HIPAA & SECURITY
Protected health information stays protected
HIPAA compliance is built into how we work with every practice we serve — from the first BAA to daily workflow.
FOUR PILLARS
How HIPAA runs in daily work
Privacy Rule
Minimum necessary access, workforce training and a Notice of Privacy Practices we can share on request.
Security Rule
Administrative, physical and technical safeguards documented and reviewed on a schedule.
Breach Notification
A written incident response plan with named owners and defined timelines.
Business Associate
Signed BAA before any PHI moves. Downstream subcontractors covered under written flow-down agreements.
Administrative safeguards
- Named Security Officer and Privacy Officer
- Workforce training on hire and annually
- Written policies with version history
- Vendor risk review before onboarding a subcontractor
Technical safeguards
- Encryption in transit and at rest
- Role-based access control with periodic review
- No PHI on personal or unmanaged devices
- Access logs retained per policy
Need a BAA or a copy of our security summary?
We can send both before your first call. No forms, no gatekeeping.