HIPAA notice

Our role

When VisMed provides revenue cycle, credentialing or administrative services to a physician practice, we act as a business associate under the Health Insurance Portability and Accountability Act. The practice is the covered entity; we handle protected health information on its behalf and under its direction.

This notice describes our obligations. It does not replace the Notice of Privacy Practices that a practice provides to its own patients — patients should refer to their provider's notice for their individual rights.

Business associate agreement

We execute a business associate agreement with every practice before any protected health information is accessed or exchanged. That agreement governs permitted uses, safeguards, subcontractor obligations, breach reporting, and what happens to data when the engagement ends. Where its terms are more specific than this notice, the agreement controls.

How we use protected health information

Only as the agreement permits and as the work requires, which in practice means:

• Eligibility and benefit verification with payers
• Coding, charge capture and claim preparation
• Claim submission, status inquiry, appeals and payment posting
• Prior authorization submission and follow-up
• Provider credentialing and payer enrollment
• Reporting back to the practice on its own data

We do not use or disclose protected health information for any purpose the agreement does not permit, and we do not use it for marketing or sell it under any circumstances.

Safeguards

• Encryption in transit and at rest
• Role-based access, granted on a minimum-necessary basis and reviewed periodically
• Unique credentials and multi-factor authentication for systems holding clinical data
• Access logging and audit trails
• HIPAA and security training for personnel, with access revoked when no longer required
• Written policies covering incident response, sanctions and workforce clearance

Subcontractors

Any subcontractor that may encounter protected health information is bound by a written agreement imposing obligations at least as restrictive as those we owe the practice.

Breach notification

If we discover a breach of unsecured protected health information, we notify the affected practice without unreasonable delay and within the period the business associate agreement specifies, providing the detail the practice needs to meet its own notification obligations.

Individual rights

Requests for access, amendment, an accounting of disclosures, or restriction should be directed to the practice that holds the relationship with the individual. We support the practice in responding to those requests as the agreement requires.

Minimum necessary

We request and use the minimum protected health information necessary for the task. Where a payer or workflow requires less than a full record, we work from less.

Return or destruction

At the end of an engagement we return or destroy protected health information as the agreement directs. Where return or destruction is infeasible, protections continue to apply for as long as the information is retained.

Contact

Compliance questions, business associate agreement requests, or a suspected incident can be raised through our contact page, and will be routed to the compliance contact directly.