MedsIT Nexus Privacy Policy

MedsIT Nexus ("MedsIT Nexus," "we," "us," or "our") provides medical billing, coding, credentialing, and revenue cycle management (RCM) services to healthcare providers and practices. This Privacy Policy explains how we collect, use, share, and protect information when you visit https://medsitnexus.com (the "Website"), contact us, or request information about our services.

This policy covers information collected through the Website and our general business communications. Protected Health Information (PHI) that we process on behalf of our healthcare clients is governed separately by the Health Insurance Portability and Accountability Act of 1996 (HIPAA), the HITECH Act, and the Business Associate Agreements (BAAs) we sign with each client, as described in the section "Protected Health Information in Our Billing and RCM Services."

By using the Website, you agree to the practices described in this policy. If you do not agree, please do not use the Website.

When you fill out a contact form, request a free billing audit or consultation, subscribe to updates, apply for a job, or email or call us, we may collect:

• Your name, job title, and practice or organization name
• Business email address, phone number, and mailing address
• Practice details such as medical specialty, number of providers, monthly claim volume, current billing software or EHR/PM system, and the services you are interested in
• Any other information you choose to include in your message

When you browse the Website, we automatically collect certain technical information, including:

• IP address and approximate location (city/region)
• Browser type and version, operating system, and device information
• Pages visited, time spent on pages, links clicked, and referring website
• Date and time of your visit and other site activity patterns

We do not ask for, and you should not submit through Website forms, any sensitive personal information, including:

• Patient health information, medical records, diagnoses, or treatment details
• Patient Social Security numbers, insurance member IDs, or claim details
• Information about race, ethnicity, religion, sexual orientation, or political beliefs
• Payment card or bank account numbers

If you are a current or prospective client who needs to share patient data, our team will provide a secure, HIPAA-compliant transfer method after a Business Associate Agreement is in place.

When healthcare providers engage MedsIT Nexus for medical billing, coding, eligibility verification, prior authorization, claim submission, denial management, A/R follow-up, payment posting, or patient statement services, we act as a Business Associate under HIPAA. In that role:

• We access and process PHI only as permitted by our Business Associate Agreement with the covered entity (the provider) and by HIPAA.
• We use PHI solely to perform billing, coding, and revenue cycle services for that client, such as submitting claims to payers and clearinghouses and following up on reimbursement.
• We apply the "minimum necessary" standard, limiting PHI access to staff who need it to perform their job.
• We maintain administrative, physical, and technical safeguards required by the HIPAA Security Rule.
• We disclose PHI only to the client, insurance payers, clearinghouses, and subcontractors bound by their own BAAs, or as required by law.
• We notify the client of any breach of unsecured PHI as required by the HIPAA Breach Notification Rule and the BAA.
• We never sell PHI or use it for marketing.

Patients who have questions about their health information, or who want to exercise their HIPAA rights (such as access or amendment), should contact their healthcare provider directly. Their provider’s Notice of Privacy Practices governs how that information is used.

We use the information collected through the Website to:

• Respond to inquiries, consultation requests, and free billing audit requests
• Prepare proposals and pricing tailored to your practice’s specialty and claim volume
• Onboard new clients and manage our business relationship, including contracts and BAAs
• Send service updates, industry news (such as payer policy and coding changes), and marketing communications, which you may opt out of at any time
• Analyze Website traffic and usage to improve our content, services, and user experience
• Detect, prevent, and investigate fraud, security incidents, or misuse of the Website
• Comply with legal, regulatory, and contractual obligations

If you receive marketing emails from us, you can unsubscribe using the link in any email or by writing to support@medsitnexus.com.

We do not sell, rent, or trade your personal information. We share it only in these limited cases:

• Partners and affiliates: We may share contact and business information with our affiliated companies and trusted partners to provide services or relevant marketing. They must protect it under terms consistent with this policy.
• Service providers: Vendors that help us operate the Website and our business, such as hosting, email, CRM, and analytics providers, receive only the data they need and may not use it for their own purposes.
• Payers and clearinghouses: For clients only, and only as needed to process claims under our BAA.
• Legal requirements: When required by law, subpoena, court order, or a government or regulatory request, or to protect the rights, property, or safety of MedsIT Nexus, our clients, or others.
• Business transfers: If MedsIT Nexus is involved in a merger, acquisition, or sale of assets, your information may transfer to the successor, which will remain bound by this policy and any applicable BAAs.

The Website uses cookies, pixels, and similar technologies to help pages load correctly, remember your preferences, and understand how visitors use the site. This data is aggregated for analytics and is not linked to your personal identity.

You can block or delete cookies through your browser settings. Blocking some cookies may affect how the Website works. We do not use tracking technologies on client billing portals or patient-facing systems in any way that discloses PHI to analytics or advertising providers.

All information is stored on secure servers located in the United States. We protect it with safeguards appropriate to healthcare and financial data, including:

• SSL/TLS encryption for all data transmitted through the Website
• Encryption of sensitive data at rest
• Password protection and multi-factor authentication for systems that hold client data
• Role-based access controls, so only authorized staff can view information needed for their job
• HIPAA privacy and security training for all employees, with signed confidentiality agreements
• Activity logging, regular risk assessments, and an incident response plan
• BAAs with every subcontractor that may access PHI

No method of transmission or storage is 100% secure. While we work hard to protect your information, we cannot guarantee absolute security. If we become aware of a breach affecting your information, we will notify you and any affected clients as required by law and our contracts.

We keep Website and contact information only as long as needed for the purposes in this policy, or as required by law. Client records and PHI are retained and returned or destroyed according to each client’s BAA, HIPAA documentation requirements, and applicable state and payer record-retention rules.

Depending on where you live, you may have the right to:

• Request access to the personal information we hold about you
• Ask us to correct inaccurate information
• Ask us to delete your information, subject to legal and contractual retention requirements
• Opt out of marketing communications and of sharing with partners and affiliates for marketing

To make a request, email support@medsitnexus.com. We will verify your identity and respond within the time required by applicable law. We will not discriminate against you for exercising these rights. Patients seeking access to medical or billing records should contact their healthcare provider.

The Website is intended for healthcare professionals and businesses. It is not directed to children under 13, and we do not knowingly collect personal information from them through the Website.

The Website may link to third-party sites, such as payer portals, clearinghouses, or industry resources. We are not responsible for their privacy practices and encourage you to review their policies.

We may update this Privacy Policy at any time to reflect changes in our services, technology, or legal requirements. Updates will be posted on this page with a revised "Last Updated" date. Continued use of the Website after changes are posted means you accept the updated policy.