Privacy & HIPAA Policy

1. Overview

Vanaa RCM provides real-time eligibility verification, benefits discovery, and claims infrastructure for healthcare providers, billing organizations, and their patients. This policy explains what information we collect through our platform, how it is used and protected, and the rights available to individuals whose information we process — including protected health information (PHI) covered under the Health Insurance Portability and Accountability Act (HIPAA).

2. Information We Collect

Depending on how you use the platform, we may collect:

• Account & provider information — organization name, NPI, user names, email addresses, and login credentials.
• Patient & eligibility data — subscriber name, date of birth, member ID, payer, and service type submitted as part of an X12 270/271 eligibility inquiry.
• Claims data — information required to prepare, submit, and track X12 837/277 claim transactions.
• Technical data — IP address, browser type, and usage logs collected automatically for security and platform performance.

3. HIPAA & Protected Health Information

Where Vanaa RCM processes PHI on behalf of a covered entity — such as a healthcare provider verifying a patient's coverage — we operate as a business associate under HIPAA. This means:

• PHI is used only to perform the eligibility verification, benefits discovery, or claims services requested by the covered entity.
• We maintain a Business Associate Agreement (BAA) with covered entities where required.
• Access to PHI is limited to personnel and systems that need it to deliver the service.
• PHI is never sold, and is not used for advertising or unrelated commercial purposes.

4. How We Use Data

Information collected through the platform is used to:

• Perform real-time eligibility checks and return structured X12 271 coverage, benefits, and patient responsibility data.
• Submit, track, and revise claims on behalf of the provider or billing organization.
• Maintain account access, security, and audit logs.
• Improve platform reliability, payer connectivity, and support response times.

5. Data Security

Vanaa RCM applies administrative, technical, and physical safeguards consistent with HIPAA's Security Rule, including:

• Encryption of data in transit and at rest.
• Role-based access controls and authenticated, logged access to PHI.
• Regular monitoring for unauthorized access or anomalous activity.
• Secure, standards-based transport for all eligibility and claims transactions.

6. Data Sharing & Business Associates

We share information only as needed to deliver the service:

• With payers and clearinghouses, to complete eligibility inquiries and claim submissions.
• With infrastructure and hosting subprocessors bound by confidentiality and data protection obligations.
• When required by law, regulation, or valid legal process.

We do not sell PHI or account data to third parties.

7. Your Rights

Depending on your relationship to a covered entity using our platform, you may have the right to request access to, correction of, or an accounting of disclosures of your PHI. Because Vanaa RCM typically processes PHI on behalf of a provider (the covered entity), these requests should generally be directed to that provider — we will support them in fulfilling it.

8. Data Retention

We retain eligibility and claims records for as long as needed to provide the service and to meet legal, regulatory, and contractual recordkeeping obligations, after which data is securely deleted or de-identified.

9. Changes to This Policy

We may update this policy as our platform, services, or applicable regulations evolve. Material changes will be reflected by updating the "Last updated" date above.

10. Contact Us

Questions about this policy, our HIPAA compliance practices, or a request related to your data can be directed to our team.