HIPAA compliance
HIPAA Notice and PHI Handling
When your practice outsources billing, you trust us with your patients' protected health information (PHI). This page explains how we handle it: what we use, how we protect it, and what happens if something goes wrong.
This notice is a summary. The Business Associate Agreement (BAA) we sign with each practice is the controlling document.
Last updated:
BAA first.
We sign a Business Associate Agreement before we receive any PHI.
Minimum necessary.
We use only the PHI each service requires.
No PHI by web form or email.
We never request or accept PHI through website forms or unencrypted email.
Written confirmation at exit.
When an engagement ends, we return or destroy your PHI and confirm it in writing.
Contracting entity
and HIPAA statement
Practice Revenue Management, Inc., which owns and operates the Nevada Med Billing brand, acts as a business associate under the Health Insurance Portability and Accountability Act (HIPAA) when it performs billing and revenue cycle services for a covered entity.
We maintain administrative, technical, and physical safeguards designed to meet our obligations under the HIPAA Privacy, Security, and Breach Notification Rules. Our HIPAA responsibilities are governed by applicable law and by the BAA executed with each practice.
All Business Associate Agreements are entered into exclusively by Practice Revenue Management, Inc. We don't describe ourselves as "HIPAA certified," because no official HIPAA certification exists.
Business Associate Agreement
We sign a written BAA with every client practice before any PHI is transmitted, accessed, or processed. The BAA sets out:
- 01
Permitted uses and disclosures of PHI.
- 02
The safeguards we maintain.
- 03
Flow-down obligations for any subcontractor.
- 04
Breach notification timelines.
- 05
Return or destruction of PHI when the engagement ends.
Your practice can use our standard BAA, or we'll review yours.
How we use
PHI
We use PHI only to perform the services your practice contracts us for, and only as the BAA and the Privacy Rule permit. Those services include:
Claim submission, denial management, and appeals
Eligibility verification and prior authorization
Payment posting and patient accounts receivable
Credentialing and payer enrollment
Practice reporting
We don't sell PHI, and we don't use PHI for marketing.
Minimum necessary
We request and use only the minimum PHI needed to perform each service. Our free billing audits use de-identified data or limited data sets wherever a full data set isn't required.
Our safeguards
Technical safeguards
- PHI is encrypted in transit using TLS and encrypted at rest.
- Every user has unique credentials, and administrative access requires multi-factor authentication.
- Access to systems containing PHI is logged, and logs are retained and reviewed.
- We exchange files only through secure, encrypted channels or directly inside your EHR or practice management system.
Administrative safeguards
- We perform a HIPAA security risk analysis and track remediation of what it finds.
- Access is role-based, granted on a least-privilege, need-to-know basis.
- Workforce members complete HIPAA privacy and security training at hire and every year, and sign confidentiality agreements.
- Access is revoked promptly when someone changes roles or leaves.
Physical safeguards
- Work devices are managed and encrypted.
- PHI is never stored on personal devices.
- Paper documents containing PHI are kept secured and shredded when no longer needed.
Substance use
disorder records
We bill for substance use disorder (SUD) programs, including IOP, PHP, residential, detox, and MAT. Records from federally assisted SUD programs carry confidentiality protections under 42 CFR Part 2, in addition to HIPAA.
We handle these records under the terms of the BAA and any additional Part 2 agreement the program requires. Staff working on SUD accounts are trained on these requirements.
Subcontractors and subprocessors
Any subcontractor that may create, receive, maintain, or transmit PHI for us is bound by a written agreement. That agreement imposes restrictions and conditions at least as protective as those in our BAA with your practice.
Clients can request a current list of our subprocessors.
Incident and breach
notification
We maintain an incident response process that covers detection, containment, investigation, and notification.
Detection
Containment
Investigation
Notification
If we discover a breach of unsecured PHI, we notify the affected covered entity without unreasonable delay. We give notice within the timeframe in the BAA, and never later than the 60 days after discovery that HIPAA allows. Our notice includes the information your practice needs to meet its own notification obligations.
Nevada privacy requirements
In addition to HIPAA, we follow Nevada's requirements for securing personal information (NRS Chapter 603A) where they apply.
Retention,
return, and destruction
We keep PHI only as long as needed to perform services and meet legal retention obligations.
When an engagement ends, we return PHI to the practice or securely destroy it in accordance with the BAA, and confirm in writing.
Certifications and evidence
We publish only compliance claims we can back with evidence. As part of vendor due diligence, practices can request the following under NDA:
- Our security overview
- Workforce training attestation
- Our current subprocessor list
- A summary of our current risk assessment
- A copy of our standard BAA
If
you are a patient
Nevada Med Billing works on behalf of healthcare providers. If you have a question about your medical records, your provider's Notice of Privacy Practices, or your rights under HIPAA, contact your provider's office first.
For questions about a bill we sent on your provider's behalf, call (631) 652-3106. Please don't send health information through our website.
Contact
Privacy and security questions, including requests from a practice's compliance officer, can be directed to us:
(631) 652-3106info@nevadamedbilling.com
Don’t include PHI.
Nevada Med Billing, 2300 W Sahara Ave, Suite 800, Las Vegas, NV 89102
Contact our team →Evaluating a billing partner?
Ask for our security packet, or start with a free billing audit. We sign the BAA before we see any data.
HIPAA questions,
answered
Can't find what you need? Our Nevada team answers every question before you commit.
Either works. We can provide our standard BAA, or our team will review yours before work begins.
No company is. HIPAA has no official certification. We maintain the safeguards the HIPAA rules require and can share evidence of them under NDA.
Only staff assigned to your account, with the minimum access their role needs. All access is logged.
We work inside your EHR or practice management system, or exchange files through encrypted channels. We never use website forms or unencrypted email for PHI.
We follow 42 CFR Part 2 requirements in addition to HIPAA. Staff on SUD accounts are trained on them.
We return or securely destroy it according to the BAA, and confirm in writing.
Without unreasonable delay, within the timeframe set in our BAA, and never later than HIPAA's 60-day limit.