Security & HIPAA

01Business associate agreement

We sign a business associate agreement with every practice before accessing protected health information, and we require the same of any subcontractor who touches it. The BAA is part of the engagement pack, not an add-on negotiated later.

Where a client already has a BAA template, we work from theirs.

02Access control

• Named accounts only — no shared logins, and no credentials stored in documents or chat.
• Access is scoped to the specific systems a person needs for their desk.
• Multi-factor authentication on every system that supports it, including the client portal.
• Accounts are removed on the day a person leaves an account, and access is reviewed quarterly.
• Administrative activity is logged and retained for review.

03Encryption and transmission

Traffic to and from this website and our client systems is encrypted in transit using TLS. Data at rest in our systems and in client systems we operate is encrypted at the storage layer.

Protected health information moves through secure portals or encrypted links, never as an email attachment. That default is configured once and is the path of least resistance, because a control people have to remember is a control that eventually fails.

04Workforce safeguards

Everyone with access completes HIPAA privacy and security training at onboarding and annually thereafter. Confidentiality obligations survive the end of employment.

Where work is performed remotely, it is performed on managed devices with full-disk encryption, screen lock, and no local storage of patient records outside approved systems.

05Incident response

We maintain a written incident response procedure covering detection, containment, assessment, notification and remediation. Where an incident affects a client's protected health information, we notify the client without unreasonable delay and no later than the timeframe required by the BAA.

We would rather report a false alarm than a silent one.

06Physical and hosting

This website is hosted on infrastructure we control, behind a reverse proxy with TLS termination, at-rest encryption and restricted administrative access. Application secrets are held in environment configuration, not in the repository.

Database backups, where a database is in use, are encrypted and tested for restore.

07Your data, and leaving

Claims data, clinical notes, ledgers, reports and correspondence belong to the practice. We hold them as a custodian, not an owner.

On request — at any point, not only at the end of an engagement — you receive a complete export in a documented, machine-readable format at no cost. There is no exit fee and no withholding of data pending payment of an invoice.

08What we do not claim

We are not currently certified to SOC 2 or HITRUST, and we do not describe ourselves as such. If a certification becomes a requirement for your practice, tell us — it is a reasonable question to ask a vendor holding your claims data, and we will tell you exactly where we stand.

09Reporting a concern

Security questions and vulnerability reports can be sent to info@mbs.elliniventures.com and are routed to a person, not a ticket queue. If you believe protected health information has been exposed, say so in the subject line.