1. Introduction

YB Billing ("YB Billing," "we," "us," or "our") provides medical billing, coding, and claim tracking services to healthcare providers ("Covered Entities" or "Clients"). In the course of providing these services, YB Billing routinely creates, receives, maintains, and transmits Protected Health Information (PHI) and Personally Identifiable Information (PII) on behalf of our Clients. This Privacy Policy explains how we handle that information in compliance with the Health Insurance Portability and Accountability Act of 1996 (HIPAA), the HITECH Act, and applicable state privacy laws.

2. Definitions

Protected Health Information (PHI)

Individually identifiable health information transmitted or maintained in any form (electronic, paper, or oral) relating to a patient's past, present, or future physical or mental health condition, the provision of healthcare, or payment for healthcare — including names, dates of service, diagnosis codes, insurance ID numbers, and billing records.

Personally Identifiable Information (PII)

Any data that could potentially identify a specific individual, such as Social Security numbers, addresses, dates of birth, and financial account information, whether or not it relates to health information.

Covered Entity

A healthcare provider, health plan, or healthcare clearinghouse that transmits health information electronically in connection with covered transactions.

Business Associate

An entity that performs functions or activities on behalf of a Covered Entity that involve the use or disclosure of PHI. YB Billing acts as a Business Associate for every provider client we serve.

3. Our Role Under HIPAA

As a medical billing service provider, YB Billing is classified as a Business Associate under HIPAA. This means we are contractually and legally obligated — under a signed Business Associate Agreement (BAA) with each Client — to protect PHI to the same standard required of Covered Entities, and we are directly liable under HIPAA for compliance failures.

4. How We Collect and Use PHI/PII

We collect PHI and PII solely to perform billing-related functions authorized by our Clients, including:

• Submitting insurance claims to payers on behalf of providers
• Tracking claim status, denials, and appeals
• Posting payments and reconciling patient accounts
• Generating billing and revenue-cycle reports for the Client
• Communicating with insurance payers and patients regarding billing inquiries

We do not use PHI for marketing purposes, sell PHI/PII to third parties, or use patient data for any purpose outside the scope defined in our Business Associate Agreements.

5. Administrative Safeguards

• Designated Privacy Officer and Security Officer responsible for HIPAA compliance oversight
• Written policies and procedures governing PHI access, use, and disclosure
• Mandatory HIPAA training for all employees upon hire and annually thereafter
• Signed confidentiality agreements with every employee and contractor
• Formal sanction policy for employees who violate privacy or security policies
• Regular internal risk assessments and compliance audits

6. Physical Safeguards

• Restricted access to office facilities via key-card entry and visitor logs
• Workstations positioned to prevent unauthorized viewing of PHI
• Locked storage for any physical documents containing PHI
• Secure, monitored disposal (cross-cut shredding) of paper records containing PHI
• Device encryption and remote-wipe capability for all company laptops

7. Technical Safeguards

• End-to-end encryption (TLS 1.2+) for all data transmitted between YB Billing, Clients, and payers
• AES-256 encryption for PHI at rest in our databases and backup systems
• Unique user IDs, strong password policies, and multi-factor authentication for all systems accessing PHI
• Role-based access controls limiting PHI visibility to only what each employee needs to perform their job
• Automatic session timeouts and audit logging of all PHI access and modifications
• Regular vulnerability scans, penetration testing, and software patching

8. Minimum Necessary Standard

YB Billing adheres to HIPAA's "minimum necessary" standard: employees access only the minimum amount of PHI required to complete a specific billing task, and data shared with payers or Clients is limited to what is necessary for the applicable transaction.

9. Business Associate Agreements

Before any PHI is exchanged, YB Billing executes a Business Associate Agreement (BAA) with each Client that defines: the permitted uses and disclosures of PHI, required safeguards, breach notification obligations, and the return or destruction of PHI upon termination of services. We also require BAAs with any subcontractor (e.g., cloud hosting or clearinghouse vendors) who may handle PHI on our behalf.

10. Data Retention & Secure Disposal

PHI is retained only as long as necessary to fulfill billing obligations and to comply with federal and state record-retention requirements (typically 6–10 years depending on jurisdiction). When retention periods expire, electronic PHI is permanently and irreversibly deleted using secure data-wiping methods, and physical records are cross-cut shredded by a certified destruction vendor.

11. Breach Notification Procedures

In the event of a suspected or confirmed breach of unsecured PHI, YB Billing will:

• Contain and investigate the incident immediately upon discovery
• Notify affected Clients without unreasonable delay, and in no case later than required by the HIPAA Breach Notification Rule
• Provide a written risk assessment detailing the nature of the breach, data involved, and mitigation steps
• Support Clients in notifying affected individuals and, where required, the Department of Health and Human Services (HHS)
• Implement corrective actions to prevent recurrence

12. Patient & Client Rights

While patients' primary HIPAA rights (access, amendment, accounting of disclosures) are held with the Covered Entity (the healthcare provider), YB Billing supports our Clients in fulfilling these obligations by promptly providing requested billing records, disclosure logs, and documentation upon a Client's request.

13. Employee Training & Accountability

Every YB Billing employee completes HIPAA privacy and security training before accessing any PHI, with refresher training annually. Access to PHI is immediately revoked upon role change or termination, and all access is logged and periodically audited by our Security Officer.

14. Third-Party Disclosures

PHI is disclosed only to insurance payers, clearinghouses, or subcontracted vendors necessary to complete the billing process — each governed by a signed BAA. We do not disclose PHI to any third party for marketing, research, or unrelated commercial purposes without explicit written authorization from the Covered Entity.

15. Changes to This Policy

YB Billing may update this Privacy Policy periodically to reflect changes in law, technology, or our practices. Material changes will be communicated to Clients directly, and the "Last updated" date at the top of this page will be revised accordingly.

16. Contact Us

If you have questions about this Privacy Policy, our HIPAA compliance practices, or wish to report a concern, please contact our Privacy Officer:

• Email: privacy@yb-billing.com
• Phone: (954) 539-7252
• Mail: YB Billing, Attn: Privacy Officer, 7901 N 4th ST, Suite 300, St Petersburg, FL 33702

← Back to Home