← Compliance
Business Associate Agreements
RevCycleMGMT performs billing, claims, and revenue-cycle functions involving protected health information (PHI) on behalf of healthcare practices. Under HIPAA, that makes us a business associate — and it means a written Business Associate Agreement (BAA) governs every PHI relationship we have.
Our standing rule: no BAA, no PHI. We sign a BAA with every client practice before any patient information flows, and every subcontractor that touches PHI for us signs an agreement at least as protective.
What every BAA we sign contains
- Specific permitted and required uses and disclosures of PHI — nothing beyond them.
- Administrative, physical, and technical safeguards meeting the HIPAA Security Rule.
- Prompt reporting of any non-permitted use, security incident, or breach of unsecured PHI — our standard is within 10 business days of discovery.
- Written flow-down of the same restrictions to any subcontractor before access.
- Support for patient rights: access, amendment, and accounting of disclosures.
- Availability of our practices, books, and records to the U.S. Department of Health and Human Services.
- Return or destruction of PHI at termination, with protections extended wherever destruction is infeasible.
- Termination for cause on material breach, and minimum-necessary discipline throughout.
For prospective clients
Our BAA is part of onboarding — it is executed alongside the services agreement, before implementation begins. To request our BAA or ask a question about our HIPAA posture, contact [email protected].
See also: Security & HIPAA Compliance Statement · Notice of Privacy Practices