HIPAA notice.
Verified RCM acts as a Business Associate to the healthcare providers we serve, as defined under the Health Insurance Portability and Accountability Act (HIPAA) and the HITECH Act. This notice describes how we safeguard protected health information (PHI) in that role.
Effective August 4, 2026.
Business Associate Agreements
Before any PHI is exchanged, we execute a signed Business Associate Agreement (BAA) with every client practice, defining the permitted uses of PHI, required safeguards, and breach notification obligations on both sides.
Administrative safeguards
- ✓Annual HIPAA training for all staff with system access
- ✓Signed confidentiality agreements for every employee and contractor
- ✓Role-based access limited to the minimum necessary PHI for each job function
- ✓A documented incident response and breach notification procedure
Technical safeguards
- ✓Encryption of PHI at rest and in transit
- ✓Unique login credentials and multi-factor authentication on all systems touching PHI
- ✓Audit logging on every chart touch, reviewed on a regular cadence
- ✓Automatic session timeouts on all workstations
Breach notification
In the unlikely event of a breach involving unsecured PHI, we notify the affected covered entity without unreasonable delay and in accordance with the timelines set by the HITECH Act, so the practice can meet its own notification obligations to patients.