Compliance & HIPAA Practices

Compliance & HIPAA Practices

At MedexCore, protecting healthcare information is an essential part of how we provide medical billing and revenue cycle management services.

Our compliance practices are designed around the requirements of the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”), the HITECH Act, applicable federal and state privacy requirements, and the contractual obligations we accept when handling information on behalf of healthcare providers.

This page explains the principles and practices we follow when Protected Health Information (“PHI”) is involved.

Our Role Under HIPAA

Medical billing and revenue cycle services require access to patient information on behalf of physicians, medical practices, clinics, and other healthcare organizations.

When MedexCore creates, receives, maintains, or transmits PHI on behalf of a HIPAA Covered Entity in performing those services, MedexCore may act as a Business Associate under HIPAA.

In that role, we are required to protect PHI and use or disclose it only as permitted by applicable law, our Business Associate Agreement, and the services we have been authorized to perform.

Business Associate Agreements

Where required by HIPAA, MedexCore enters into a written Business Associate Agreement (“BAA”) with healthcare provider clients before handling PHI on their behalf.

Our BAAs are intended to establish requirements concerning:

• permitted uses and disclosures of PHI;
• appropriate safeguards for PHI;
• reporting of unauthorized uses, disclosures, or breaches;
• assistance with applicable patient privacy rights;
• requirements for subcontractors that handle PHI;
• return or destruction of PHI where required and feasible; and
• other responsibilities required under HIPAA.

The BAA works together with the applicable services agreement and does not replace the healthcare provider's own HIPAA responsibilities.

How We Handle PHI

We may need access to PHI to perform authorized services such as:

• medical billing and claim submission;
• medical coding;
• denial management and appeals support;
• accounts receivable follow-up;
• payment posting;
• eligibility verification;
• prior authorization support;
• provider credentialing; and
• revenue cycle reporting.

We seek to access, use, and disclose only the information reasonably necessary to perform the authorized task, consistent with applicable HIPAA requirements and contractual obligations.

PHI is not used for unrelated advertising or sold for independent commercial purposes.

Administrative Safeguards

Our compliance framework is designed to include administrative measures appropriate to the nature of the information we handle.

These may include:

• written privacy and security policies;
• defined responsibilities for privacy and security;
• workforce access procedures;
• HIPAA and security awareness training;
• risk identification and management processes;
• incident response procedures;
• access review and termination procedures; and
• periodic review of policies and safeguards.

Access to PHI should be limited to workforce members who require it for legitimate job responsibilities.

Technical Safeguards

MedexCore's security practices are designed to protect electronic Protected Health Information (“ePHI”) against unauthorized access, alteration, disclosure, or loss.

Depending on the system and service involved, safeguards may include:

• authentication and access controls;
• role-appropriate permissions;
• secure methods for transmitting sensitive information;
• system activity monitoring and audit capabilities;
• measures designed to protect data integrity;
• secure credentials and password practices;
• session and device security controls; and
• other security measures appropriate to identified risks.

Physical Safeguards

Physical safeguards are also part of protecting healthcare information.

Our practices are designed to reduce unauthorized physical access to devices, systems, workspaces, and media that may contain or provide access to ePHI.

Workforce members with access to PHI are expected to follow appropriate workstation, device, workspace, and information-handling requirements.

PHI should not be stored, printed, copied, transported, or disposed of through unauthorized methods.

Workforce Training and Confidentiality

Employees, contractors, and other authorized workforce members who may access PHI are expected to understand their privacy and security responsibilities.

Appropriate personnel may receive training concerning topics such as:

• HIPAA privacy requirements;
• appropriate handling of PHI;
• secure communications;
• password and account security;
• phishing and cybersecurity awareness;
• incident reporting;
• minimum necessary access; and
• confidentiality obligations.

Unauthorized access, use, or disclosure of PHI may result in corrective or disciplinary action, as appropriate.

Vendors and Subcontractors

Healthcare information can sometimes be processed through vendors or subcontractors that support the services MedexCore provides.

When a subcontractor creates, receives, maintains, or transmits PHI on MedexCore's behalf and HIPAA requires a BAA, MedexCore requires appropriate contractual protections before permitting that PHI processing.

Subcontractors with access to PHI are expected to protect the information in accordance with applicable HIPAA requirements and their contractual obligations.

Security Incidents and Breach Response

MedexCore takes suspected privacy and security incidents seriously.

Our compliance processes are designed to support the identification, investigation, containment, mitigation, documentation, and appropriate response to incidents involving PHI.

If a breach of unsecured PHI occurs while we are acting as a Business Associate, we will provide notice to the affected Covered Entity as required by HIPAA and the applicable BAA.

We also cooperate with clients on legally required investigation, mitigation, documentation, and notification activities.

Data Retention and Disposal

PHI is retained only as required for authorized services, contractual obligations, legal requirements, or other permitted purposes.

When PHI is no longer required, it may be returned, securely destroyed, deleted, or otherwise handled according to the applicable BAA, service agreement, retention requirements, and applicable law.

Where PHI cannot reasonably be returned or destroyed, applicable protections continue for as long as the information is retained.

Sensitive Healthcare Information

Certain healthcare information may be subject to additional confidentiality requirements beyond ordinary HIPAA protections.

Where applicable to the information MedexCore processes, we seek to comply with additional federal or state requirements governing specially protected information, including requirements that may apply to substance use disorder records under 42 CFR Part 2 and other specially protected categories of health information.

The exact requirements depend on the information involved, the client, the applicable service, and the governing law.

Our Clients' Responsibilities

HIPAA compliance is a shared responsibility.

Healthcare provider clients remain responsible for their own legal and regulatory obligations, including the accuracy and completeness of clinical documentation, lawful collection of patient information, workforce compliance, patient-facing privacy notices, appropriate system access, and other responsibilities applicable to the Covered Entity.

MedexCore's compliance practices do not replace a client's own HIPAA compliance program.

Clients should also promptly notify MedexCore of suspected unauthorized access, disclosure, security incidents, or other privacy concerns involving systems or information connected to MedexCore's services.

No HIPAA Certification Claim

HIPAA does not provide a general government-issued certification that permanently establishes an organization's compliance.

MedexCore therefore treats HIPAA compliance as an ongoing operational responsibility rather than a one-time certificate.

Our goal is to maintain policies, safeguards, agreements, training, and processes appropriate to our responsibilities as a medical billing and revenue cycle management company.

Questions About Compliance

Healthcare organizations considering MedexCore may contact us regarding HIPAA, Business Associate Agreements, privacy practices, or security requirements relevant to the proposed services.

For patient-specific privacy requests, patients should generally contact the healthcare provider or organization responsible for their records. When MedexCore acts as that provider's Business Associate, we will assist the provider as required by the applicable BAA and law.

PRIMACY MEDEX INC. d/b/a MedexCore
5900 Balcones Drive, Suite 100
Austin, TX 78731
United States

Email: info@medexcore.com

Phone: (917) 924-9022

Website: https://medexcore.com/