HIPAA & SOC-2 Compliance Statement

Last Updated: May 2026

RevCycleGenius and our proprietary AI engine, RCG NexaCore, are committed to strict adherence to the Health Insurance Portability and Accountability Act (HIPAA) of 1996 and the HITECH Act. Headquartered in Dallas, Texas, our global infrastructure is built from the ground up to exceed US federal security and privacy standards.

1. Business Associate Agreement (BAA)

We operate as a fully compliant Business Associate. We execute a comprehensive Business Associate Agreement (BAA) with all Covered Entities and Agency Partners prior to the commencement of any workflows, legally binding us to the highest standards of Protected Health Information (PHI) protection.

2. Technical Safeguards & RCG NexaCore

SOC-2 Certified Architecture: All automated RCM processes and data extractions run through RCG NexaCore are handled within SOC-2 Type II certified environments.
Zero Local Data Storage: Patient data is processed directly within the Client's cloud or EHR environment. Absolutely no PHI is downloaded, cached, or stored on our local operational hard drives.
Secure Access: We utilize encrypted, enterprise-grade VPNs with strict IP whitelisting to access client systems securely.
Encrypted Communications (RCG Workspace): We do not rely on standard emails or unsecured third-party messaging apps for daily PHI exchange. All Client-to-SME communication, file sharing, and issue escalation are routed exclusively through our proprietary, 256-bit encrypted RCG Workspace Portal. This ensures a 100% compliant, auditable, and secure communication ecosystem.
AI Data Isolation: RCG NexaCore strictly utilizes localized rule-sets and does not use your PHI to train generalized or public AI/Machine Learning models. Your data remains strictly siloed.

3. Physical & Administrative Safeguards

Our secure operations center features biometric access control, restricted physical entry, and 24/7 surveillance. Clean-desk policies are strictly enforced on the production floor (no mobile phones, cameras, or unapproved recording devices). All team members undergo mandatory HIPAA training upon hiring, followed by rigorous annual audits and refresher courses.