Home / Security & Compliance

How we protect the data we're trusted with

Every engagement puts patient and financial information in our hands. Here's the approach we hold ourselves to — before you ever have to ask.

Confidentiality

Treated as sensitive by default

Patient records and financial data aren't handled any differently than a practice would handle them itself — with the same caution, the same restraint, and no shortcuts.

Purpose-limited use

Data is only ever used to perform the billing, credentialing, or reporting work a practice has contracted us for — nothing beyond that scope.

Minimum necessary access

Team members only see the records they need for the task in front of them — not a practice's full data set by default.

Confidentiality agreements

Everyone who touches practice data signs a confidentiality agreement before an engagement begins, not after.

Secure access to practice data and systems
Access Controls

Access is granted narrowly, and reviewed regularly

Individual, role-based logins

No shared accounts or generic passwords — every action is tied to a specific team member.

Access reviewed, not assumed

Access to a practice's data is revoked promptly when a team member's role changes or an engagement ends.

Secure channels only

Files and records are exchanged through access-controlled channels — never as unprotected email attachments or left in open folders.

HIPAA & Business Associates

A signed BAA, before any PHI changes hands

AZ RCMS operates as a Business Associate under HIPAA for every healthcare practice it serves — not an informal vendor working around the edges of it.

Business Associate Agreement

Before any protected health information is exchanged, a BAA is put in place that spells out how it may be used, how it's safeguarded, and how it's returned or destroyed once an engagement ends.

Retention with an end date

Data is kept only as long as the engagement and applicable recordkeeping requirements call for — then securely disposed of, not indefinitely archived.

If something goes wrong

Any suspected security incident is investigated immediately, and the affected practice is notified without delay — consistent with HIPAA's breach notification expectations.

One point of accountability

Security and compliance questions go directly to the founder — not a support queue that loses context between replies.

Want to review a BAA before signing on?

Send us a message and we'll walk through our data handling process in detail.

Contact AZ RCMS