HIPAA and security
HIPAA-compliant medical billing starts with a signed business associate agreement and ends with you being able to see, in your own systems, exactly who has access.
In between: role-based users with MFA, work done inside your software rather than ours, trained staff, and a plain process for when something goes wrong. This page says what we do, without badges we do not hold.
Last reviewed by the Remitwright billing team. Editorial policy
Patient data stays in your systems. Your biller works inside your own software, clearinghouse and payer portals and never exports, downloads or stores claim files, remittances or patient lists on Remitwright devices or systems.
Before any access
A business associate agreement is signed before anyone at Remitwright sees a claim, a schedule or a remittance. If your practice has its own BAA, we review and sign that. The agreement sets out what we may do with protected health information, how it is safeguarded, how incidents are reported, and what happens when the engagement ends.
Both links open an email to sales@remitwright.com with the subject filled in.
Access
Inside your systems. Claims are worked, posted and followed up where the data already lives, and every action is logged under your biller's own user.
Claim files, remittances and patient lists are never exported, downloaded or stored on Remitwright devices or systems.
Everyone who works on client accounts completes HIPAA privacy and security training when they join and again every year, and is bound by a confidentiality agreement. Credentials are stated only as each person holds them, and you meet the people on your account by name before go-live. The roles on every account are described on the team page.
If we become aware of a security incident or an unauthorized use or disclosure involving your data, we tell you without undue delay and within the time the BAA specifies, with what we know, what we have done, and what we recommend. We then investigate, document the cause and the fix, and share the written outcome with you. Decisions about patient and regulator notification are yours, made with the facts in front of you.
Questions
Yes, before any access to any system that holds patient information. We send the BAA first; if you have your own, we review it. No one looks at a claim until it is signed.
Where it already is: in your practice management system, EHR and clearinghouse. Your biller works inside those systems as a user you created. We do not take exports of claim data into systems of our own.
The named people on your account: your biller, the cover biller, the coding reviewer and the account lead, each with their own login and only the role the work needs. You can see the list of users in your own system and remove any of them at any time. How remote billing works shows where the work happens and how access is granted and removed.
Our users are removed from your systems on the date you set, and we confirm in writing that it is done. Nothing is left to return or destroy, because no patient data is stored on Remitwright devices or systems: any notes your biller keeps live in your own systems.
Yes. Use the request link in the BAA section above and we send the template as a document, with nothing else attached. If your practice already has its own BAA, send that instead and we review it.
Use the report link in the BAA section above. Say what you saw and when, and leave patient information out of the message. We acknowledge the report in writing and follow the incident process described on this page.
