Privacy Policy

Our Commitment to Privacy

Rapid Auth Solutions (“we,” “our,” or “us”) is committed to protecting the privacy and security of all information we handle — including Protected Health Information (PHI), business information provided by our clients, and data collected through our website at rapidauthsolutions.com.

This Privacy Policy explains what information we collect, how we use it, with whom we share it, and the steps we take to keep it secure. By using our services or website, you agree to the practices described in this Policy.

Information We Collect

Information You Provide Directly

• Practice name, contact name, email address, and phone number provided when you contact us or sign up for services
• EMR access credentials and system information shared for the purpose of performing authorization services
• Business information including billing details, tax identification numbers, and service agreements
• Communications including emails, messages, and feedback you send to our team

Protected Health Information (PHI)

In the course of providing prior authorization services, we access and process Protected Health Information on behalf of our client healthcare providers. This includes:

• Patient demographics, diagnosis codes, and medical history required for authorization submissions
• Lab results, imaging reports, physician visit notes, and clinical documentation
• Insurance information, payer IDs, and prior authorization numbers
• Electronic Medical Record (EMR) data accessed through secure, HIPAA-compliant systems

Website Usage Information

• IP address, browser type, operating system, and device information
• Pages visited, time spent, and navigation patterns on our website
• Referral sources and search queries that led you to our site

How We Use Your Information

We use the information we collect solely for the purpose of delivering and improving our prior authorization services. Specifically:

• To submit, track, follow up on, and appeal prior authorization requests on behalf of our clients
• To update Electronic Medical Records and Practice Management systems with authorization outcomes
• To communicate with payers, insurance companies, and relevant parties in the authorization process
• To coordinate peer-to-peer review calls and provide additional clinical information as required
• To send service updates, renewal alerts, and account-related notifications to our clients
• To improve our internal processes and ensure quality in our authorization workflows
• To comply with applicable laws, regulations, and contractual obligations

HIPAA Compliance & Protected Health Information

As a Business Associate under the Health Insurance Portability and Accountability Act (HIPAA), Rapid Auth Solutions is bound by strict rules governing the use and disclosure of Protected Health Information (PHI).

Our HIPAA Safeguards Include:

• Business Associate Agreements: We execute a BAA with every covered entity client before accessing any PHI
• US-Based Virtual Environment: All work is performed inside a HIPAA-compliant, US-based virtual workspace — PHI never leaves the secure environment
• Role-Based Access Controls: Strict access controls limit PHI exposure to only the team members who need it for the specific task
• No Local Storage: No PHI is ever downloaded or stored on local devices or personal systems
• Full Audit Logging: Every access event is logged, timestamped, and available for audit review
• Encryption: All PHI in transit and at rest is encrypted using industry-standard protocols
• Minimum Necessary Standard: We access and use only the minimum PHI required to complete the authorization task

In the event of a HIPAA breach or suspected breach, we will notify affected clients within the timeframes required by HIPAA regulations and assist in breach notification procedures as required by law.

When We Share Information

We do not share personal information or PHI except in the following limited circumstances:

• With Payers and Insurance Companies: We share clinical and patient information required for prior authorization submissions, as directed by our client healthcare providers
• With CoverMyMeds and Payer Portals: Information is submitted through authorized channels for the purpose of processing authorization requests
• With Your Authorization: We may share information in other ways if you provide explicit written consent
• Legal Requirements: If required by law, court order, or governmental authority, we may disclose information as legally compelled
• Business Transfers: In the event of a merger, acquisition, or asset sale, PHI handling obligations transfer to the successor entity under a new BAA

How We Protect Your Data

We implement administrative, physical, and technical safeguards designed to protect all information we handle against unauthorized access, disclosure, alteration, or destruction.

• End-to-end encryption for all data in transit (TLS 1.2 or higher)
• Encrypted storage for all PHI and sensitive business information at rest
• Multi-factor authentication required for all team member access to systems
• Regular security training and HIPAA compliance updates for all staff
• Access provisioning and de-provisioning processes for onboarding and offboarding
• Annual risk assessments and security audits aligned with HIPAA Security Rule requirements
• Incident response plan and breach notification procedures in place

While we take every reasonable precaution to protect your data, no method of transmission over the internet or electronic storage is 100% secure. We encourage clients to contact us immediately at hello@rapidauthsolutions.com if they suspect any unauthorized access.

How Long We Keep Your Data

We retain information only as long as necessary to fulfill the purposes for which it was collected, comply with legal obligations, and resolve any disputes.

• PHI and Clinical Records: Retained for the period required under HIPAA and applicable state law — typically a minimum of 6 years from the date of creation or the date it was last in effect
• Client Business Records: Retained for 7 years following the end of a client engagement
• Website Usage Data: Retained for up to 24 months, then anonymized or deleted
• Communications: Retained for the duration of the client relationship plus 3 years

Upon termination of a client relationship, we return or securely destroy all PHI in accordance with the terms of the Business Associate Agreement, applicable law, and the client’s written instructions.

Your Privacy Rights

Depending on your location and applicable law, you or your patients may have the following rights regarding personal information:

• Right to Access: Request a copy of the personal information we hold about you or your practice
• Right to Correction: Request correction of inaccurate or incomplete information
• Right to Deletion: Request deletion of personal information, subject to legal retention requirements
• Right to Restriction: Request that we restrict processing of your information in certain circumstances
• Right to Portability: Receive your data in a portable, machine-readable format
• HIPAA Patient Rights: As a Business Associate, we support covered entities in fulfilling patient rights under HIPAA, including rights to access and amend PHI

To exercise any of these rights, please contact us at hello@rapidauthsolutions.com. We will respond within 30 days.

Cookies & Tracking Technologies

Our website uses minimal cookies and tracking technologies necessary for basic functionality and analytics. We do not use cookies for advertising or cross-site tracking.

• Essential Cookies: Required for website functionality, including session management and security
• Analytics Cookies: Used to understand aggregate website traffic and improve user experience. No personally identifiable information is collected

You may disable cookies in your browser settings at any time. Disabling essential cookies may affect the functionality of certain website features. We do not respond to Do Not Track (DNT) signals at this time, as there is no industry-standard interpretation of DNT.

Third-Party Links & Services

Our website and services may reference or link to third-party platforms such as CoverMyMeds, payer portals, EMR providers, and other healthcare tools. These third parties operate under their own privacy policies, and we are not responsible for their data practices.

We encourage you to review the privacy policies of any third-party services you interact with in connection with our work on your behalf. When we access third-party systems on your behalf, we do so only as instructed and within the scope of our Business Associate Agreement.

Children’s Privacy

Our website and direct business services are not directed at individuals under the age of 18. We do not knowingly collect personal information from minors through our website.

In the context of clinical authorization services, we do process PHI related to minor patients as directed by and on behalf of our licensed healthcare provider clients. All such processing is governed by HIPAA and the terms of our Business Associate Agreements.

Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or operational improvements. When we make material changes, we will:

• Update the “Last Updated” date at the top of this page
• Notify active clients via email at the address on file
• Post a notice on our website for a period of 30 days following significant changes

Continued use of our services after changes are posted constitutes acceptance of the updated Policy. We encourage you to review this page periodically.

Questions About This Policy?

If you have any questions, concerns, or requests relating to this Privacy Policy or our data practices, please reach out to us directly. We are committed to addressing all privacy inquiries promptly and transparently.