Privacy Policy & Healthcare Compliance Standards

// 1. Business Associate Governance (BAA)

Medavyn RCM operates strictly as a certified Business Associate under the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and the Health Information Technology for Economic and Clinical Health (HITECH) Act. Prior to accessing any client practice management (PM), EHR, or clearinghouse environment, a formal, legally binding Business Associate Agreement (BAA) is executed with the Covered Entity.

// 2. Zero Local PHI Storage Perimeter

Our operational infrastructure strictly enforces a Zero Local Storage Architecture:

• All medical billing, charge entry, and denial adjudications occur directly inside the client's native cloud PM/EHR system (e.g. AthenaHealth, Kareo, Epic, AdvancedMD).
• No Protected Health Information (PHI) or Electronic Protected Health Information (ePHI) is ever downloaded, cached, or stored on local endpoints.
• Removable media devices and physical storage write access are restricted via strict security policies.

// 3. Cryptographic Transmission & Access Security

Every electronic transaction (ASC X12 EDI 837 claim files, 835 remittances, 270/271 eligibility checks) is transmitted over dedicated 256-bit AES encrypted IPsec VPN tunnels and TLS 1.3 cryptographic protocols. Workstations require multi-factor authentication (MFA) and continuous audit trail logging.

// 4. Audit Trail Logging & Breach Notification

In strict compliance with 45 CFR § 164.410, continuous session logging tracks system interactions. Our protocols mandate executive notification to the covered entity within 24 hours of discovery in the event of any security incident.