Privacy Policy
- Effective Date: 14 May, 2025
At Medi Billing, your privacy and the protection of sensitive healthcare data are of the utmost importance. This Privacy Policy explains how we collect, use, disclose, and safeguard your information, particularly Protected Health Information (PHI), in full accordance with the Health Insurance Portability and Accountability Act (HIPAA) and other relevant data protection regulations.
1. Information We Collect
We collect personal, professional, and health-related information strictly to provide our medical billing and revenue cycle management services. This may include:
Personal Information
- Name
- Email address
- Phone number
- Business address
- Professional credentials (e.g., NPI, license numbers)
Protected Health Information (PHI)
- Patient names
- Dates of service
- Diagnosis and procedure codes (ICD-10, CPT)
- Insurance details
- Billing and payment records
Website & Communication Data
- IP addresses
- Browser and device information
- Communication preferences
- Interaction history with our website or customer support
2. How We Use Your Information
At Medi Billing, we use your information strictly for the purpose of delivering efficient, secure, and compliant medical billing services. We do not use or share your data for marketing purposes or any unrelated commercial activities. Below is a more detailed explanation of how your information is utilized:
a. Claim Preparation and Submission
We use your practice’s data, including PHI, to generate and submit clean claims to insurance payers, Medicare, and Medicaid. This includes verifying patient eligibility, selecting the appropriate CPT/ICD codes, and ensuring that all documentation meets payer requirements.
b. Payment Processing and Reconciliation
Our team uses billing and payer remittance information to track claim statuses, post payments, and reconcile Explanation of Benefits (EOBs) or Electronic Remittance Advice (ERAs). This helps ensure your revenue is accurately recorded and any payment discrepancies are promptly resolved.
c. Medical Coding Audits and Reviews
To reduce denials and maintain compliance, we analyze submitted claims and supporting documentation for proper coding. This includes:
- Cross-checking diagnosis-to-procedure alignment
- Identifying undercoding or overcoding risks
- Applying appropriate modifiers and units
d. Practice and Patient Communication
As authorized by you, we may contact your team or patients (e.g., regarding missing info or eligibility questions) to ensure claims are submitted completely and accurately. All communication is conducted securely and professionally.
e. Regulatory Compliance and Reporting
We generate reports that help your practice meet documentation, audit, and payer transparency requirements. This includes:
- Claim logs and audit trails
- Utilization and financial performance reports
- Documentation for payer inquiries or prepayment reviews
f. Process Improvement and Quality Assurance
We internally analyze anonymized or aggregated data to assess billing trends, improve our workflow efficiency, and enhance the service we provide to you. This data is never used in a way that compromises privacy.
g. Contractual Obligations
We process and store your data to fulfill obligations under service agreements, payer rules, and state/federal laws. This includes responding to audits or complying with legal requests in a HIPAA-compliant manner.
Note: Your data will only be used within the scope of our medical billing relationship, and only by trained staff who are subject to strict confidentiality agreements.
3. HIPAA Compliance (Our Priority)
At Medi Billing, compliance with the Health Insurance Portability and Accountability Act (HIPAA) is not just a legal requirement—it’s a core pillar of how we operate. We understand that the information you entrust to us involves highly sensitive patient health records, and we are fully committed to protecting that information from unauthorized access, misuse, or exposure.
a. Our Role as a HIPAA Business Associate
Under HIPAA, we operate as a Business Associate of your healthcare practice (the Covered Entity). This means we are legally bound to handle PHI responsibly and follow all security, privacy, and breach notification rules under HIPAA and the HITECH Act.
We enter into Business Associate Agreements (BAAs) with all of our clients, clearly outlining each party’s responsibilities for protecting PHI.
b. Technical Safeguards
- Data Encryption: All PHI is encrypted using industry-standard protocols (e.g., AES-256) both in transit and at rest.
- Firewall and Intrusion Detection Systems: Our networks are protected by enterprise-grade security systems to prevent unauthorized access.
- Secure File Transfer Protocols: All electronic communications involving PHI use HIPAA-compliant transfer methods (e.g., secure FTP, encrypted email portals).
c. Administrative Safeguards
- Access Controls: Employees only have access to PHI that is necessary for their role. All access is monitored and logged.
- Regular HIPAA Training: Every staff member undergoes initial and annual HIPAA training, including data handling protocols, patient confidentiality, and breach prevention.
- Privacy Policies & Confidentiality Agreements: All employees must sign data use and confidentiality policies as a condition of employment.
d. Physical Safeguards
- Restricted Workspaces: Access to workstations handling PHI is physically restricted and monitored.
- Secure Disposal of PHI: Any printed or hard-copy PHI is securely shredded in compliance with HIPAA disposal rules.
e. Breach Notification and Contingency Planning
- In the rare event of a data breach, we will notify your practice within the required HIPAA timeframe and provide all necessary documentation.
- We maintain a tested disaster recovery and business continuity plan to ensure ongoing data protection during emergencies, outages, or cyber threats.
f. Ongoing Compliance Monitoring
We conduct regular internal audits and partner with HIPAA compliance consultants to:
- Assess our safeguards
- Ensure adherence to evolving regulations
- Address any vulnerabilities proactively
At Medi Billing, HIPAA is more than a checkbox—it’s a culture. Every system, policy, and team member is aligned to ensure that patient data remains secure, confidential, and fully compliant with the highest standards in the healthcare industry.
