HIPAA Statement
Execil provides medical billing and revenue cycle management to medical practices. In HIPAA terms, we are a business associate of each practice we work for. This page explains what that means in practice and what we commit to.
It is not a Notice of Privacy Practices. That is the document your practice gives its patients.
Agreement first
We sign a business associate agreement with every client before any protected health information is shared with us. No claims, notes or patient data move until it is in place.
The agreement sets out what we may do with protected health information, how we protect it, and what happens if something goes wrong.
Where the data lives
We work inside the practice's own practice management and EHR systems, under user accounts the practice controls. Patient records and claims stay in those systems. We do not move them into a separate database of our own.
This also means that if a practice stops working with us, there is nothing to hand back. The practice removes our access and its data is exactly where it always was.
Minimum necessary
Each person on our team can see only what their work requires. Access is tied to a role, reviewed regularly, and removed when someone's role changes or they leave.
Safeguards
Everyone who handles protected health information is trained before they start and at least once a year. We keep written privacy and security policies and a named person is responsible for them.
- Every person has their own login. Shared accounts are not used.
- Multi-factor authentication is used wherever the practice's systems support it.
- Connections to the practice's systems are encrypted.
- Protected health information is never sent over ordinary email or messaging.
- It is not printed or saved to removable media.
Subcontractors
If we use a subcontractor who will handle protected health information, they sign a business associate agreement with us that carries the same obligations we have to you.
If something goes wrong
If we discover a breach of unsecured protected health information, we notify the practice without unreasonable delay, and in no case later than 60 calendar days after discovery, or sooner if the business associate agreement requires it. We help with the practice's own notification obligations.
This website
This website does not collect protected health information and is not a way to send it to us. Do not include patient names, dates of birth, diagnoses, claim details or similar information in the assessment form or in email. Ordinary email is not a secure channel for patient information, and we do not treat it as one.
If you have a question about a specific claim, tell us and we will arrange a secure channel once an agreement is in place.
Contact
Questions about this page, or a request under it, go to contact@execil.net or +1 (914) 513-4535.