HIPAA & SOC-2 Compliance Statement

Last Updated: May 2026

RevCycleGenius and our proprietary AI engine, RCG NexaCore, are committed to strict adherence to the Health Insurance Portability and Accountability Act (HIPAA) of 1996 and the HITECH Act. Headquartered in Dallas, Texas, our global infrastructure is built from the ground up to exceed US federal security and privacy standards.

1. Business Associate Agreement (BAA)

We operate as a fully compliant Business Associate. We execute a comprehensive Business Associate Agreement (BAA) with all Covered Entities and Agency Partners prior to the commencement of any workflows, legally binding us to the highest standards of Protected Health Information (PHI) protection.

2. Technical Safeguards & RCG NexaCore

SOC-2 Certified Architecture: All automated RCM processes and data extractions run through RCG NexaCore are handled within SOC-2 Type II certified environments.
Zero Local Data Storage: Patient data is processed directly within the Client's cloud or EHR environment. Absolutely no PHI is downloaded, cached, or stored on our local operational hard drives.
Secure Access: We utilize encrypted, enterprise-grade VPNs with strict IP whitelisting to access client systems securely.
AI Data Isolation: RCG NexaCore strictly utilizes localized rule-sets and does not use your PHI to train generalized or public AI/Machine Learning models. Your data remains strictly siloed.

3. Physical & Administrative Safeguards

Our secure operations center features biometric access control, restricted physical entry, and 24/7 surveillance. Clean-desk policies are strictly enforced on the production floor (no mobile phones, cameras, or unapproved recording devices). All team members undergo mandatory HIPAA training upon hiring, followed by rigorous annual audits and refresher courses.