Compliance Officer Statement: At RevoCentra, HIPAA compliance is not a checkbox; it is the fundamental architectural foundation of our business. We execute a binding Business Associate Agreement (BAA) with every healthcare client prior to handling a single superbill, patient encounter, or remittance file.
1. Business Associate Commitment
Under the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and the Health Information Technology for Economic and Clinical Health Act (HITECH) provisions of the American Recovery and Reinvestment Act of 2009, medical billing companies that create, receive, maintain, or transmit Protected Health Information (PHI) are legally classified as Business Associates.
RevoCentra is directly liable under federal law for compliance with the HIPAA Security Rule and portions of the HIPAA Privacy and Breach Notification Rules. We welcome and uphold this responsibility across all 50 states.
2. Administrative Safeguards (45 CFR § 164.308)
Our administrative security policies establish formal governance over workforce activities, risk evaluation, and emergency operations:
- Continuous Security Risk Analysis: We conduct comprehensive quarterly vulnerability scans and annual formal third-party risk assessments to identify potential vulnerabilities across all network endpoints, databases, and transmission lines.
- Formal Sanction Policy: Strict disciplinary standards, up to and including immediate termination and referral for criminal prosecution under federal statutes, are enforced for any intentional or negligent mishandling of PHI.
- Information System Activity Review: Automated Security Information and Event Management (SIEM) systems continuously monitor audit logs, access attempts, file exports, and system anomalies 24 hours a day, 7 days a week.
- Business Continuity & Disaster Recovery: Redundant encrypted data backups are mirrored across geodiverse U.S. data centers with Recovery Time Objectives (RTO) under 4 hours and Recovery Point Objectives (RPO) under 15 minutes.
3. Physical Safeguards (45 CFR § 164.310)
We restrict physical access to facilities and electronic equipment containing practice data:
- Tier-III & Tier-IV Cloud Facilities: RevoCentra cloud infrastructure is housed in SSAE 18 SOC 1, SOC 2 Type II, and ISO 27001-certified data centers featuring biometric access barriers, mantrap entrances, 24/7 video surveillance, and dual-source uninterrupted power supply (UPS).
- Clean-Desk & Clean-Screen Operations: In our operational billing centers, paper clinical documents are prohibited. Billing analysts operate in paperless environments with zero printing capabilities on production floors.
- Device & Hardware Lockdowns: Universal Serial Bus (USB) mass storage, Bluetooth file transfers, external hard drives, and screen capture tools are disabled at the operating system kernel level on all billing workstations.
4. Technical Safeguards (45 CFR § 164.312)
Our technology architecture implements rigorous technical controls to protect Electronic Protected Health Information (ePHI):
- Zero-Trust Identity & RBAC: Every billing specialist is assigned a unique, audited user identifier. Access is restricted strictly to assigned client practices based on the principle of least privilege.
- Mandatory Multi-Factor Authentication (MFA): FIDO2 hardware tokens or time-based one-time password (TOTP) authenticators are required for all staff logins to billing portals, EHR integrations, and VPN concentrators.
- Automatic Inactivity Session Timeouts: All active sessions automatically terminate and lock after 10 minutes of user inactivity to prevent unauthorized physical viewing.
- FIPS 140-2 Cryptographic Standards: Data in transit is protected using TLS 1.3 with strong cipher suites. Data at rest is encrypted using AES-256 bit encryption across all databases, backups, and file storage volumes.
- Immutable Audit Trails: Every viewing, creation, modification, export, or transmission of PHI generates a cryptographically signed, tamper-evident log record stored in a write-once-read-many (WORM) compliant repository.
5. Workforce Training & AAPC/AHIMA Oversight
Technology controls are only as strong as the human intelligence managing them:
- Mandatory Pre-Hire Background Checks: All prospective billing analysts and coders undergo comprehensive 7-year criminal background screening, Office of Inspector General (OIG) exclusions list verification, and identity audits.
- Annual HIPAA & Cybersecurity Certification: Every workforce member completes accredited HIPAA Privacy, Security, and Phishing Defense training upon hire and recertifies annually.
- Certified Coding Professionals: Our coding team maintains active certifications through AAPC (CPC, COC) and AHIMA (CCS), ensuring adherence to ethical coding guidelines, official AMA conventions, and fraud prevention protocols.
6. Breach Notification SLA (45 CFR §§ 164.400–414)
RevoCentra maintains an accelerated Breach Notification commitment that surpasses the standard federal 60-day statutory limit:
In the confirmed event of an unauthorized acquisition, access, use, or disclosure of your practice's unsecured PHI, RevoCentra guarantees written notification to your practice administrator within 24 to 48 hours of discovery, followed by an immediate forensic containment report and remediation plan.
7. Clearinghouse & Subcontractor Compliance
Under the HIPAA Omnibus Final Rule, Business Associates must hold downstream subcontractors to the identical privacy and security standards governing their primary contracts.
RevoCentra executes rigorous Business Associate Agreements with all clearinghouse partners (Change Healthcare, Availity, Waystar), secure telecommunications carriers, and cloud data center providers prior to routing any practice data.
8. Executing a Practice BAA
We provide a standardized, pre-executed Business Associate Agreement vetted by top healthcare regulatory counsel, or we are pleased to review and execute your hospital system or practice's proprietary BAA document.
Request Pre-Executed BAA Documentation:
Contact our Compliance Department to receive our standard Business Associate Agreement package, certificate of cyber liability insurance, and SOC 2 Type II summary report.