How we handle protected health information

How we think about healthcare data

When we work on a practice's billing, we may need access to claims, remittance information, patient information, and other data that is considered protected health information.

We treat that access as part of the responsibility that comes with doing the billing work.

• A Business Associate Agreement is put in place before we work with PHI for a practice.
• Access is limited to people working on the account and is used for the work we are authorized to perform.
• We do not use patient PHI to market to the practice's patients.

VeroRCM as a business associate

When Vero provides billing and revenue cycle services for a practice, we generally handle PHI as the practice's business associate.

That information may be needed to:

• review and submit claims
• post and reconcile payments
• investigate denials
• work outstanding A/R
• review potential underpayments
• communicate with payers as part of the billing process
• report back to the practice

The purpose of having access to that information is to do the work the practice hired us to do.

Business Associate Agreements

When our work requires access to PHI, the appropriate Business Associate Agreement is put in place before we begin working with that information.

The BAA sets out how PHI may be used and handled as part of the relationship.

Who can access the information

Access to client accounts and healthcare information is limited based on the work someone needs to perform.

Not every person on the Vero team needs access to every client account.

We try to keep access tied to the people actually servicing the practice.

Technology and PHI

We use technology as part of the billing operation.

It can help identify claims that may need attention, recurring denial patterns, aging accounts, or other areas that deserve review.

Technology assists the billing team.

People remain responsible for reviewing the work and deciding what action should be taken.

Using technology does not change the reason we have access to PHI in the first place: to perform the billing and revenue cycle services authorized by the practice.

If there is a privacy or security issue

If something happens involving PHI that requires us to notify a client practice, we notify the practice as required.

The practice remains the covered entity, and we work with the practice as appropriate when information in our possession is involved.

What patients should do

Patients who want to access their records, request an amendment, or exercise other HIPAA rights should generally contact their physician practice directly.

The practice is the covered entity responsible for the patient's medical record.

If the practice needs information that Vero holds as part of the billing relationship, we assist the practice as appropriate.

What about the Revenue Leak Audit?

Whether a BAA is needed depends on what information we need to review.

If the audit requires access to PHI or a system containing PHI, the appropriate BAA should be in place before that access is provided.

If you are not sure what your audit will require, email team@verorcm.com or use our contact form.

We will walk through what information is needed before you provide access.

The public website is different

The information collected through verorcm.com, such as website analytics and contact form submissions, is covered separately by our Privacy Policy.

Our general website forms are not intended for medical records or other patient PHI unless we have specifically instructed you to provide information through an approved process.