HIPAA Notice & Compliance Statement

1. Our role: Business Associate

The Health Insurance Portability and Accountability Act (HIPAA) and the HITECH Act govern how protected health information (PHI) is used and protected. AxioRCM LLC provides billing, coding, credentialing, and related revenue cycle services to healthcare providers. In doing so, AxioRCM acts as a Business Associate — not a Covered Entity — and processes PHI only on behalf of, and at the direction of, its provider clients.

2. Business Associate Agreements & Legal Liability

Before AxioRCM accesses or processes any PHI, we execute a legally binding Business Associate Agreement (BAA) with the healthcare provider. The BAA defines the permitted uses and disclosures of PHI, our safeguarding obligations, breach notification duties, and the return or destruction of PHI. Crucially, our standard BAA includes robust indemnification terms: AxioRCM formally assumes full legal HIPAA liability and responsibility for the safeguarding of PHI under our care. To further protect our provider clients, AxioRCM maintains comprehensive Cyber Liability Insurance to financially insulate your practice against third-party risks.

3. Zero-Download Standard & Offshore Data Protection

We recognize that healthcare providers have acute data security, cross-border privacy, and audit concerns. To completely eliminate that risk:

• Zero Offshore Transfer or Storage: We never transfer, download, or store your patient data in offshore jurisdictions or on local computer hard drives.
• Remote Cloud Execution: All billing, coding, and claims adjudication work is performed strictly via remote execution directly inside your existing, authorized U.S.-based servers or HIPAA-compliant cloud EHR systems.
• Zero Local Persistence: No PHI is ever cached, exported, or saved to local workstation drives. In any exceptional analytical workflow where temporary data handling is contractually authorized, all files remain encrypted end-to-end and are immediately purged upon task completion.

4. Practice-Controlled Access & Native Audit Trails

You retain 100% control over system access and data integrity at all times:

• Individual Credentials: AxioRCM specialists work solely under individual, role-based user accounts that your practice provisions, oversees, and can revoke or restrict at any second.
• Immutable Native Software Audit Trail: Every single claim entered, code assigned, payment posted, and adjustment made is logged directly in your EHR/PM software's native, timestamped audit log. Every action is traceable to the specific operator, preserving pristine defense records for commercial payer inquiries or CMS Recovery Audit Contractor (RAC) audits.
• Network Whitelisting: Access is restricted through dedicated, static IP addresses and encrypted VPN tunnels with Multi-Factor Authentication (MFA) strictly enforced.

5. Physical 'Clean Floor' Security Architecture

AxioRCM enforces an uncompromising physical security protocol across all operational facilities:

• Strict 'Clean Floor' Policy: No personal mobile smartphones, USB flash drives, removable storage media, external cameras, recording devices, or paper are permitted on the operational floor.
• Biometric Access Control: Entry to operational rooms requires multi-stage biometric and card-key authentication, monitored 24/7 by continuous closed-circuit surveillance.

6. Administrative, physical, and technical safeguards

AxioRCM maintains safeguards consistent with the HIPAA Security Rule and SOC 2 Type II principles:

• Administrative — written information security policies, annual third-party risk assessments, designated HIPAA Privacy and Security Officers, and formal incident response protocols.
• Physical — controlled facility perimeters, visitor logging, clean-desk and clean-floor enforcement, and strict hardware disposal standards.
• Technical — AES-256 encryption of PHI at rest, TLS 1.3 encryption in transit, least-privilege role-based access controls, automatic session timeouts, and continuous intrusion monitoring.

7. Software Authenticity & Vendor Integrity

AxioRCM operates exclusively inside your practice's official, vendor-supported EHR, clearinghouse, and billing software platforms (such as Epic, athenahealth, eClinicalWorks, Kareo, NextGen, and AdvancedMD). AxioRCM strictly prohibits the use of cracked software, pirated tools, unauthorized third-party scrapers, or shadow IT applications.

8. Permitted uses and disclosures

AxioRCM uses and discloses PHI only as permitted by the applicable BAA and by federal law — primarily to perform billing, coding, claim submission, denial management, prior authorization, and credentialing on the provider's behalf. AxioRCM does not sell PHI and does not use PHI for marketing.

9. Workforce training and access

All AxioRCM workforce members undergo background checks, sign legally binding individual Non-Disclosure Agreements (NDAs), and complete certified HIPAA privacy and security training upon hire and annually thereafter. Access to PHI is granted strictly on a least-privilege, need-to-know basis and is reviewed continually.

10. Subcontractors

Where AxioRCM engages any subcontractor that may have access to PHI, that subcontractor is legally required to execute a Business Associate Subcontractor Agreement imposing safeguards at least as stringent as those in our primary Business Associate Agreements.

11. Breach notification

If AxioRCM discovers any confirmed or suspected breach of unsecured PHI, we will notify the affected Covered Entity without unreasonable delay and well within the timeframes mandated by the HIPAA Breach Notification Rule and the applicable BAA, cooperating fully in notification and remediation.

12. Patient rights

Patients have rights regarding their health information — including the rights to inspect, amend, and receive an accounting of disclosures. Because AxioRCM acts as a Business Associate, these rights are exercised through the healthcare provider client. AxioRCM promptly assists providers in fulfilling patient rights requests as stipulated by the BAA.

13. Reporting a concern

To report a privacy or security concern, request our SOC 2 Type II documentation or standard BAA, or reach the AxioRCM Privacy Officer, contact AxioRCM LLC, Sheridan, WY 82801, by email at [email protected], or by phone at +1 (307) 430-1809. AxioRCM strictly prohibits retaliation against anyone reporting a concern in good faith.