Two-step verification
Required on every account I use for the company, starting with Microsoft 365.
HIPAA
How I protect your clients' information
In the analysis, Cleared RCM is a Business Associate of your agency, as HIPAA defines it. That is why we sign the HIPAA agreement (BAA) before you share a single file with me, and why I work only with what you export, without logging into your system.
- HIPAA agreement (BAA)
- Before any data is shared
- Together with a one-page letter that says what the analysis includes.
- Access to your system
- None
- You export the reports. I do not ask for a username or password.
- How files travel
- Your private folder
- In Microsoft 365. Never by email or WhatsApp.
- Encryption
- In transit and at rest
- TLS 1.2 or higher in transit. BitLocker disk encryption and Microsoft 365 encryption at rest.
- Two-step verification
- Required
- On every company account.
- When we finish
- I delete every copy
- After two weeks for you to download everything, and I confirm it in writing.
The agreement
What a Business Associate is
HIPAA calls your agency a covered entity, and anyone who works with your clients' health information on your behalf, as I do in the analysis, a business associate.
The agreement we sign (BAA) says what I may use that information for, how I protect it, what happens if something goes wrong and what happens at the end. We sign it together with the scope letter, from your phone or computer, and until then I do not receive any data.
Your files
The path of your files, from start to finish
-
1
We sign
The BAA and the scope letter. Before that, no files.
-
2
Your private folder
A Microsoft 365 site only for your agency, shared only with the people you name, each with their own invitation confirmed by a code sent to their email. You upload your files to one folder and find the report in another. I do not use links that anyone can open.
-
3
The video call
We pull the reports together on Microsoft Teams. The call is not recorded, because client names may appear on your screen.
-
4
My working copy
I download your files to an encrypted computer, into a folder that is not synchronized or backed up. To build the report I keep only what the analysis uses: no names, contact details, dates of birth or member numbers, and each client becomes a number. The sheet that says who each number is stays in your folder.
-
5
When we finish
Your files, your report and the sheet stay in your folder for two weeks so you can download them. Then I delete everything, the site included, always within the sixty days the BAA sets, and send you written confirmation. If you ask me in writing, I delete it sooner.
Safeguards
What is in place from day one
Encryption
TLS 1.2 or higher when information travels. BitLocker full-disk encryption on the computer and Microsoft 365 encryption on its servers. The screen locks after five minutes.
Access log
Microsoft 365 logs who opens your folder, and I note each time I work with your copy. I export that log at the results meeting and at the end, and keep it six years, as the BAA says. If you ask, I give it to you.
No artificial intelligence with your data
Your files, the database I build the report from and the report itself are never opened in or pasted into an AI assistant, or any service without a BAA.
Only me
I work alone, with no subcontractors. If someone else ever joins, they will sign a BAA and complete HIPAA training before seeing any data.
Written policies and training
A written information security program (WISP) and an incident response plan, signed on October 19, 2026. That day I completed the HIPAA training of the Department of Health and Human Services (HHS), and I repeat it every year.
If something goes wrong
What I do and when I tell you
I hope it never happens. If it does, this is the plan, and it is in writing.
In the first 24 hours
I contain the problem
I shut down access and preserve the evidence, and I aim to send you a first email within that time.
Within 10 days at most
I notify you in writing
With what is known and what is not known yet. This is the formal notice the BAA requires.
At 30 days
Final report
What happened, why, who it affected and what I changed so it does not happen again.
As the covered entity, your agency is the one that notifies families and authorities when the law requires it. I help you with whatever you need to do it on time.
For families
If you are a family member of a client of an agency I work with
Your agency is the covered entity and keeps your records. To see or correct your information, or to ask for a list of who it has been shared with, contact your agency. I do not communicate with families; if your agency asks me in writing, I help it respond to you.
Questions
What owners usually ask me about HIPAA
What information do you receive?
Only the two reports you export: claims (with what was paid) and authorizations. They include, for example, the client, the insurer, dates of service, codes, what was billed, what was paid and the status of each claim. I do not need clinical notes or treatment plans.
Do you need to log into our system?
No. On the video call you share your screen and I tell you what to choose. I do not ask for a username or password.
Whose BAA do we sign?
I have one prepared for this analysis. I send it to you before we start so you can read it calmly, and you sign it from your phone or computer.
Do you use artificial intelligence with our data?
No. Your files and your report never go through an AI assistant or any service without a BAA.
What happens to our data at the end?
It stays in your private folder for two weeks so you can download it. Then I delete every copy I have and the site, within the sixty days the BAA sets, and send you written confirmation.
Want to read the BAA before we start?
Write to me and I will send it, together with the scope letter. I reply myself within one business day.