Data Protection & Security
Effective Date: October 5, 2026
At RivoRev RCM, we consider the proper handling and protection of information entrusted to our organization to be one of our key responsibilities as a healthcare revenue cycle management service provider.
We recognize that medical billing and revenue cycle management may involve confidential business information and, where applicable, Protected Health Information (\”PHI\”).
Our data protection practices are intended to enable secure handling of information and to meet applicable contractual, legal, and regulatory requirements.
1. Scope
This Data Protection & Security Statement pertains to information handled by RivoRev RCM in relation to our website, business operations, and services.
Additional requirements may apply under individual agreements, Business Associate Agreements (\”BAAs\”), security requirements, or laws and regulations.
2. Protection of Healthcare Information
When performing services involving PHI on behalf of a covered entity or another business associate, we will handle such information in accordance with applicable contractual obligations and applicable HIPAA requirements.
Where required, a Business Associate Agreement will address the permitted uses and disclosures of PHI and responsibilities of each party.
RivoRev RCM will not use or disclose PHI, except to the extent permitted or required by the applicable agreement or applicable law.
3. Administrative Safeguards
Our data protection program may include administrative functions, including:
- Role-based access to information
- Confidentiality obligations for authorized persons
- Security and privacy awareness training
- Access management functions
- Policies on appropriate use of information
- Incident response procedures
- Data handling and retention procedures
- Vendor and service-provider oversight
- Periodic review of security practices
Access to sensitive information is limited to those requiring access for authorized business purposes.
4. Technical Safeguards
Depending on the system and information involved, technical safeguards may include:
- User authentication
- Role-based access controls
- Password and credential management
- Encryption where appropriate
- Secure data transmission
- Endpoint protection
- System monitoring and logging
- Backup and recovery procedures
- Security updates and vulnerability management
The particular safeguards applicable to a client environment may be defined through contractual and technical requirements.
5. Physical Safeguards
Where applicable, physical safeguards may include:
- Controlled access to work areas
- Secure handling of physical records
- Device and equipment security
- Restrictions on unauthorized access
- Secure disposal of information and media
6. Minimum Necessary Access
RivoRev RCM adheres to a need-to-know and minimum-necessity approach when handling sensitive information under applicable law and contractual requirements.
Persons are given access to only the systems and information necessary to perform their assigned duties.
7. Workforce Confidentiality
Employees who have access to confidential or sensitive information are expected to maintain confidentiality and follow applicable company security and privacy policies.
Access may be restricted or revoked when persons no longer require access or when employment or contractual duties cease.
8. Secure Transmission
Sensitive information should be transmitted only through approved and properly secured channels.
Clients and prospects should not send PHI through ordinary website forms or unsecured email, unless RivoRev RCM has instructed them to use that method and appropriate safeguards are in place.
For client engagements involving PHI, RivoRev RCM will work with the client to establish appropriate methods for secure data exchange.
9. Data Storage and Retention
RivoRev RCM maintains data retention and disposal practices that prevent unauthorized access to information that is no longer needed.
Information may be retained when necessary for:
- Contractual obligations
- Legal or regulatory requirements
- Client requirements
- Accounting and financial records
- Security and audit purposes
- Business continuity
Information subject to a client agreement or BAA will be handled in accordance with the applicable requirements.
10. Incident Response
RivoRev RCM maintains procedures to help identify, assess, respond to, and document suspected security incidents.
If an incident involves information subject to a contractual or legal breach-notification requirement, RivoRev RCM will follow the applicable notification procedures and contractual requirements.
For HIPAA-regulated information, applicable HIPAA Breach Notification requirements and the relevant Business Associate Agreement will govern the response.
11. Business Associate Responsibilities
Where RivoRev RCM qualifies as a HIPAA Business Associate, we recognize that applicable HIPAA requirements can impose direct obligations on business associates.
Our responsibilities may include appropriate safeguards for PHI, appropriate use and disclosure restrictions, cooperation with applicable client obligations, and reporting of qualifying incidents or breaches as required by law and contract.
12. Subcontractors and Third-Party Providers
RivoRev RCM may use third-party technology providers, contractors, or subcontractors to support business operations.
Where a subcontractor will create, receive, maintain, or transmit PHI on behalf of RivoRev RCM, applicable contractual and HIPAA requirements will be considered and appropriate agreements implemented where required.
13. Employee and Contractor Access
Access to sensitive information is limited based on the responsibilities of employees or contractors.
When access is no longer needed, appropriate access termination procedure is followed.
14. Business Continuity and Backup
Where appropriate, RivoRev RCM maintains backup and recovery processes that support the availability and restoration of critical business information.
The specific recovery procedures applicable to the client’s systems may vary based on the technology platform and contractual arrangement.
15. Security Reviews
RivoRev RCM may periodically review our administrative, technical, and physical safeguards to identify opportunities for improvement.
Security measures may be updated as technology, risks, client requirements, and legal requirements evolve.
16. Client Responsibilities
Data security is a shared responsibility.
Clients are responsible for maintaining appropriate security of their own systems, user credentials, devices, applications, and information prior to and after transferring information to or receiving information from RivoRev RCM.
Clients should promptly notify RivoRev RCM of any suspected unauthorized access, security incidents, or other concerns regarding information provided to RivoRev RCM.
17. Contact
Questions regarding data protection or information security may be directed to:
RivoRev RCM
Email: info@rivorevrcm.com
Website: www.rivorevrcm.com
Important Notice: This Data Protection & Security Statement describes RivoRev RCM’s intended security framework and should be customized to reflect the controls, systems, vendors, certifications, policies, and procedures that RivoRev RCM maintains. It should not be interpreted as a representation that RivoRev RCM has gained a particular security certification or compliance attestation unless separately stated and supported.