HIPAA notice

What this notice is, and what it is not

This is a statement of how iFocus RCM Solutions LLC handles protected health information, or PHI, when a practice engages us. It explains our position and our obligations as a business associate under the Health Insurance Portability and Accountability Act and the HITECH Act.

This is not a Notice of Privacy Practices. A Notice of Privacy Practices is issued by a covered entity, such as your practice, to its own patients, and describes patients’ rights with respect to that practice. If you are a patient looking for that notice, ask the practice that treated you. We do not have a direct relationship with patients and we do not use PHI for our own purposes.

We sign a business associate agreement before any PHI moves

We do not accept, access or process PHI without a signed business associate agreement in place. That applies to a full engagement and equally to a free ninety day audit: if an audit involves PHI, the agreement is signed first.

The agreement sets out the permitted uses and disclosures, our safeguard obligations, breach notification, the treatment of subcontractors, and what happens to the information when the engagement ends. Where the agreement and this page differ, the agreement governs.

What we use PHI for

We use and disclose PHI only as the business associate agreement permits or requires, and as law requires. In practice that means using it to carry out the billing functions the practice has engaged us for, such as:

• verifying eligibility and benefits, and obtaining prior authorisations;
• coding, charge entry, claim preparation, scrubbing and submission;
• posting payments and reconciling remittances;
• working denials, appeals and accounts receivable;
• patient statements and balance follow up;
• producing reporting for the practice.

We do not sell PHI. We do not use it for marketing. We do not use or disclose it for our own purposes, and we do not use it outside the engagement except for our own proper management and administration or to carry out our legal responsibilities, as permitted by the agreement.

Minimum necessary, and least privilege

We ask for and use the minimum information necessary for the task. Access is granted per person and per system on a least privilege basis, reviewed as roles change, and removed when someone leaves the account or the company.

Wherever the practice can grant us role based access inside its own systems, we work that way rather than taking copies of data out of them.

Safeguards

We maintain administrative, physical and technical safeguards designed to protect the confidentiality, integrity and availability of the PHI we handle, as required by the HIPAA Security Rule. These include:

• Administrative. A named person accountable for privacy and security, documented policies and procedures, a security risk analysis, access authorisation and review, and workforce sanctions for breach of policy.
• Physical. Controlled access to workplaces and equipment, and controls on the removal, reuse and disposal of devices and media that hold PHI.
• Technical. Unique user accounts, multi factor authentication where the system supports it, encryption of PHI in transit, session controls, and audit logging of access to systems holding PHI.

We make no claim to any certification or accreditation, such as SOC 2 or HITRUST, unless it is stated in writing in a signed agreement.

Training

Workforce members who handle PHI receive HIPAA privacy and security training before they are given access, and refresher training periodically and whenever our policies change materially. Training is recorded.

Subcontractors

Where we engage a subcontractor who will create, receive, maintain or transmit PHI on our behalf, we enter into a written agreement with that subcontractor imposing obligations at least as protective as those in our agreement with the practice, as HIPAA requires.

Breach notification

If we discover a breach of unsecured PHI, we will notify the affected practice without unreasonable delay and in no case later than 60 calendar days after discovery, as required by 45 CFR 164.410.

Our notification will identify the individuals affected so far as we know them, describe what happened and when, what information was involved, what we have done in response and to mitigate harm, and what we are doing to prevent a recurrence. We will cooperate with the practice in meeting its own notification obligations.

Supporting patients’ rights

Patients exercise their HIPAA rights through the practice that treated them, not through us. Where PHI we hold is part of a designated record set, we will assist the practice in responding to a patient’s request for access, for amendment, or for an accounting of disclosures, within the timeframes the agreement sets.

If a patient contacts us directly, we will refer them to their practice.

When an engagement ends

At the end of an engagement we return or destroy the PHI we hold, as the agreement directs. Where return or destruction is not feasible, we extend the protections of the agreement to that information and limit further use and disclosure to the reasons that make return or destruction infeasible.

Do not send PHI through this website

The forms on this website are not a secure channel for PHI and are not covered by a business associate agreement. Please do not submit patient information through them. Contact us and we will arrange a secure transfer.

Raising a concern

If you believe we have mishandled PHI, contact us at info@ifocusrcm.com or +1 (281) 406-1401 and we will investigate and respond. We will not retaliate against anyone for raising a concern in good faith.

You may also complain to the practice that engaged us, and you have the right to complain to the Secretary of the U.S. Department of Health and Human Services, Office for Civil Rights, at hhs.gov/ocr/complaints.