Physical

• PHI is hosted only in United States regions of cloud providers that sign BAAs with us.
• PHI is worked inside the portal. Our policies keep it off paper, personal devices and removable media.

Technical

• Encryption in transit with TLS 1.2 or higher, and encryption at rest, with column-level encryption for identifiers.
• Row-level isolation per organization in the database, so one client’s records cannot be read in another’s session.
• SSO and multi-factor authentication for every user.
• An append-only audit log of every PHI read, document generated and offer sent, kept for six years. That matches the six-year retention HIPAA sets for required documentation (45 CFR 164.316(b)(2)).
• Secrets management, vulnerability scanning, dependency updates, and backups with tested restores.

HIPAA has no official certification. A vendor that says it is “HIPAA certified” is describing its own assessment. We report status instead of badges, and we name the date where an audit is still ahead of us.

Subcontractors

A business associate may share PHI with a subcontractor only after the subcontractor agrees in writing to the same restrictions (45 CFR 164.502(e)(1)(ii), 164.504(e)(5)). We sign a BAA with every subcontractor that creates, receives, maintains or transmits PHI for us, and we give each one only what its job needs.

The categories we use are cloud hosting, managed database and authentication, a language model API, document reading (OCR), and fax delivery. Language model vendors must agree not to train on the data we send them. The trust center lists each category, and names each vendor before client data reaches it, with 30 days notice of changes. This marketing site’s host never receives PHI.

Incidents and breach notification

If we discover a breach of unsecured PHI, we notify the affected client without unreasonable delay and within the period our BAA sets. The rule’s outer limit is 60 calendar days after discovery (45 CFR 164.410). We do not wait for that limit.

Our notice includes, as far as we know it at the time:

• Each individual whose PHI was, or may have been, accessed, acquired, used or disclosed.
• What happened, when, and when we discovered it.
• The types of PHI involved.
• What we are doing to contain it and prevent a repeat.
• Anything else the client needs to notify patients, HHS and, where required, the media.

We send what we learn later as we learn it. We also report other security incidents and any use or disclosure the BAA does not allow (45 CFR 164.314(a), 164.504(e)(2)(ii)(C)). Notifying patients is the provider’s duty under 45 CFR 164.404; we support it with the facts and records it needs. HHS explains the full process on its breach notification page.

Patient rights requests

Patients have rights to access, amend and get an accounting of disclosures of their PHI (45 CFR 164.524, 164.526, 164.528). Those requests go to the provider, which decides them. See HHS guidance on the right of access.

• We give the provider the PHI it needs to answer an access request, in the time our BAA sets.
• We make amendments the provider approves to the records we hold.
• We record our disclosures so the provider can give a complete accounting.
• If a patient contacts us directly, we pass the request to the provider and tell the patient we have done so.

Return or destruction

When an engagement ends, we return or destroy the client’s PHI as the BAA directs, including copies held by our subcontractors, and confirm in writing (45 CFR 164.504(e)(2)(ii)(J)). Where return or destruction is not feasible, for example records the law requires us to keep, the BAA’s protections continue for as long as we hold them, and we use them only for the reason they were kept.

This website and email

This marketing site is outside the PHI boundary. It collects no PHI, runs no advertising pixels or third-party analytics, and its forms ask only for contact details. HHS has warned that tracking tools on health websites can expose PHI (HHS guidance on online tracking); we keep them off this site. The privacy policy covers what the site does collect.

Do not send PHI through a form on this site or by email. Clients receive a secure upload link for claim files once the BAA is signed. If you send PHI to us by mistake, tell us and we will delete it.

Questions and concerns

• Privacy questions and patient rights questions: privacy@revise-medical.com.
• Suspected security incidents and vulnerability reports: security@revise-medical.com. We acknowledge within two business days.
• You can also file a complaint with the HHS Office for Civil Rights at hhs.gov/hipaa/filing-a-complaint. We will not retaliate against anyone for filing a complaint or raising a concern.

Changes to this notice

We update this notice when our practices or the law change, and change the date at the top. A change to this page does not change a signed BAA. Changes to a BAA are made in writing with the client.