Compliance · HIPAA Privacy & Security
1 . The six pain points killing your margins
Healthcare practices trust us with sensitive patient information every day. We treat that trust as the foundation of our business. Our HIPAA program is built around three principles:
- Privacy by default — PHI is used and disclosed only as necessary to perform the services in our agreements, or as otherwise permitted or required by law.
- Security at every layer — administrative, physical, and technical safeguards protect PHI throughout its lifecycle.
- Accountability — documented policies, signed BAAs, ongoing training, vendor oversight, and a designated Privacy Officer responsible for compliance.
2 . Our role under HIPAA
HIPAA distinguishes between two main categories of regulated entities:
- Covered Entities — healthcare providers, health plans, and clearinghouses that create or maintain PHI in the ordinary course of providing healthcare.
- Business Associates — organizations that perform functions or services on behalf of a Covered Entity that involve the use or disclosure of PHI.
AllMedex is typically a Business Associate. When we provide medical billing, credentialing, payer enrollment, or revenue cycle management services, we operate under a written Business Associate Agreement (BAA) with each Covered Entity.
3 . What is PHI
Protected health information includes any individually identifiable health information transmitted or maintained in any form. Examples we routinely handle include:
- Patient demographic information (name, date of birth, address, contact information)
- Insurance and subscriber information
- Diagnoses, procedure codes, and treatment information necessary for billing
- Claim, payment, and remittance information
- Authorization, eligibility, and benefits information
- Provider and practice identifiers (NPI, taxonomy, license, DEA)
4 . Permitted uses & disclosures
We use and disclose PHI only as necessary to perform the services described in our agreement, or as otherwise permitted or required by law. Common permitted purposes include:
- Treatment, payment, and healthcare operations — submitting claims, posting payments, working denials, and supporting day-to-day RCM activities.
- Required by law — disclosures mandated by federal, state, or local law, court order, or lawful subpoena.
- Our own management and administration — limited internal uses such as quality assurance, training, and auditing.
- To subcontractors — only where bound by a written agreement requiring at least the same protections.
We do not sell PHI. We do not use or disclose PHI for marketing without authorization. We do not use PHI to train external machine learning or AI models.
5 . Minimum necessary
When using or disclosing PHI, we apply the minimum necessary standard: only the information reasonably needed to accomplish the intended purpose is accessed, used, or shared. Our access controls, role definitions, and workflow design are built around this principle.
6 . Safeguards we maintain
We implement administrative, physical, and technical safeguards in line with the HIPAA Security Rule.
Administrative safeguards
- Designated Privacy Officer and Security Officer
- Documented HIPAA Privacy and Security policies and procedures
- Risk analysis and risk management program with documented mitigation
- Workforce screening, onboarding, sanction policy, and termination procedures
- Incident response and disaster recovery plans, tested periodically
- Vendor risk reviews and signed Business Associate Agreements
Physical safeguards
- Restricted access to facilities and workstations handling PHI
- Clean-desk policy and secure storage of any printed materials
- Secure disposal of paper and media containing PHI
- Workstation use policies governing acceptable handling of PHI
Technical safeguards
- Unique user IDs, role-based access controls, and least-privilege provisioning
- Multi-factor authentication for systems containing PHI
- Encryption of PHI in transit (TLS) and at rest where supported
- Audit logging and monitoring of access to PHI
- Automatic session timeouts and access reviews
- Endpoint protection, patching, and configuration baselines
7 . Workforce training
Every member of our workforce who may come into contact with PHI completes HIPAA Privacy and Security training as part of onboarding and refreshes that training periodically. Training covers permitted uses and disclosures, minimum necessary, secure handling of PHI, password and device hygiene, social engineering, and incident reporting. Workforce members are bound by confidentiality agreements and a documented sanction policy.
8 . Subcontractors
Healthcare practices trust us with sensitive patient information every day. We treat that trust as the foundation of our business. Our HIPAA program is built around three principles:
- Privacy by default — PHI is used and disclosed only as necessary to perform the services in our agreements, or as otherwise permitted or required by law.
- Security at every layer — administrative, physical, and technical safeguards protect PHI throughout its lifecycle.
- Accountability — documented policies, signed BAAs, ongoing training, vendor oversight, and a designated Privacy Officer responsible for compliance.
9 . Breach notification
In the event of a confirmed or suspected breach of unsecured PHI, AllMedex will:
- Promptly investigate, contain, and document the incident
- Notify the affected Covered Entity in accordance with the BAA and HIPAA Breach Notification Rule timelines
- Provide the information needed for the Covered Entity to fulfill its own notification obligations
- Cooperate with reasonable mitigation, remediation, and audit activity
In the event of a confirmed or suspected breach of unsecured PHI, AllMedex will:
- Promptly investigate, contain, and document the incident
- Notify the affected Covered Entity in accordance with the BAA and HIPAA Breach Notification Rule timelines
- Provide the information needed for the Covered Entity to fulfill its own notification obligations
- Cooperate with reasonable mitigation, remediation, and audit activity
Suspect a security or privacy incident involving PHI we handle?
Contact our Privacy Officer immediately using the details below.
10 . Patient rights
HIPAA gives patients several rights regarding their PHI. These rights are exercised through the Covered Entity (your healthcare provider or practice), which is the legal custodian of the medical record. These generally include:
- Right to access and obtain a copy of PHI in a designated record set
- Right to request an amendment to PHI believed to be inaccurate or incomplete
- Right to an accounting of certain disclosures of PHI
- Right to request restrictions on certain uses and disclosures
- Right to request confidential communications by alternative means or location
- Right to receive a paper copy of the Notice of Privacy Practices on request
- Right to file a complaint without fear of retaliation
Have More Any Questions?
Have more questions? We’re here to help! Whether you need details about our billing process, services, or partnership options.
Frequently Asked Questions About Our Services
What is a medical billing company and how can it help me?
A medical billing company handles the financial side of healthcare for providers by managing patient billing, insurance claims, and reimbursements.
What is a medical billing service?
Medical billing services manage every financial touchpoint after a patient visit: verifying coverage, coding procedures, filing claims, appealing denials, and depositing funds to ensure healthcare providers receive full, compliant reimbursement.
What are the services offered by your medical billing company?
Our solutions align with international security standards and regulations, ensuring your business remains compliant while protecting sensitive information.
Can I Reschedule Or Cancel My Appointment?
Our medical billing firm offers a range of services, such as provider enrollment, insurance verification, charge entry, claim submission, payment posting, account receivable management, denial management, appeal management, patient billing, reimbursement tracking, and collection.
Can I monitor the performance and quality of the medical billing service I hire?
Of course. AllmedEx lets providers track the caliber and results of their facility’s billing. We also share reports on daily invoicing, key markers and offer feedback for revenue cycle advancement.
Do you offer independent and advanced medical billing services?
At our company, we have the people and processes to provide independent, specialized medical billing services for Medicaid and Medicare patients. Every state has its own rules for filing and getting paid, and we stay on top of them. We know which forms to fill out, which codes to use, and how to get it right the first time. We watch each claim to make sure it gets paid. If there are problems, we handle appeals so you recoup all owed payments.
Contact our Privacy Officer
For HIPAA questions, BAA requests, audit support, or to report a privacy or security concern: