HIPAA Privacy Statement

01Our commitment

HealthRescue Partners LLC (“HealthRescue Partners,” “we,” “us”) provides medical billing, insurance credentialing, virtual staff, patient marketing, website and practice startup services to independent healthcare practices. Some of this work requires access to patients’ protected health information (PHI).

We take that responsibility seriously. This statement explains how we handle PHI, the safeguards we maintain, and what practices and patients can expect from us under the Health Insurance Portability and Accountability Act of 1996 (HIPAA), the HITECH Act and their implementing regulations.

02Our role under HIPAA

The practices we work with are covered entities under HIPAA. When we create, receive, maintain or transmit PHI on a practice’s behalf, we act as that practice’s business associate.

• Before we access any PHI, we sign a Business Associate Agreement (BAA) with the practice.
• The BAA defines what we may do with PHI, and we follow it along with the HIPAA Privacy, Security and Breach Notification Rules that apply to business associates.
• The practice remains responsible for its own Notice of Privacy Practices and its relationship with its patients.

03Information we handle

Depending on the services a practice uses, we may handle:

• Patient names, contact details, dates of birth and other demographic information
• Insurance details, eligibility results, claims, remittances and payment records
• Diagnosis and procedure codes and the clinical documentation needed for coding, claims and prior authorizations
• Appointment, intake and call information collected by our virtual staff

Credentialing work mainly involves information about providers, not patients. We protect that information with the same care.

04How we use and disclose PHI

We use and disclose PHI only to perform services for the practice, as permitted by our BAA and by HIPAA, for example to:

• Verify eligibility, submit claims, post payments and follow up on denials and balances
• Request and track prior authorizations with payers
• Schedule appointments, return calls and collect intake information
• Meet our own legal obligations, or when required by law

We do not:

• Sell PHI or receive payment in exchange for it
• Use a practice’s patient information to market our own services
• Use or disclose PHI in any way the practice itself would not be permitted to under HIPAA

05Minimum necessary

We limit the PHI we request, use and disclose to the minimum necessary to complete each task. Access is assigned by role, so a team member working on scheduling, for example, does not need access to full claim histories.

06How we safeguard PHI

We maintain administrative, physical and technical safeguards designed to protect the confidentiality, integrity and availability of electronic PHI, as the HIPAA Security Rule requires.

Where possible, we work inside the practice’s own EHR, practice management and billing systems rather than copying PHI into separate systems.

07Our workforce and virtual staff

• Everyone who may access PHI, including remote virtual staff, signs a confidentiality agreement and completes HIPAA training before getting access.
• Remote team members must follow our rules for secure devices, private workspaces and approved communication tools.
• Violations of our privacy and security policies lead to disciplinary action, up to and including termination.

08Subcontractors and vendors

If a subcontractor or vendor needs to create, receive, maintain or transmit PHI to help us deliver our services, we first obtain written assurances, through a business associate agreement, that it will protect the information under the same restrictions and conditions that apply to us.

09Incidents and breach notification

We investigate suspected security incidents promptly and take steps to contain and reduce any harm.

If we discover a breach of unsecured PHI, we notify the affected practice without unreasonable delay, and no later than 60 calendar days after discovery or any shorter period set in our BAA. We give the practice the information it needs to meet its own notification obligations to patients and regulators.

10Patient rights and requests

Under HIPAA, patients have rights to access and get copies of their health information, request corrections, ask for restrictions and receive an accounting of certain disclosures. These rights are exercised through the patient’s healthcare provider.

11Retention, return and destruction

We keep PHI only as long as needed to provide our services or as our BAA or the law requires. When our relationship with a practice ends, we return or securely destroy the PHI we hold for that practice where feasible. If return or destruction is not feasible, we continue to protect that information and limit its further use.

12Our website and communications

Information you submit through this website, such as a consultation request, is covered by our Privacy Policy, not by this statement.

13Changes to this statement

We may update this statement as our practices or the law change. The updated version will be posted on this page with a new effective date. Changes do not reduce the protections in any BAA we have signed.

14Contact our Privacy Officer

Questions about this statement, or concerns about how we handle PHI, can be sent to our Privacy Officer:

HealthRescue Partners LLC, Attn: Privacy Officer
2201 Menaul Blvd NE, Albuquerque, NM 87107

Patients who believe their privacy rights have been violated may also file a complaint with the U.S. Department of Health and Human Services, Office for Civil Rights, at hhs.gov/ocr/complaints. No one will be retaliated against for filing a complaint.