HIPAA & Data Security
HIPAA & Data Security
How Vantix Med protects the patient and practice information you trust us with.
Compliance is a practice, not a label
As a medical billing and credentialing company, Vantix Med works with protected health information (PHI) every day. Under HIPAA, that makes us a Business Associate of the healthcare providers we serve, with legal duties to protect that information.
Putting “HIPAA compliant” on a website does not make a company compliant. Compliance comes from written policies, signed agreements, technical safeguards, trained staff and a plan for when something goes wrong. This page explains how we approach each of these.
At a glance
- Business Associate Agreement signed with every client
- PHI shared only through encrypted, access-controlled systems
- Minimum necessary access for every team member
- Security training for all staff who handle PHI
- Documented incident response and breach notification process
How we protect patient information
The safeguards behind our billing and credentialing services.
HIPAA policies
We maintain written privacy and security policies based on the HIPAA Privacy, Security and Breach Notification Rules. We review them regularly and update them when regulations, systems or risks change, and we perform periodic security risk assessments.
Business Associate Agreements
We sign a Business Associate Agreement (BAA) with every practice before we access any PHI. The BAA defines how we may use and disclose PHI, the safeguards we must maintain and our breach notification duties. Vendors we use to handle PHI must also sign a BAA with us.
Secure file transfer
We never ask practices to send PHI through regular email, text messages or our website forms. Documents such as EOBs, patient records and credentialing files are exchanged through encrypted, access-controlled file-sharing systems or directly inside your EHR or practice management system.
Encryption
PHI is encrypted in transit using secure connections (TLS) and stored only on encrypted systems. Company devices used to access client systems use full-disk encryption, so information stays protected if a device is lost or stolen.
Access controls
Every team member uses a unique login, strong passwords and multi-factor authentication where supported. Shared accounts are not used, and access is removed promptly when someone leaves the team or no longer needs it.
Role-based access
We follow HIPAA’s minimum necessary standard. Billing specialists, coders and credentialing coordinators can access only the systems and records their role requires, and access for each client account is limited to the team assigned to it.
Audit logging
We work inside systems that record who accessed which records and when. These logs help us and our clients review activity, investigate unusual access and show accountability during audits.
Secure EHR/PM access
Whenever possible, we work directly inside your EHR or practice management system using user accounts you create and control. This keeps PHI in your system and lets you see, limit or remove our access at any time.
Employee security training
All team members receive HIPAA and security training before handling PHI and on an ongoing basis. Training covers privacy rules, phishing, password security, safe handling of documents and how to report a possible incident.
Data retention
We keep PHI only as long as needed to provide our services or as our BAA requires. When a client relationship ends, we return or securely destroy PHI as the BAA specifies. HIPAA-required documentation, such as policies, is kept for at least six years.
Incident response
We have a documented process for identifying, containing, investigating and documenting security incidents. If a breach of unsecured PHI occurs, we notify the affected practice without unreasonable delay and within the timeframe HIPAA requires, so the practice can meet its own notification duties.
Backup and security procedures
We rely on secure, backed-up systems for client work, keep software and devices updated with security patches, and use endpoint protection on company devices. These procedures are reviewed as part of our risk assessments.
What our website does and does not collect
Healthcare websites that collect or transmit PHI need careful attention to forms, hosting, third-party services, access controls and BAAs. To keep patient information safe, our public website is not used to collect PHI.
- Our contact form is for business inquiries only, such as your name, practice name, email and phone number
- Please do not include patient names, dates of birth, diagnoses, insurance IDs or other PHI in website forms or regular email
- Once you become a client, PHI is exchanged only through the secure methods described above
- Website analytics and cookies are used only to understand site traffic, not to collect health information
A shared responsibility
HIPAA compliance is shared between a practice and its business associates. We protect the PHI we access, and we work with you to keep the whole process secure.
- You control the user accounts we use in your EHR and PM systems
- We follow your practice’s policies in addition to our own
- We share security information and answer security questionnaires on request
- We tell you promptly about any issue that affects your data
Frequently asked questions
Common questions about how we handle patient data.
Will you sign a Business Associate Agreement?
Yes. We sign a BAA with every practice before accessing any PHI. We can sign your practice’s BAA or provide our own for your review.
How should we send patient documents to you?
Through the secure file-sharing method we set up during onboarding, or by giving us access inside your EHR or practice management system. Please do not send PHI through regular email, text messages or our website contact form.
Who on your team can see our patients’ information?
Only the team members assigned to your account, and only the information their role requires. Each person uses their own login, so access can be tracked and removed at any time.
What happens to our data if we stop working together?
At the end of the relationship, we return or securely destroy PHI as required by our Business Associate Agreement, and remove all access to your systems.
Can you complete our security questionnaire?
Yes. We are happy to complete vendor security questionnaires and answer questions from your compliance team during onboarding.
Have a security or compliance question?
Our team will answer your questions and share our BAA before you sign up.
Professional medical billing and credentialing services for US healthcare providers. Over 4 years of experience.
Specialties
Contact
- hellomed@vantixmed.com
- Mon–Fri, 9am–6pm EST
- 106 E Lincolnway Suite 305A
Cheyenne, WY 82001, USA
