Business Associate Agreement (BAA)

1. Scope & Permitted Uses of PHI

RCMContact agrees to store, transmit, and process Electronic Protected Health Information (ePHI) strictly to fulfill the primary communication operations outlined inside our Master Services Agreement. We are expressly prohibited from utilizing or sharing protected records in any layout that would directly breach statutory HIPAA Privacy Rules if executed by the Covered Entity itself.

2. Mandatory Security Safeguards

To maintain absolute structural containment barriers around downstream telephony transit payloads, RCMContact guarantees the enforcement of administrative, technical, and physical safeguards including:

• Data Encryption: Flawless TLS 1.3 flight encryption structures alongside AES-256 stationary block partitions protecting active database setups.
• Access Containment: Role-based access logic controls and multi-factor authorization safeguards isolating user activity entries.
• Real-Time Auditing: Immutable tracking logs capturing every interaction loop, database API request, and credential state transition natively.

3. Security Incident & Breach Notification Protocols

In accordance with federal data protection protocols, RCMContact maintains automated monitoring processes across our entire platform layout. Following the clear verification of any unpermitted ePHI exposure, network breach vector, or service vulnerability footprint, our compliance response officers will notify the designated Covered Entity contacts within 24 to 72 hours of baseline confirmation.

4. Subcontractor Governance Boundaries

If RCMContact coordinates with secondary third-party carrier lines or cloud architecture vendors to deliver cross-border network routing loops, we ensure that every participating infrastructure sub-vendor signs identical contractual data protection covenants, legally insulating your operational workflows.

5. Data Destruction & Return Policy

Upon termination of your service workspace configuration, RCMContact completely purges or returns all saved patient ledger rows, contact numbers, and recording arrays within thirty (30) business days. If technical limitations or federal archive rules require stationary record preservation, those elements stay structurally locked down until deep overwrite scripts can clear them securely.