Privacy Policy & Data Safeguards

1. Overview & Business Associate Status

This Privacy Policy explains how RevoCentra Medical Billing Services LLC ("RevoCentra", "we", "us", or "our") collects, uses, protects, and discloses information obtained from healthcare practices, medical providers, administrative staff, and website visitors.

When providing revenue cycle management, certified medical coding, claim creation, electronic filing, payment posting, and denial recovery services, RevoCentra acts strictly as a Business Associate (as defined under 45 CFR § 160.103) to our healthcare provider clients ("Covered Entities"). We maintain a comprehensive compliance program designed to satisfy Title II of HIPAA, the HIPAA Privacy, Security, and Breach Notification Rules (45 CFR Parts 160 and 164), and the Omnibus Final Rule.

2. Information We Collect

In the execution of revenue cycle operations, we collect and process several categories of information on behalf of our client practices:

• Protected Health Information (PHI): Patient demographic data (full name, date of birth, address, phone number), insurance identifiers (subscriber ID, group number, policyholder info), clinical encounter documentation (superbills, provider notes, operative reports, diagnostic findings), and coding data (CPT, ICD-10-CM, HCPCS codes).
• Provider & Practice Data: Provider names, National Provider Identifiers (NPI), Tax Identification Numbers (TIN), State Medical License numbers, CAQH credentialing records, commercial payer contracts, and practice banking information for direct payer EFT deposit reconciliation.
• Website Inquiries: Contact information submitted via audit request forms, including practice name, administrator contact name, business email, telephone number, estimated monthly volume, and electronic health record (EHR) platform in use.
• Technical Log Data: Non-identifying IP addresses, browser types, session timestamps, and referral sources collected via server logs to ensure site security and prevent malicious traffic.

3. Permitted Uses and Disclosures of Health Information

Under 45 CFR § 164.502 and § 164.504(e), RevoCentra uses and discloses PHI solely as permitted or required by our Business Associate Agreement with your practice, or as required by law. Specifically, we use PHI to:

• Verify patient insurance eligibility, benefits coverage, copays, and deductible thresholds before encounters take place.
• Review clinical charts and superbills to assign accurate AMA CPT and ICD-10 diagnostic codes and modifier combinations.
• Generate and submit electronic ANSI ASC X12N 837P and 837I transactions to commercial clearinghouses and government payers.
• Process and reconcile electronic remittance advices (835 ERAs) and Explanation of Benefits (EOB) statements.
• Investigate, appeal, and resolve denied claims with commercial insurers, Medicare Administrative Contractors (MACs), and state Medicaid programs.
• Generate practice analytics, days in A/R benchmarks, and executive financial performance dashboards.

Zero Commercial Data Selling: RevoCentra never sells, rents, monetizes, or markets practice data, patient contact information, or clinical records to third-party advertisers, data brokers, or pharmaceutical marketers under any circumstances.

4. Minimum Necessary Rule & Access Controls

In adherence to 45 CFR § 164.502(b), RevoCentra enforces the Minimum Necessary Rule. Our billing systems, remote desktop environments, and workflow queues ensure that billing personnel are granted access exclusively to the specific patient records and practice data required to perform their designated billing or coding assignment.

Access privileges are strictly governed by Role-Based Access Controls (RBAC), multi-factor authentication (MFA), and automated session inactivity timeouts. Workforce access is terminated immediately upon role modification or employee separation.

5. Data Sharing & Electronic Clearinghouse Routing

To secure reimbursement for your practice, RevoCentra transmits claim files to sanctioned healthcare intermediaries:

• Accredited Clearinghouses: We partner with accredited healthcare clearinghouses (e.g., Change Healthcare, Availity, Waystar) operating under formal BAAs to validate claim syntax and route 837 batches to payers.
• Government & Commercial Payers: Claims and appeal documentation are delivered directly to Medicare, Medicaid, TriCare, and commercial health plans (e.g., Blue Cross Blue Shield, UnitedHealthcare, Aetna, Cigna, Humana).
• Subcontractors & Technology Vendors: Any cloud infrastructure provider or specialized billing software vendor utilized by RevoCentra must execute a binding Business Associate Agreement confirming equivalent HIPAA security controls.

6. Technical & Physical Safeguards

RevoCentra employs enterprise-grade cybersecurity controls to protect data confidentiality, integrity, and availability:

• Encryption in Transit: All data transmitted between your practice EHR and our billing systems is encrypted using Transport Layer Security (TLS 1.3) protocols.
• Encryption at Rest: All stored practice records, claims histories, and electronic documents are protected with FIPS 140-2 validated AES-256 bit encryption.
• Secure Data Centers: Systems are hosted within SOC 2 Type II and ISO 27001 certified cloud environments featuring 24/7 biometric physical perimeter security, redundant power, and environmental failovers.
• No Local Endpoint Storage: Billing analysts work through sandboxed virtual desktop environments (VDI). Downloading PHI to personal laptops or removable USB media is cryptographically blocked at the operating system level.

7. Data Retention & Record Disposal

We retain practice billing records, claim logs, and remittance records for the duration mandated by federal and state regulatory authorities (typically 6 to 7 years following claim adjudication, or longer where state pediatric records statutes apply).

Upon contract termination, RevoCentra provides a complete export of practice receivables and reconciliations, and permanently purges or returns PHI in accordance with NIST SP 800-88 Rev. 1 media sanitization standards, subject to surviving legal retention obligations.

8. Security Breach Notification Protocols

In compliance with 45 CFR §§ 164.400–414 (the HIPAA Breach Notification Rule), RevoCentra maintains an active Incident Response Plan. In the unlikely event of a confirmed breach of unsecured PHI affecting your practice records:

• We will notify your designated Privacy Officer in writing without unreasonable delay and in no case later than 24 to 48 hours following discovery.
• We will provide an exhaustive incident report detailing the nature of the breach, the specific individuals affected, the types of PHI involved, and immediate containment measures executed.
• We will cooperate fully with your practice and regulatory bodies to mitigate harmful effects and fulfill state and federal notification obligations.

9. State Privacy Regulations

To the extent state privacy laws (such as the California Consumer Privacy Act / CCPA as amended by CPRA, the Texas Medical Records Privacy Act, or similar state statutes) apply to non-PHI business inquiries, RevoCentra honors individual rights to access, correct, or delete personal commercial data upon verified written request.

10. Contacting Our HIPAA Privacy & Security Officer

If you have questions regarding this Privacy Policy, your practice's Business Associate Agreement, or wish to request data verification, please contact our compliance leadership: