How we protect your practice's data

Billing, coding, denial and AR work happens inside your own EHR and practice management system. There’s no data migration, your software licences stay in your name, and your data stays yours.

To start a free audit, aging totals are enough, so there’s no need to send patient data before a BAA is in place. Please don’t send patient information through our website forms or by ordinary email.

Everyone who works on your account gets their own login to your systems. We don’t share logins or passwords, and each login uses two-factor sign-in wherever your system supports it.

When the work ends, every Quilven login comes off within 2 business days of the end date. The one exception is an AR recovery project, where one read-only report login stays for the 90 days after the end date while payments on the claims we worked are still posting. See how our AR recovery terms work.

Everyone at Quilven who touches client data completes HIPAA training and signs a confidentiality agreement.

We operate a global team, with US and international staff. The BAA covers every person who touches your data, wherever they sit. Two things worth checking on your side: whether any of your payer contracts restrict protected health information leaving the US, and whether your state adds requirements of its own.

If we discover a breach involving your patients’ data, we tell your practice within 5 business days of discovery. We share what happened and, as far as we can establish, which patients are affected, so you can meet your own notification duties.

HIPAA requires a business associate to give notice without unreasonable delay and no later than 60 calendar days after discovery (45 CFR 164.410(b)). Our 5 business days is well inside that.

When an engagement ends, we return or destroy the patient data we hold for your practice, as the BAA and HIPAA require (45 CFR 164.504(e)). If returning or destroying any of it isn’t feasible, the BAA’s protections keep applying to it for as long as we hold it.

Quilven carries professional liability (errors and omissions) insurance and cyber liability insurance. We’ll send a certificate of insurance on request.

For security questions, a BAA to review or a certificate of insurance, get in touch: