Security and privacy
What happens to your patients' data
We are your practice's HIPAA business associate. We sign a Business Associate Agreement (BAA) before any patient data moves, and our systems are built to HIPAA standards.
The BAA comes first
We sign it before we see, receive or log in to anything with patient information. No BAA, no patient data.
The BAA, explained| The BAA requires us to | Rule |
|---|---|
| Use and share your patients' information only as the BAA allows or the law requires. | 45 CFR 164.504(e)(2)(i) and (ii)(A) |
| Protect it with appropriate safeguards and follow the HIPAA Security Rule for electronic records. | 45 CFR 164.504(e)(2)(ii)(B); 164.314(a)(2)(i)(A) |
| Tell you about any use or disclosure the BAA does not allow, any security incident, and any breach of unsecured patient information. | 45 CFR 164.504(e)(2)(ii)(C); 164.314(a)(2)(i)(C) |
| Make every vendor that handles the information agree to the same restrictions, in writing. | 45 CFR 164.504(e)(2)(ii)(D); 164.314(a)(2)(i)(B) |
| Make the information available so you can answer patients who ask to see, correct or track their records. | 45 CFR 164.504(e)(2)(ii)(E) to (G) |
| Follow the Privacy Rule when we do a task that is your practice's own obligation. | 45 CFR 164.504(e)(2)(ii)(H) |
| Open our books and records about the information to HHS. | 45 CFR 164.504(e)(2)(ii)(I) |
| Return or destroy it at the end and keep no copies, or keep protecting what cannot be returned or destroyed. | 45 CFR 164.504(e)(2)(ii)(J) |
| Let you end the agreement if we break a material term. | 45 CFR 164.504(e)(2)(iii) |
How our systems protect your patients' data
Our billing system is built to HIPAA standards.
| Protection | What it does |
|---|---|
| Encryption | Patient data is encrypted when it is stored and when it moves. |
| Role-based access | Each person sees only what their role needs. |
| A log of every access | Every access to patient data is recorded. |
| Secrets management | Passwords and keys to connected systems are kept in a secrets manager. |
| A check on where data goes | Patient data is blocked from leaving to any service we have not approved. |
| AI providers | Our billing is AI-native, and AI runs only on providers that sign a BAA with us. |
| Backups and monitoring | Data is backed up, and our systems are monitored. |
Duties that apply to us directly
HHS can enforce many of these duties against us directly, not only through the BAA. The Security Rule applies to us as a business associate.
What we access, and why
We use only what billing needs: demographics, insurance, visit dates, charges, codes, payments and insurance company letters, and clinical notes when an insurance company asks for them to support a claim or appeal. HIPAA's minimum necessary standard applies to us directly.
Companies that handle your data
You do not sign with our vendors. HIPAA requires us to have a written BAA with each vendor before it touches your patients' data.
If something goes wrong, you hear from us
If your patients' information is ever involved in a breach, we tell you. The Breach Notification Rule requires a business associate to notify the practice without unreasonable delay and no later than 60 days after discovering it. Your BAA puts that duty in writing.
When you leave, your data stays yours
Your records stay in your EMR the whole time. When our agreement ends, we return or destroy the patient information we hold, as the BAA requires, and keep no copies. If a copy cannot be destroyed right away, it stays protected until it is.
There is no official HIPAA certification
HHS does not issue a HIPAA certification and does not recognize private ones. What counts is how a company handles your patients' information. We sign a BAA before any patient data moves, and we follow the HIPAA Privacy, Security and Breach Notification Rules.
This website
This website never asks for patient information. Please keep patient details out of the contact form and out of email.
Rules that are changing
In January 2025, HHS proposed changes to the Security Rule, including required multi-factor sign-in, encryption and yearly penetration tests. The federal agenda lists July 2027 for final action.
Questions about patient data
Yes, before any patient data reaches us or we log in to your systems. No BAA, no patient data.
There is no official HIPAA certification: HHS does not issue or recognize one. We sign a Business Associate Agreement before any patient data moves, and we follow the HIPAA Privacy, Security and Breach Notification Rules in how we handle your patients' information.
You do not sign with our vendors. HIPAA requires us to have a written BAA with each vendor before it touches your patients' data.
Please don't. This website does not ask for patient information.
Next question: who are you?
Who founded Mohenara, and how we work.