HIPAA & Security
Trust is infrastructure. MedfirstRCM treats protected health information with the same rigor we bring to clean claims — documented controls, trained people, and auditable processes.
Last updated: July 1, 2026
HIPAA commitment
MedfirstRCM operates as a business associate to covered entities. We sign Business Associate Agreements (BAAs) as a standard part of onboarding and design workflows to support the Privacy, Security, and Breach Notification Rules.
Minimum necessary access, role-based permissions, and documented policies guide how workforce members handle PHI day to day.
SOC 2 Type II
We maintain SOC 2 Type II controls covering security and availability. Reports are available to clients under NDA.
Control areas include access management, change management, vendor oversight, and incident response.
Encryption & infrastructure
Data in transit is protected with modern TLS. Production systems use encryption at rest, network segmentation, and continuous monitoring.
Remote access requires multi-factor authentication. Endpoint and identity controls are enforced for staff with production access.
BAA availability
A MedfirstRCM BAA is available for every engagement that involves PHI. We also flow down appropriate terms to subprocessors that touch client data.
Workforce training
All team members complete HIPAA and security awareness training at hire and at least annually thereafter. Phishing simulations and policy acknowledgments reinforce the program.
Specialists working lab and specialty claims receive additional guidance on safeguarding clinical documentation used in appeals.
Incident response
We maintain an incident response plan with escalation paths, forensic readiness, and client notification procedures aligned to contractual and regulatory timelines.
Security contact
Security or compliance inquiries: billing@medfirstrcm.com. Mailing address: 212 N. 2nd St. STE 100, Richmond, KY 40475. For urgent incidents, use the 24/7 escalation path provided in your account welcome kit.