Legal
HIPAA and data security
Cure MB acts as a business associate to the healthcare practices we serve. This page summarizes how we protect the patient information entrusted to us.
Draft for legal review: replace every highlighted [bracketed] item and have a qualified attorney review this page before it is published. This note is hidden automatically on a production site.
1Our role as a business associate
Cure MB provides billing and revenue-cycle services to healthcare practices. When we handle patient information for a practice, we act as its business associate under HIPAA. The practice remains the covered entity and responsible for its patients’ information.
In short
We sign a Business Associate Agreement before we touch any protected health information (PHI), and we handle that information only to provide the services you’ve engaged us for.
2Business Associate Agreements
We sign a Business Associate Agreement (BAA) with every client before accessing any protected health information (PHI), as HIPAA requires. The BAA sets out how we may use and disclose PHI, the safeguards we must have and what happens if something goes wrong. We can sign your practice’s BAA or provide ours for review.
3Minimum necessary access
Our team accesses only the systems and information needed to perform the services you’ve engaged us for, and access is removed when it’s no longer needed.
4How we safeguard information
We aim to keep PHI inside the systems you already use. Our approach includes:
- Working inside your EHR, clearinghouse and payer portals rather than keeping copies on personal devices
- [Confirm: unique user accounts and multi-factor authentication]
- [Confirm: workforce HIPAA training on hire and annually]
- [Confirm: encrypted devices and secure file transfer]
- [Confirm: documented security risk assessment]
What we don’t claim
We don’t claim any third-party security certification on this page. If and when we hold one, we’ll state it here.
5Website forms and PHI
Website forms are not for PHI
Our website forms are for contact information only. Please don’t submit patient names or health information through the website. Once you’re a client, we’ll provide a secure way to share information.
See our Privacy Policy for how we handle the personal information of website visitors.
6Breach notification
If we discover a breach of unsecured PHI, we will notify the affected client without unreasonable delay and as required by HIPAA and our BAA.
7Questions
For security or privacy questions, contact support@curemb.com. [Add the name or title of your privacy/security officer]
Contact
Questions about data security?
Email or call and we’ll answer your questions about BAAs, access controls and how we protect your patients’ information.
- Call(817) 396-6663
- Emailsupport@curemb.com
- MailCure MB Medical Billing Service, [mailing address]
Ready to see where your revenue is leaking?
Our free consultation is a quick review of your A/R, denials and payer mix. We sign a BAA before we request any data.
No patient information, please. We reply within one business day.