What we do with your data, and what we never do.

Who does your work

Our own team. Not an agency.

The people who handle your work are recruited, trained and managed by us directly, and each one signs a written agreement with us before touching your practice. There is no staffing agency in between and nobody taking a cut. You will know every person on your account by name, and you can have any of them taken off it the same day.

Our clinical lead — a practicing physician — trains that team in person and writes the escalation rules herself. When a call turns clinical, the rule for what happens next was written by someone who has actually taken that call.

Before we start, we check your payer and EHR-vendor contracts for any terms that restrict how your data may be accessed and handled. If something in your agreements blocks how we work, we’ll tell you plainly and we won’t take the work.

In place

What binds from the day you sign.

• In placeBusiness Associate Agreement. Signed before we touch a single record. No exceptions, no pilots without one, no "we will paper it later."
• In placeNamed, unique logins. Every coordinator has their own credentials in your systems. No shared accounts, ever — it’s both a HIPAA audit-trail requirement and a term in most EHR vendor contracts.
• In placeMinimum necessary access. Role-based access to only the parts of your system the job requires. If we are running your fax queue we don’t need your billing module.
• In placeAnnual HIPAA workforce training. Before anyone works on your account they complete documented HIPAA training, and we keep the certificate on file for as long as they do. If your compliance officer wants copies, ask and you get them.
• In placeNo clinical advice, ever. We never triage, never advise, never suggest a diagnosis or a billing code. Anything clinical goes back to your team the same minute it reaches us. This is a standing rule, not a preference.
• In placeWe never hold your money. Payments go to you. We invoice separately, and we never net a fee out of anything collected — no percentage of collections, no per-appointment fee.
• In placeDisclosed use of automation. Where software assists our coordinators, we tell you, and we default to disclosing it to patients.

What has to be true before your first day

Every one of these is done before we touch a live record.

These are the things a careful administrator asks for after the handshake and before the go-live, and they are not negotiable on our side either. If any of them isn’t in your hands, we don’t start.

• Before day oneAttorney-reviewed agreements. Your BAA and service agreement are reviewed by healthcare counsel, and you see the final documents before you sign anything. We don’t work off a generic template — a BAA that covers work done outside your building has to carry terms most templates leave out.
• Before day oneSecurity Rule risk analysis. A written risk analysis is completed and shared with you before we touch a live record. Not after, not on request.
• Before day oneCyber liability and errors & omissions cover. Bound before your start date. We name the carrier and the limits, and you get the certificate for your file.
• Before day oneWritten escalation and supervision protocol. The documented chain for what a coordinator does when something falls outside their scope — owned by our clinical lead, and in your hands before your first day.
• Before day oneWritten data-handling and access assessment. A written account of how and where your data is accessed by our team, and by whom. You get it before you sign, not after you ask.

One thing to watch for

Nobody is “HIPAA certified.” Including us.

The US Department of Health and Human Services doesn’t certify anyone as HIPAA compliant, and says so in writing — it doesn’t endorse or recognize private organizations’ certifications, and holding one doesn’t absolve a covered entity of anything.

So if a vendor puts a “HIPAA Certified” badge on their homepage, that badge means a member of their staff paid about thirty dollars for a course. The course is genuinely worth taking — ours do — but it is evidence of training, not a credential. What we say instead is the true version: our staff complete annual HIPAA training and we retain the records.