Security and compliance
Enrollment runs on facts about your practice. Patient information waits for a signed agreement.
The Payer Enrollment Sprint and a Service Line answer need nothing about any patient. The billing review starts from report totals. The on-screen walk-through and any system access come after your practice and Health Revenue Intelligence, LLC sign a business associate agreement, and so does billing.
Summary
What is a business associate agreement, and does a billing company need one?
A business associate agreement is the contract HIPAA requires before a vendor handles a practice's patient information on its behalf. A billing company needs one. Ours is signed before any patient information changes hands.
Enrollment never touches a patient record. Billing does, under an agreement.
A payer asks about licenses, NPIs, ownership, malpractice cover and the answers on each provider's CAQH profile. Some of it is personal to the provider, and we guard it as closely as patient data.
| Stage | What we work from | Patient information |
|---|---|---|
| Billing review | Your report totals, your payer list, your providers, your state and where each application stands. The on-screen walk-through and any system access come after the agreement is signed. | None until the agreement is signed |
| Payer Enrollment Sprint | Practice and provider documents, CAQH access and the payers' own forms. | None |
| Service Line Made Billable | The service, your specialty, your payer mix and the payers' published rules. | None |
| Billing and revenue cycle | Eligibility checks, authorizations, claims, remittances and the notes a denial turns on. | Yes, after the agreement is signed |
A business associate agreement comes before the first claim.
Ours is signed by Health Revenue Intelligence, LLC, the firm HRI Med is part of. It commits us to use patient information only for the work you hired us to do, to protect it, to tell you if it is ever exposed, and to return or destroy it when the work ends. If your compliance officer has a form of their own, send it.
Your proposal and agreements set out the responsibilities for the work and the handling of practice information.
The people doing your work read what you send.
A request from this site goes to the people responsible for the work you select.
Provider documents leave our hands only when an application needs them: to CAQH, to Medicare through PECOS, to your state's Medicaid program and to the commercial payers on your plan.
A practice's working files are kept secure under its name, shared with the people your practice tells us to include.
Three outside services carry your messages.
| Service | What it does for HRI Med | What passes through it |
|---|---|---|
| Our hosting provider | Hosts these pages over HTTPS, runs the form and its spam check, and counts a few site events.The counts record a page path and an event name. They hold nothing you typed. | Your request, on its way to email |
| Our email delivery service | Delivers the request to our inbox and sends you a receipt. | What you typed into the form |
| Our business email provider | Our business email, and the secure file system for the practice's working files. | Correspondence and provider documents; patient information only under a signed agreement |
The site's own code sets no cookies and loads no advertising trackers. How long form data is kept is on the privacy page.
Common security and compliance questions.
Can we send a denial letter for the review?
Please describe it in words instead. A denial letter names a patient.
What if someone on our staff sends patient details by mistake?
Tell us. We remove the message from our inbox, confirm that to you in writing, and ask for the facts again without the patient in them.
Will you answer our security questionnaire?
Yes, before anything is signed.
Send your security questions with the request.
Put them in the message box beside your payer list.
You can raise the terms of the business associate agreement in the same message.