Security practices
How we protect access, data and facilities
Plain answers to the questions your compliance team will ask. No overstated claims.
Illustrative imageAccess control
- Role-based access on the minimum-necessary principle
- Secure VPN / remote access into your systems
- Accounts you provision and can revoke at any time
- Multi-factor authentication and virtual desktops
Data handling
- Encrypted connections for data in transit
- Work performed inside your PM / EHR, clearinghouse and portals
- No migration of your data to a separate platform
- No local PHI storage, no USB media, no personal phones at desks
Facility
- Secure, access-controlled delivery center in Ahmedabad
- Private cabins for leads and sensitive calls
- Conference room for reviews and client calls
- Office visits and video walkthroughs on request
People
- NDAs signed by every team member
- Senior-led pods with clear accountability
- Background checks for team members
- HIPAA training for every team member
Agreements
- BAA signed with every practice before any access
- Breach notification as HIPAA and your BAA require
- No subcontractors touch your PHI
- Security questionnaires completed on request
Offboarding
- Access credentials revoked at the end of the engagement
- Open AR and work-in-progress handed over with notes
- PHI returned or destroyed as your BAA requires
- Your data always remains yours
About certifications
We don't claim third-party security certifications such as SOC 2, ISO 27001 or HITRUST. We'd rather describe our safeguards accurately than overstate them, and we're happy to complete your security questionnaire. If your organization needs a specific certification, we can discuss it during discovery.
How does your team access our systems?
Through secure VPN / remote access over encrypted connections, using user accounts you provision and can revoke at any time. Access is role-based, so each person sees only what their role requires. Multi-factor authentication and virtual desktops are used, managed by our internal IT team.
Is patient data stored on your computers?
We work inside your systems, so your data stays in your PM/EHR. No PHI is stored on local machines, USB and removable media are not permitted, and personal phones are not allowed at workstations.
How would we be notified of a security incident?
As required by HIPAA and the terms of your BAA. Any shorter contractual notification window is agreed in your BAA.
Do we get audit rights?
We're open to reasonable security reviews and questionnaires. Yes. Clients can audit us, as defined in the terms of your contract.
Free billing audit
Start with a free billing audit.
Before you commit to anything, our specialists review how your revenue cycle runs today: what's working, what isn't, and where revenue may be held up. No cost, no obligation.
What a typical audit looks at
- Denial patterns and root causes
- AR aging and stuck balances
- Coding and charge-capture gaps
- Eligibility and front-end workflow
- Payment posting and underpayments
- Practical next steps, clearly prioritized
No cost. No obligation. BAA signed first.