Security and compliance

Built like the money it handles.

Revise Medical is a HIPAA business associate for every client. Below is the program as designed and being built. Where a certification is still ahead of us, we state the date.

Trust centerRequest our BAA

SOC 2 Type I planned, target Q1 2027. Not yet audited.

Data flow

How claims data moves through Revise.

From your remits to the documents a filing needs, and nothing more.

InYour data835, 837, EOB, CSVunder a signed BAA
US-hosted Revise environment

Row-level isolation per organization. Encrypted at rest. Identifiers hashed.

Append-only audit log: every PHI read, 6 years
OutPayers and IDREsnotices, offers,briefs, in your name
The design every control is built to. What is in place today versus in build is on the trust center.
HIPAABAA with every client
EncryptedAt rest and in transit
US-only hostingNo offshore data
SOC 2 Type IPlanned, Q1 2027
Controls

The program, in plain terms.

  • In place
  • In progress
  • Planned
  • 01

    Access

    SSO and MFA for every user, role-based access, row-level isolation per organization, least privilege, quarterly access reviews.

    In progress
  • 02

    Data

    Encrypted at rest and in transit; column-level encryption for identifiers; patient identifiers hashed in working tables; minimum necessary by design.

    In progress
  • 03

    Audit

    An append-only log of every PHI read, document generated and offer sent, kept six years.

    In progress
  • 04

    Operations

    Secrets management, vulnerability scanning, dependency updates, backups with tested restores, incident response, security training.

  • 05

    Vendors

    A BAA with every vendor that touches PHI. Vendors that never see PHI are kept that way: this website collects none.

    BAA template in placeNo PHI on this site
  • 06

    Program

    HIPAA risk analysis and policies first; SOC 2 Type I targeted for Q1 2027 with Type II after; a penetration test before the first hospital client.

    Risk analysis in progressPen test plannedSOC 2 planned
Rules enforced in code

What the engine will not do.

  • No filing without a cited eligibility assessment

    A dispute leaves the system only above the confidence threshold or with a human sign-off, with the rationale and the regulation attached.

  • No offer above your threshold without your approval

    Offers over the limit you set wait for a named approver in the portal or the app, with the clock shown next to the button.

  • No document without your letterhead and authorization

    Notices, briefs and demand letters go out in your name with the representative authorization on file. We are not a law firm.

  • No PHI in logs, email, notifications or analytics

    Identifiers stay inside the encrypted stores. Everything outside them works from claim IDs and amounts.

Report a vulnerability to security@revise-medical.com. We acknowledge within two business days.

Send us one month of remits.
We’ll show you what you left on the table.

Seven business days. No cost. A line-by-line report of eligible claims you didn’t file, QPAs that don’t add up, and awards you were never paid.

Start the free auditBook a demo