4. Data Sharing and Disclosure
At Medi Billing, your privacy is paramount. We do not sell, rent, or trade your information to third parties under any circumstances. However, certain situations require us to share data strictly to support your billing operations and comply with legal standards.
When and How We Share Data:
- For Claims Submission and Revenue Cycle Management
We may share necessary data with insurance companies, clearinghouses, or third-party payers to submit claims, verify eligibility, obtain prior authorizations, or process reimbursements. This is done in strict accordance with HIPAA regulations. - With HIPAA-Compliant Service Providers
We may collaborate with third-party vendors (e.g., EHR software providers, cloud platforms, credentialing companies) who support our operations. These entities are bound by Business Associate Agreements (BAAs) and are required to implement HIPAA-compliant data protection measures. - At Your Request
If you, as a client or authorized representative, request data sharing with a third party (e.g., a legal team, consultant, or practice manager), we will honor the request upon receiving proper written authorization. - To Comply with Legal Obligations
In rare cases, we may be required to share data in response to:- A court order, subpoena, or other legal processes
- A request from a government agency such as HHS or CMS
- A situation involving fraud, abuse, or criminal investigation, where mandated by law
Important: We ensure that all data shared—when legally or operationally necessary—is limited to the minimum amount required for the intended purpose.
5. Data Retention
We retain client and patient data only as long as necessary to fulfill our contractual, legal, and regulatory obligations. Retention periods are based on the type of data, applicable state laws, and federal healthcare regulations.
Typical Retention Timeframes:
|
Type of Data
|
Retention Period
|
Governing Rule
|
|---|---|---|
|
Medical Records
|
6-10 years after last patient visit
|
HIPAA state laws
|
|
Billing Claims
|
7-10 years
|
IRS, CMS guidelines
|
|
Insurance EOBs
|
7 years
|
Financial auditing
|
|
Emails/Communications
|
2-5 years (varies by policy)
|
Practice policy
|
Secure Archiving:
After the retention period expires, data is securely archived or permanently deleted using HIPAA-compliant disposal methods, including digital wiping and shredding of printed records.
We are committed to storing and handling your data only for as long as it serves a legitimate operational or legal purpose.
6. Your Rights
As a healthcare provider or designated representative, you retain important rights concerning the data we process on your behalf.
Your Rights Include:
- Right to Access
You may request a copy of the billing-related data we hold for your practice or on behalf of your patients. We will respond promptly and provide this in a secure format. - Right to Request Corrections
If you believe any of the data is incomplete or inaccurate, you may submit a correction request. We will make updates in accordance with HIPAA and payer documentation standards. - Right to Request Restrictions
You can request that we limit the use or disclosure of your information. While we may not always be able to comply with all restriction requests (e.g., in the case of legal audits or payer requirements), we will honor them wherever possible. - Right to Audit or Review Records
You may audit our use of your data, request access logs, and review reports related to claim submissions, payment posting, or PHI handling. - Right to File a Complaint
If you believe your privacy rights have been violated or have concerns about how your data is handled, you may:- File a complaint with our Privacy Officer (contact details available on our website)
- File a formal complaint with the Office for Civil Rights (OCR) at the U.S. Department of Health and Human Services
We will not retaliate against anyone who exercises their privacy rights or files a complaint in good faith.
7. Data Security
Protecting your data is at the heart of our business. We implement comprehensive technical, administrative, and physical safeguards to prevent unauthorized access, use, or disclosure of sensitive information.
Key Security Measures:
- Encryption
All data is encrypted using industry-standard protocols (e.g., AES-256) both in transit (e.g., during claim submission or email transmission) and at rest (e.g., on servers or databases). - Access Controls
Our team uses role-based access systems to ensure staff only see the information required for their job. We regularly update passwords and implement two-factor authentication (2FA). - Ongoing Monitoring & Audits
We perform routine vulnerability scans, penetration tests, and internal audits to detect and address potential risks in real-time. - Security Incident Response
In the unlikely event of a data breach or security incident, we:- Immediately contain and assess the scope
- Notify affected clients and regulators as required by HIPAA Breach Notification Rule
- Document corrective actions and implement improvements
- Employee Training
All staff complete mandatory training on data security, HIPAA, phishing prevention, and safe handling of PHI during onboarding and at least annually thereafter.
8. Cookies & Website Analytics
Our website uses standard web technologies to enhance your experience and understand how visitors engage with our content. This section outlines how we handle data collected via our digital platforms.
Use of Cookies:
Cookies are small data files stored in your browser that help our website remember preferences and improve performance. Types of cookies we use:
- Essential cookies – to enable core functions like navigation and access to secure areas
- Performance cookies – to analyze traffic and usage patterns via tools like Google Analytics
Important Notes:
- We do not collect or track Protected Health Information (PHI) through cookies or analytics.
- You may disable cookies via your browser settings at any time. This will not affect your access to our services.
Third-Party Analytics:
We use services such as Google Analytics and Hotjar to understand how users interact with our site. These tools collect non-personal data (like page views, bounce rates, device type) to help us improve functionality.
If you submit a contact form or sign up for a newsletter, your information is stored securely and used only for communication related to your inquiry—never sold or shared with third parties.
9. Children’s Privacy
Our services are intended for licensed healthcare providers and their staff. We do not knowingly collect any data from individuals under the age of 18.
10. Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in laws, technology, or services. Updates will be posted on this page with a new “Effective Date.” We encourage you to review this policy periodically.
Contact Us
If you have any questions, concerns, or requests related to this Privacy Policy or how your information is handled, please contact us:
