Draft for review: have your attorney review this text before the site goes live.
When we answer calls, work claims or run software for a healthcare provider, we may handle protected health information (PHI). This notice explains how we protect it under the Health Insurance Portability and Accountability Act (HIPAA) and our agreements with each client.
On this page
Our role under HIPAA
Our clients, such as physicians, clinics and other healthcare providers, are covered entities under HIPAA. When we perform front desk, billing, revenue cycle or software services that involve PHI on their behalf, InCareMD acts as their business associate. We use and disclose PHI only as our business associate agreement and HIPAA allow, and only to provide the services the client has asked for.
Business associate agreements
We sign a business associate agreement (BAA) with every client before any work begins and before we receive any PHI. The BAA sets out how we may use PHI, the safeguards we maintain, how we report incidents and what happens to PHI when the relationship ends. Clients can sign the BAA electronically and keep a signed PDF for their records.
Minimum necessary use
We follow the minimum necessary standard. Team members are assigned to specific practices and see only the practices and modules their work requires. Software screens mask sensitive values by default, for example showing only the last digits of a number and an age instead of a full date of birth.
Workforce training and accountability
Every team member completes HIPAA privacy and security training before working with client information and agrees to our confidentiality and acceptable use rules. Training is refreshed regularly. Access is removed promptly when a person changes roles or leaves, and violations of our policies lead to disciplinary action.
Safeguards
Administrative safeguards
- Written privacy and security policies, with a named person responsible for them.
- Risk assessment and review of our safeguards as our services and systems change.
- Role-based access approved for each person and each practice.
Physical safeguards
- Work is done on company-approved devices with screen locks.
- Systems that store PHI run in secured, access-controlled hosting facilities.
Technical safeguards
- Encryption: in Pulseline and MDClaim360, sensitive fields such as patient names, dates of birth, call details, appointment reasons and medications are encrypted with AES-256-GCM, and data is encrypted in transit.
- Two-factor sign-in: required for staff accounts.
- Role-based access: each person sees only the modules and practices they are allowed to, checked on every action.
- Audit logging: every view and export of a patient record is logged, and the log cannot be edited or deleted.
- Automatic sign-out: sessions end after 15 minutes of inactivity, with a warning first.
- Backups and retention: encrypted backups, retention settings and legal hold.
Read more about how we protect data on our Security page.
Subcontractors
If we use a subcontractor that creates, receives, maintains or transmits PHI for us, such as a hosting provider, we sign a business associate agreement with that subcontractor first, requiring the same protections we give our clients.
Breach notification
If we discover a breach of unsecured PHI, we will notify the affected client without unreasonable delay, and no later than the HIPAA Breach Notification Rule and our BAA require. We will share what happened, the information involved, what we are doing about it and what the client may need to do, and we will help the client meet its own notification duties to patients and regulators.
Patient rights
If you are a patient of one of our clients, your rights under HIPAA, such as the right to see, get a copy of or correct your records, are handled by your healthcare provider. Please contact your provider's office directly. If we receive a request from a patient, we forward it to the right provider and help them respond.
When a client leaves
Our plans are month to month. When a client relationship ends, we return or destroy PHI as the BAA requires and follow the client's retention settings. If return or destruction is not feasible, we continue to protect the information and limit further use.
This website is not for PHI
This website is for business inquiries only. Please do not send patient health information through its forms, live chat or Ava, the website assistant. Information you share on the website is covered by our Privacy policy.
Report a concern
Clients and anyone else can report a privacy or security concern to us at any time. We investigate every report.
- Email: contact@incaremd.com
- Phone: (833) 4-CARE-98 (Mon–Fri 9 AM–5 PM EST; operations run 24/7)
This notice describes our practices as a business associate. It is not a Notice of Privacy Practices for patients and is not legal advice.