01
Access and confidentiality
Access should be limited to authorized personnel and the systems required for assigned work. Client-specific requirements and responsibilities are documented during implementation.
Protecting sensitive information
Security and HIPAA-Aware Operations
Revenue-cycle work can involve sensitive patient and practice information. Apex approaches access and communications with confidentiality, minimum-necessary principles, and defined accountability.
02
Operational safeguards
Security measures are applied according to the systems and engagement in use.
- Role-based and minimum-necessary access
- Secure account access and MFA where available
- Confidentiality expectations and workforce training
- Access termination when responsibilities end
- Secure communication methods
- Incident identification and escalation
03
Business associate agreements
Where required and appropriate to the engagement, contractual privacy and security responsibilities should be addressed through a business associate agreement reviewed by the parties.
04
Claims and certifications
Apex does not represent its operations as HIPAA certified, SOC 2 certified, HITRUST certified, or ISO certified. Specific security controls and contractual requirements are discussed and documented as appropriate to each engagement.
PT expertise. Revenue cycle results.