HIPAA statement

Serenify Health Solutions provides billing, revenue cycle, virtual medical assistant and virtual medical scribe services to healthcare providers. In that role we act as a business associate under the Health Insurance Portability and Accountability Act (HIPAA), and we design our workflows to meet our HIPAA obligations.

HIPAA does not offer an official government certification, so we don’t describe ourselves as “HIPAA certified.” Instead, we sign a business associate agreement with each client and follow documented policies and safeguards for every service we provide.

Business associate agreements

We sign a business associate agreement (BAA) with every client before accessing any protected health information (PHI). The BAA sets out how we may use and disclose PHI and our obligations to safeguard it.

Safeguards

We protect PHI with administrative, physical and technical safeguards that are appropriate to our services, including:

• Minimum necessary access: individual user accounts for every team member, with access limited to the clients and tasks each person works on. Shared logins are not used.
• Working in your systems: wherever possible, PHI stays inside the client’s own EHR, practice management system and clearinghouse rather than being copied to our devices.
• Secure connections: encrypted connections for accessing systems and exchanging information, and multi-factor authentication wherever the system supports it.
• Workforce training: privacy and security training when team members join and regularly afterwards, with confidentiality obligations in writing.
• Device and workspace controls: password-protected, screen-locking work devices and rules against printing, downloading or storing PHI outside approved systems.
• Access reviews: access is removed promptly when a team member leaves or no longer works on an account.
• Subcontractors: any vendor that handles PHI on our behalf signs a business associate agreement first.
• For virtual assistant and scribe services: access only through the client’s own systems or approved secure connections, under the same BAA.

Breach notification

If a breach of unsecured PHI occurs, we will notify affected clients as required by HIPAA and the terms of our BAA.

This website

This website is not a channel for sharing PHI. Please don’t include patient information in our contact or audit forms. Once we work together, we’ll agree a secure method for sharing information.

Privacy officer

Questions about our privacy and security practices, or to report a concern, contact our Privacy Officer at contact@serenifyhealthsolutions.com or +1 512 678 3453. Clients should also use the contact named in their business associate agreement.