HIPAA Compliance

Last updated: October 12, 2026

Protecting Protected Health Information

PortMedica understands the importance of protecting the privacy, confidentiality, and security of healthcare information.

As a provider of medical billing, revenue cycle management, credentialing, enrollment, and related healthcare administrative services, PortMedica may handle Protected Health Information (“PHI”) on behalf of healthcare providers and other organizations subject to the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”).

Where applicable, PortMedica operates in accordance with the HIPAA requirements that apply to its role and responsibilities.

1. Business Associate Relationship

Certain medical billing and administrative services involving PHI may constitute Business Associate functions under HIPAA.

Where PortMedica acts as a Business Associate for a covered entity, PortMedica's use and disclosure of PHI is governed by applicable HIPAA requirements and the terms of the applicable Business Associate Agreement (“BAA”).

PortMedica uses PHI only as permitted by applicable agreements and law and limits access to authorized personnel and purposes.

2. Administrative Safeguards

PortMedica maintains policies and procedures designed to protect PHI and electronic PHI (“ePHI”).

Depending on the nature and scope of the services provided, these safeguards may include:

• Workforce privacy and security policies
• Appropriate workforce access controls
• Security awareness and training
• Information access management
• Security incident procedures
• Contingency and business continuity procedures
• Risk assessment and risk management practices
• Policies governing the appropriate use and disclosure of PHI
• Periodic review and updating of security practices

3. Physical Safeguards

PortMedica takes reasonable measures to protect physical systems, devices, workstations, and facilities that may be used to access or maintain ePHI.

These measures may include:

• Physical access controls
• Workstation security
• Device and media controls
• Appropriate disposal procedures
• Restrictions on unauthorized physical access
• Protection of equipment and systems used to process sensitive information

4. Technical Safeguards

PortMedica implements reasonable technical safeguards appropriate to the systems and information involved.

Depending on the applicable environment, safeguards may include:

• User authentication
• Role-based access controls
• Unique user credentials
• Access restrictions
• Audit and activity monitoring
• Data integrity protections
• Secure transmission methods
• Password and authentication controls
• Security monitoring
• Backup and recovery procedures

These safeguards are intended to help protect ePHI against unauthorized access, use, alteration, disclosure, or destruction.

5. Minimum Necessary Access

PortMedica follows the principle of limiting access to PHI and ePHI to authorized individuals and systems as appropriate for the services being performed.

Access may be restricted based on job responsibilities, business requirements, contractual obligations, and applicable legal requirements.

6. Business Associate Agreements

When required by HIPAA, PortMedica enters into Business Associate Agreements with applicable covered entities.

BAAs establish the permitted uses and disclosures of PHI and the obligations of the parties relating to the protection of PHI.

Where applicable, PortMedica also evaluates the HIPAA obligations associated with subcontractors or service providers that may handle PHI on its behalf.

7. Security and Risk Management

PortMedica recognizes that healthcare information security requires ongoing assessment and improvement.

Security practices may be reviewed and updated as appropriate based on:

• Changes in technology
• Changes in services
• Changes in regulatory requirements
• Identified security risks
• Security incidents
• Business and operational requirements

PortMedica takes reasonable steps to identify and address risks to the confidentiality, integrity, and availability of ePHI.

8. Security Incidents and Breaches

PortMedica maintains procedures for identifying, responding to, investigating, and addressing suspected security incidents involving PHI or ePHI.

Where a reportable breach occurs, PortMedica will follow applicable contractual and legal requirements, including applicable HIPAA breach notification requirements.

9. PHI and Website Forms

The PortMedica Website is not intended for the submission of Protected Health Information through general contact, consultation, quote, or inquiry forms.

Please do not submit:

• Patient names
• Medical records
• Diagnoses
• Treatment information
• Insurance information
• Social Security numbers
• Patient identification numbers
• Claims containing patient information
• Clinical notes
• Other PHI

through ordinary Website forms or general email unless PortMedica has specifically instructed you to use an authorized and appropriately secured communication method.

If you are an existing PortMedica client and need to transmit PHI, please use the secure communication method provided by PortMedica.

10. PHI Is Governed by Applicable Agreements

Information relating to PHI that PortMedica handles in connection with client services is governed by the applicable service agreement, Business Associate Agreement, HIPAA requirements, and other applicable federal and state laws.

This Website HIPAA Compliance page is informational and does not replace, amend, or supersede any executed agreement.

11. No Guarantee of Absolute Security

PortMedica takes reasonable measures designed to protect information, but no electronic system, network, transmission, or storage environment can be guaranteed to be completely secure.

Accordingly, PortMedica cannot guarantee that unauthorized access, security incidents, or other cybersecurity events will never occur.

12. HIPAA Compliance Is an Ongoing Responsibility

HIPAA compliance involves ongoing administrative, physical, and technical safeguards, policies, training, risk management, and appropriate contractual arrangements.

PortMedica periodically evaluates its security and privacy practices and may update its procedures as its services, technology, risks, and applicable legal requirements change.

13. Questions About HIPAA

If you have questions regarding PortMedica's handling of PHI or its HIPAA-related practices, please contact:

PortMedica
5900 Balcones Drive, STE 100
Austin, TX 78731
United States

Phone: +1 (512) 678-3807
Email: contact@portmedica.com
Website: portmedica.com