Privacy Policy

Hypex is a denial-recovery service for healthcare revenue cycle teams. In the course of providing the Service we act as a Business Associate under HIPAA (45 CFR 160.103, 164.504(e)) on behalf of covered entities and their billing companies. This policy explains every category of data we handle, exactly how long each lives, the safeguards applied, and the rights you have. Where this policy and an executed BAA differ, the BAA controls for PHI.

To work a denied appeal, we receive PHI from the covered entity or its billing company. Depending on the intake channel this can include: patient name, date of birth, member ID, medical record number and, where clinical evidence must be retrieved from an EHR, the clinical notes themselves.

Lifecycle: raw PHI exists only inside an encrypted Redis vault with a hardcoded 24-hour time-to-live that self-destructs automatically; there is no manual override in the codebase. On successful processing the payload is purged immediately, typically within minutes of arrival. PHI has no write path to our PostgreSQL database, object storage, or any language model. We receive it, use it to complete the task, and destroy it.

De-identification. Before anything persists, identifiers are removed under the HIPAA Safe Harbor method (45 CFR 164.514(b)): structured identifier fields are never copied out of the vault, and free text is scrubbed by deterministic rules plus Microsoft Presidio NER, with the pipeline failing closed if the NER layer cannot load in production. De-identified records retain only: payer identifier, denial code (CARC/RARC), procedure code (CPT/HCPCS), diagnosis code (ICD-10), place of service, claim amounts, service dates, and an opaque claim token that cannot be reversed to a patient.

When you inquire, onboard, or correspond with us, we collect business contact information you provide directly: organization name, contact name, work email, optional phone number, and billing identifiers such as NPI or Tax ID. This is used to respond to you, operate the customer relationship, issue invoices, and provide support. It is not patient data and is deleted on request.

Like nearly all web services, we process IP addresses, user-agent strings, and request timestamps for security monitoring, rate limiting, abuse prevention, and audit logging. Console actions are recorded in a hash-chained, tamper-evident audit log whose integrity a background worker verifies continuously. The free audit tool runs your numbers without storing the input; the ROI calculator runs entirely in your browser.

• We do not store PHI in any persistent database, file store, or backup of one. There is no code path that does.
• We do not sell, rent, trade, or monetize your information or your patients' information. Ever.
• We do not use PHI for marketing, advertising, or product analytics beyond the contracted service.
• We do not train machine learning models on PHI. Language models receive only de-identified summaries, and only when you opt into that drafting mode.
• We do not re-identify de-identified data, and aggregate insights we derive cannot be traced to you or any patient.
• We do not send your data outside US-hosted infrastructure.

• Encryption: TLS 1.2+ for all transport; encryption at rest for the vault and durable stores.
• Access control: role-based access with least privilege; tenant isolation enforced at the query layer so no organization can read another's data.
• Integrity: append-only, hash-chained audit log verified continuously by a watchdog worker; verifiable via console and API.
• Boundary gates: layered de-identification plus independent PHI scanners at every write boundary (letters, logs, model inputs), fail-closed in production.
• Abuse controls: tiered rate limiting, brute-force protection, token revocation, and IP allowlists for machine ingest.
• Subcontractors: infrastructure providers operate under written agreements satisfying 45 CFR 164.308(b) and 164.504(e), including flow-down of HIPAA obligations.

Because Hypex receives and processes PHI on behalf of covered entities, a BAA is executed with each customer before any PHI is processed. Our BAA covers all eight required elements of 45 CFR 164.504(e): permitted uses and disclosures; safeguards; reporting of breaches and security incidents; subcontractor flow-downs; individual access; amendment; accounting of disclosures; and return-or-destruction at termination. Customers may alternatively provide their own BAA, which we review and sign.

If unsecured PHI is breached, Hypex notifies the affected covered entity without unreasonable delay and no later than 60 calendar days after discovery, per 45 CFR 164.410. Notification includes the nature of the incident, the categories of information involved, steps individuals should take, mitigation measures, and contact procedures. The architecture makes this scenario structurally unlikely: there is no durable store of PHI to breach.

We do not sell or rent information. We share data only:

• With infrastructure subprocessors (hosting, managed database, object storage) operating under written HIPAA-compliant agreements;
• With a payment processor, limited to business banking details, never patient data;
• As required by law or legal process, with notice to you where legally permitted;
• To protect the rights, property, or safety of Hypex, our customers, or others.

Business users may request access to, correction of, or deletion of their business contact information at any time by emailing us. Covered entities may exercise PHI-related rights (access, amendment, accounting of disclosures, return or destruction) through the mechanisms in the BAA. Because we rarely hold PHI longer than minutes, "deletion" requests concerning PHI are typically already satisfied by the time they are processed, and we will confirm that in writing.

We update this policy as the Service evolves; material changes are posted here with a new "last updated" date, and customers with engagements are notified by email at least 14 days before material changes take effect. The BAA cannot be modified by a policy update, only by written agreement.

Privacy questions, data requests, or reports of a concern: founder@hypexrcm.com. See also our Terms of Service and Security page.

This policy describes the Service as built and operated. It is not legal advice; each party should obtain its own counsel for compliance questions specific to its role (covered entity vs. business associate).