Privacy Policy

Last Updated: December 5, 2025 | Effective Date: December 5, 2025

1. Introduction

Reimbursify ("we," "our," or "us") is committed to protecting your privacy and the confidentiality of your Protected Health Information (PHI) in compliance with the Health Insurance Portability and Accountability Act of 1996 (HIPAA), the HITECH Act, and all applicable federal and state privacy laws.

This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our medical practice management platform, including our physician portal, back office portal, IVR voice system, and related services.

2. Information We Collect

2.1 Protected Health Information (PHI)

We may collect and process PHI on behalf of healthcare providers, including:

• Patient names, addresses, and contact information
• Dates of birth and Social Security numbers
• Medical record numbers and account numbers
• Health insurance information and policy numbers
• Diagnosis codes (ICD-10) and procedure codes (CPT)
• Treatment records and medical history
• Appointment scheduling information
• Prescription and medication information
• Laboratory and imaging results
• Billing and payment information

2.2 Provider Information

For healthcare providers using our platform, we collect:

• National Provider Identifier (NPI) numbers
• Professional license information
• DEA registration numbers
• Practice information and tax identification numbers
• Credentialing and enrollment documentation
• Bank account information for payment processing

2.3 Technical Information

We automatically collect certain technical information:

• IP addresses and device identifiers
• Browser type and operating system
• Access times and pages viewed
• Audit logs of system access and actions

3. How We Use Protected Health Information

3.1 Treatment

PHI may be used to support healthcare providers in delivering treatment to patients, including:

• Scheduling and managing appointments
• Coordinating care between providers
• Generating referral communications
• Supporting clinical decision-making through AI-powered coding assistance

3.2 Payment

PHI may be used for payment-related activities, including:

• Submitting claims to insurance companies
• Verifying insurance eligibility
• Processing prior authorizations
• Managing accounts receivable and billing
• Collecting outstanding balances

3.3 Healthcare Operations

PHI may be used for healthcare operations, including:

• Quality assessment and improvement activities
• Credentialing and accreditation
• Compliance auditing and reporting
• Business management and administration

4. Disclosures Without Authorization

In certain circumstances, we may use or disclose PHI without patient authorization as permitted by law:

• Public Health Activities: Reporting to public health authorities for disease prevention and control
• Health Oversight: Disclosures to government agencies for audits, investigations, or inspections
• Judicial Proceedings: In response to court orders or subpoenas
• Law Enforcement: When required by law or to report suspected abuse or neglect
• Emergency Situations: To prevent serious threat to health or safety
• Workers' Compensation: As authorized by workers' compensation laws
• Coroners and Medical Examiners: For identification or determining cause of death

4.1 Uses Requiring Authorization

The following uses of PHI require explicit written authorization from the patient:

• Marketing purposes (unless face-to-face or promotional gifts of nominal value)
• Sale of PHI
• Psychotherapy notes (with limited exceptions)
• Most research purposes

5. Your Rights Under HIPAA

6. Security Measures

We implement comprehensive security measures to protect PHI in compliance with the HIPAA Security Rule:

6.1 Technical Safeguards

• TLS 1.2+ encryption for all data in transit
• AES-256 encryption for data at rest
• Multi-factor authentication (MFA) for portal access
• Automatic session timeouts (15 minutes of inactivity)
• Role-based access controls
• Unique user identification and audit trails

6.2 Administrative Safeguards

• Designated Privacy and Security Officers
• Regular workforce training on HIPAA compliance
• Business Associate Agreements with all subcontractors
• Incident response and breach notification procedures
• Annual Security Risk Assessments

6.3 Physical Safeguards

• Secure data centers with access controls
• Workstation security policies
• Device and media controls

7. Cookies and Tracking Technologies

Our platform uses cookies and similar technologies for:

• Essential Cookies: Required for platform functionality, authentication, and security
• Session Cookies: Maintain your login session and preferences
• Security Cookies: Support trusted device recognition and fraud prevention

8. Third-Party Services

We work with carefully vetted third-party service providers who have signed Business Associate Agreements:

• Twilio: SMS notifications and IVR voice services
• SendGrid: Secure email communications
• Stripe: Payment processing (PCI-DSS compliant)
• Google Calendar: Appointment synchronization (optional integration)
• OpenAI: AI-powered medical coding assistance (with PHI encryption)

All third-party providers are contractually obligated to protect PHI in accordance with HIPAA requirements.

9. Data Retention

We retain PHI and records in accordance with applicable laws:

• Medical Records: Retained for the period required by state law (typically 7-10 years after last treatment)
• Billing Records: Retained for at least 7 years
• Audit Logs: Retained for at least 6 years as required by HIPAA
• Account Information: Retained for the duration of the business relationship plus required retention period

Upon request and subject to legal requirements, we can assist with secure disposal of records.

10. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes:

• We will update the "Last Updated" date at the top of this policy
• We will post the revised policy on our website
• For significant changes, we may notify you via email or platform notification

We encourage you to review this policy periodically. Your continued use of our platform after changes are posted constitutes acceptance of the updated policy.

11. Contact Information