Security & Compliance
HRI handles revenue-cycle information under written client agreements, plus a Business Associate Agreement whenever the work requires access to protected health information.
In short
Controls
around the
data.
PHI · ACCESS · TRANSFER
Defined by agreement, applied per engagement
First
BAA before any PHI is exchanged
Access
Handled only by named, accountable HRI principals
Boundary
PHI never through the public site
Controls
Client records are kept secure, and a Business Associate Agreement is in place before any PHI is exchanged. Controls are established during contracting and onboarding around the systems, work, and minimum information each engagement requires.
A written BAA defines permitted PHI use, security duties, incident and subcontractor obligations, and return-or-destruction terms before data is exchanged. For addiction-treatment programs, we also sign a 42 CFR Part 2 qualified service organization agreement before handling any records.
Individual named accounts identify every person who accesses systems used for client work.
Every user is required to register multifactor sign-in.
Permissions are limited to the information and actions each user is authorized to perform.
PHI moves only through approved secure transfer methods, never the public website or review form.
Client files are encrypted in storage and in transit.
Systems that support logging retain access and activity records appropriate to the work performed.
If we find a breach of client records, we tell the client in writing, as HIPAA's breach notification rule requires.
Retention periods and secure destruction of PHI are defined by agreement.
Important. This page summarizes HRI practices and is not a certification, legal opinion, or substitute for the executed service agreement and Business Associate Agreement. Specific systems, controls, and responsibilities are confirmed during contracting and onboarding.
Vetting us
Yes. The BAA is in place before any PHI is exchanged. It spells out permitted PHI use, security duties, incident and subcontractor obligations, and return-or-destruction terms. A written client agreement covers the engagement itself.
Only accountable HRI principals. PHI is not handled by an offshore team or rotating contractors. Everyone accessing systems used for client work does so under an individual named account, with permissions limited to the information and actions that person is authorized to perform.
Client files are encrypted in storage and in transit, and every user must register multifactor sign-in.
Through approved secure transfer methods established during contracting and onboarding, never through the public website or the review form.
It is returned or destroyed at the end of the engagement, with retention periods and secure destruction defined by agreement.
If we find a breach of your records, we tell you in writing, as HIPAA's breach notification rule requires. Incident obligations are also written into the BAA.
Ready to talk security before onboarding?
Tell us what your compliance team needs to see, and we'll share it under the appropriate agreement.
Last updated: October 25, 2026