Security & Compliance

Apex RCM Services ("Apex RCM", "we", "us", or "our") has the responsibility of protecting our clients' private financial and health data, and this protection is fundamental to the way we do business.

The following page provides a brief summary of how we approach both security and compliance. In addition, our Privacy Policy details how we use the data collected via this website. Finally, each of our clients has specific responsibilities as defined in their signed agreement(s) with us.

Our Approach

We use several types of controls (administrative, physical, and technical) to help protect our data. We work hard to ensure that all data remains secure, accurate, and accessible when needed. Security measures are integrated into each day's work rather than being completed separately.

HIPAA Compliance

We are a business associate for our clients who are healthcare providers. When we have access to PHI on behalf of a client, it is done through an executed Business Associate Agreement (BAA) and for no other reason than what that agreement permits. Our security practices were developed in accordance with the requirements of HIPAA.

Protecting Your Data

• Security: Data is secure when moving over networks and when stored.
• Access Control: Only those authorized to use records that contain sensitive information will be able to access those records.
• Minimal Necessary Usage: Information at the individual patient level will be utilized and distributed only when it is essential for the delivery of our services.
• Deleting/Anonymizing Data: When your data is no longer necessary for services, compliance with laws, or reporting, the data will be removed or made anonymous.

Our People

All employees who work with client information have the responsibility of following the company's confidentiality and data security policies. Access will be based on job function, and once an employee no longer requires access, their access will be rescinded.

Trusted Vendors

We may hire approved vendors and contractors for services including but not limited to website hosting and the development/maintenance of our information technology systems. Our approved vendors/contractors will be required to maintain strict privacy/security standards, and each vendor/contractor who has access to PHI (Protected Health Information) on our behalf must comply with the Health Insurance Portability and Accountability Act (HIPAA).

Incident Response

When we believe there has been a breach in our systems, we take immediate action to limit its damage, find out how it occurred, and make sure it does not happen again. If the incident affects any of our clients' data, we will inform the client of the situation, as per the legal requirements and our contract with them.

Protecting Your Information on This Website

Our site forms are used only for business inquiries. Do not submit your PHI, patient health record(s), diagnosis(es), etc. via the site forms. Your submissions will be processed using spam protection, and the handling of the information submitted will follow our Privacy Policy.

Your Role

Clients contribute to security through the protection of client credentials (e.g., username/password), limiting access to the most appropriate employees, and notifying the company of employee turnover as well as any activity that appears suspicious.

Reporting a Concern

If there is a safety issue with your personal information or if you think that your data has been compromised, let us know as soon as possible via our "Contact Us" section. Do not include Protected Health Information (PHI) in your initial contact.

Changes to This Page

As we continuously review and update our processes, technological capabilities, and regulatory requirements, we reserve the right to revise this document. You will find the date of the most recent revision at the top of the first page.