Security & HIPAA Compliance Statement
RevCycleMGMT builds and operates revenue-cycle infrastructure for healthcare practices. We protect electronic protected health information (ePHI) with safeguards in all three HIPAA Security Rule families, and we run our compliance program on the standard published elements: written standards, a designated official, training, monitoring, enforced discipline, and corrective action.
Administrative safeguards
- A designated Security Official and Privacy Official responsible for security and privacy policy.
- Written, versioned security and privacy policies with ongoing risk analysis and periodic evaluation.
- Workforce training on privacy and security, with applied discipline for violations.
- Role-based information-access management on the least-privilege principle, with authorization and supervision of workforce members who work with ePHI.
- A contingency and continuity plan; HIPAA documentation retained at least six years.
Physical safeguards
- Facility access controls for systems and equipment; authorized access preserved.
- Workstation and device security standards specifying proper use and access.
- Controlled procedures for transferring, re-using, and disposing of electronic media.
Technical safeguards
- Access control: unique accounts and role-based permissions so only authorized persons reach ePHI.
- Audit controls: append-only activity records on systems that hold or use ePHI.
- Integrity controls preventing improper alteration or destruction of ePHI.
- Transmission security for data in motion, and malicious-software protections.
Organizational requirements
Written Business Associate Agreements govern every PHI relationship, upstream and downstream — see Business Associate Agreements. Vendors whose services never touch PHI are documented as out of scope. Policies, procedures, and documentation are maintained, reviewed, and retained for six years.
Breach notification
We maintain a written breach-notification policy under the HIPAA Breach Notification Rule: documented risk assessment on every incident, notification of affected client practices without unreasonable delay (our contractual standard is 10 business days, well inside the 60-day legal limit), support for individual, media, and HHS notifications where required, an append-only incident register, and no retaliation for good-faith reporting.
Our product carries the same discipline
The RevCycleMGMT practice-management platform is built with tenant isolation, role-based access control, append-only audit trails, and deterministic, testable behavior — and every public demonstration runs on synthetic data only.