Practice-level access
Access is assigned by practice and function. Users can access the practices and functions they have been granted; access can be withdrawn when responsibilities change.
Security and data handling
Review how claim information is handled
A clear data-handling review belongs before the first batch. Ask about access, storage, subprocessors, retention, and the agreements governing the work.
Current data-handling commitments
Encryption
Claim information is encrypted in transit and at rest, including backups.
Activity and correction history
Access to PHI and changes to case records are logged. Corrections add to the history rather than replacing the earlier record.
United States data location
Claim information is stored and processed in the United States, including backups. Hosting and subprocessor details are available for review.
Access boundaries
Practice boundaries stay visible
A shared RCM operation can serve several practices without treating their work as one undifferentiated pool. Access follows assigned practice and function.
RCM company workspace
- Practice A Cases, records, and activity remain connected to this practice.
- Practice B A separate boundary contains this practice's work and review history.
- Assigned access People reach only the practices and functions they have been granted.
The diagram describes the operating boundary, not the underlying implementation.
Agreements and review materials
A business associate agreement is in place before Halcora handles PHI. Current controls documentation is available under a mutual non-disclosure agreement.
Tell us what your review requires, including retention, deletion, incident reporting, and subprocessor access. We will address those requirements before work begins.
Start with the security review
Bring the requirements your team needs to examine. We can discuss the current controls and available documentation before any patient information is shared.