Platform / Security and Compliance
Security and compliance
Patient and payment data protected at every step
BillCycle handles protected health information every day. It is built to HIPAA requirements, encrypts data in transit and at rest, limits access by role and records every action.
- HIPAA compliant
- Encrypted in transit and at rest
- Full audit trail of every action
Controls [Values to confirm]
Audit log Today
| 09:42 | K. Patel | Edited claim #48213 |
| 09:31 | J. Moore | Posted ERA · UHC |
| 09:12 | Admin | Changed role: Biller |
Core controls
Four controls built into every account
These are on by default. You do not pay extra or turn them on.
HIPAA compliance
BillCycle is designed and operated to meet HIPAA Privacy and Security Rule requirements for handling PHI.
Encryption
Data is encrypted in transit between your systems and BillCycle, and at rest in storage.
Role-based access
Each user sees only the practices, data and actions their role allows.
Full audit trail
Every view, edit, submission and approval is logged with the user, time and change.
Access control
Give each person exactly the access their job needs
A front desk user does not need practice-wide financials. A biller for one client does not need to see another. BillCycle lets you set this by role and change it as people move.
Roles you define
Start from standard roles such as biller, manager and owner, and adjust permissions to fit your team.
Client separation
Billing companies keep each client’s data separate and grant access client by client.
Quick removal
When someone leaves, an admin turns off access in one step.
Collections by week Last 8 weeks
| Commercial | $218K | On target |
| Medicare | $131K | On target |
| Medicaid | $63K | Slow |
Audit trail
A record of who did what, and when
If a payer, auditor or patient asks what happened to a claim or a record, you can show them. BillCycle keeps a full history of activity on every claim and patient account.
Every action logged
Edits, submissions, postings, approvals and record views are captured.
AI actions included
AI flags, suggestions and drafts are logged along with the person who accepted or dismissed them.
Searchable history
Look up activity by user, claim, patient or date range.
| Claim | Payer | Status | Age | Amount | Next |
|---|---|---|---|---|---|
| #48213 | BCBS PPO | Rejected | 2d | $225 | Fix modifier |
| #48207 | Aetna | No response | 84d | $3,615 | Call payer |
| #48190 | Medicare | In process | 12d | $860 | Wait |
| #48172 | UHC | Denied CO-16 | 21d | $1,140 | Add info |
| #48165 | Cigna | Paid | 18d | $410 | Done |
How we handle your data
Safeguards behind the scenes
The details your compliance reviewer will ask about.
- Business Associate Agreement [confirm standard BAA terms]
- Hosting in [hosting provider and region to confirm]
- Data encrypted in transit and at rest
- Secure connections to your EHR feeds
- Multi-factor sign-in [confirm availability]
- Regular backups [confirm frequency]
- Your data returned if you leave [confirm format]
- [SOC 2 status to confirm]
AI and your data
AI works under the same protections
BillCycle’s AI features run inside the platform under the same HIPAA controls, access rules and audit trail as the rest of your billing data. AI suggests. People approve.
Same access rules
AI suggestions only appear to users who are allowed to see that claim.
Data use
[Confirm AI data use policy: whether and how practice data is used to improve models.]
FAQ
Security questions practices ask
Will you sign a Business Associate Agreement?
[Confirm before launch.] As a vendor handling PHI on your behalf, BillCycle is a business associate under HIPAA.
Is BillCycle SOC 2 certified?
[SOC 2 status to confirm.] We can share our current security documentation on request.
Who at BillCycle can see our data?
Only staff who need access to support your account, under the same role-based controls and audit logging. [Confirm support access policy.]
How is data moved from our EHR to BillCycle?
Over encrypted connections, whether the feed is an API, HL7 interface or file transfer.
What happens to our data if we stop using BillCycle?
You can export your data. [Confirm export format, retention period and deletion process.]
Can we get documentation for our compliance review?
Yes. Request our security overview and we will send it along with answers to your questionnaire.
Bring your security questions to the demo
Invite your compliance lead. We will walk through access controls, the audit trail and how your data moves, and answer your security questionnaire.