Menu

What we do

Specialties

Company

Get a billing plan

Security and privacy

What happens to your patients' data

When we bill for your practice, we are its HIPAA business associate. We sign a Business Associate Agreement before any patient data moves, and we follow the HIPAA Privacy, Security and Breach Notification Rules in how we handle your patients' information.

A Business Associate Agreement before any patient data moves

We sign a Business Associate Agreement (BAA) with your practice before we see, receive or log in to anything with patient information. No BAA, no patient data.1

The BAA, explained
Table 1What every BAA must commit us to
The BAA requires us toRule
Use and share your patients' information only as the BAA allows or the law requires.45 CFR 164.504(e)(2)(i) and (ii)(A)2
Protect it with appropriate safeguards and follow the HIPAA Security Rule for electronic records.45 CFR 164.504(e)(2)(ii)(B)2; 164.314(a)(2)(i)(A)3
Tell you about any use or disclosure the BAA does not allow, any security incident, and any breach of unsecured patient information.45 CFR 164.504(e)(2)(ii)(C)2; 164.314(a)(2)(i)(C)3
Make every vendor that handles the information agree to the same restrictions, in writing.45 CFR 164.504(e)(2)(ii)(D)2; 164.314(a)(2)(i)(B)3
Make the information available so you can answer patients who ask to see, correct or track their records.45 CFR 164.504(e)(2)(ii)(E) to (G)2
Follow the Privacy Rule when we do a task that is your practice's own obligation.45 CFR 164.504(e)(2)(ii)(H)2
Open our books and records about the information to HHS.45 CFR 164.504(e)(2)(ii)(I)2
Return or destroy it at the end and keep no copies, or keep protecting what cannot be returned or destroyed.45 CFR 164.504(e)(2)(ii)(J)2
Let you end the agreement if we break a material term.45 CFR 164.504(e)(2)(iii)2

Duties that apply to us directly

HHS can enforce many of these duties against us directly, not only through the BAA.4 The Security Rule applies to us as a business associate.5

What we access, and why

We use only what billing needs: demographics, insurance, visit dates, charges, codes, payments and insurance company letters, and clinical notes when an insurance company asks for them to support a claim or appeal. HIPAA's minimum necessary standard applies to us directly.16

Companies that handle your data

You do not sign with our vendors. HIPAA requires us to have a written BAA with each vendor before it touches your patients' data.12

If something goes wrong, you hear from us

If your patients' information is ever involved in a breach, we tell you. The Breach Notification Rule requires a business associate to notify the practice without unreasonable delay and no later than 60 days after discovering it.7 Your BAA puts that duty in writing.2

When you leave, your data stays yours

Your records stay in your EMR the whole time. When our agreement ends, we return or destroy the patient information we hold, as the BAA requires, and keep no copies. If a copy cannot be destroyed right away, it stays protected until it is.2

There is no official HIPAA certification

HHS does not issue a HIPAA certification and does not recognize private ones.8 What counts is how a company handles your patients' information. We sign a Business Associate Agreement before any patient data moves, and we follow the HIPAA Privacy, Security and Breach Notification Rules in how we handle your patients' information.

This website

This website never asks for patient information. Please keep patient details out of the contact form and out of email.

Rules that are changing

In January 2025, HHS proposed changes to the Security Rule, including required multi-factor sign-in, encryption and yearly penetration tests.9 The federal agenda lists July 2027 for final action.10

Questions about patient data

Yes, before any patient data reaches us or we log in to your systems. No BAA, no patient data.

There is no official HIPAA certification: HHS does not issue or recognize one.8 We sign a Business Associate Agreement before any patient data moves, and we follow the HIPAA Privacy, Security and Breach Notification Rules in how we handle your patients' information.157

You do not sign with our vendors. HIPAA requires us to have a written BAA with each vendor before it touches your patients' data.1

Please don't. This website does not ask for patient information.

Next question: who are you?

Mohenara LLC, who founded it, what we believe and how we work.

Who we are