HIPAA Notice of Privacy Practices

What Is RevalonMD’s HIPAA Notice of Privacy Practices?

RevalonMD LLC is a HIPAA business associate that handles medical billing, coding, and credentialing Protected Health Information (PHI) on behalf of covered-entity healthcare providers. This notice, issued under 45 CFR 164.520 (HIPAA Privacy Rule), describes how RevalonMD receives, uses, protects, and discloses that information and outlines your rights.

Under 45 CFR 164.520, covered entities — and, as a trust commitment, business associates like RevalonMD — must provide individuals with a clear description of their privacy practices. Although business associates are not required by regulation to issue their own Notice of Privacy Practices (NPP), RevalonMD publishes this notice voluntarily as a transparency commitment to every provider client and the patients whose PHI we handle.

The required NPP header, per 45 CFR 164.520(b)(1)(i): “This notice describes how medical information about you may be used and disclosed and how you can get access to this information. Please review it carefully.”

How RevalonMD Receives and Uses Protected Health Information

RevalonMD receives PHI exclusively from covered-entity clients under a signed Business Associate Agreement (BAA). PHI is limited to the minimum necessary for billing, coding, and credentialing — diagnosis codes, procedure codes, patient demographics, and insurance information — as required by the minimum necessary standard under 45 CFR 164.502(b).

Table 1 — PHI Uses and Disclosures

Permitted Disclosures of PHI Under HIPAA

RevalonMD discloses PHI only for the purposes permitted or required under the HIPAA Privacy Rule (45 CFR Parts 160 and 164) and as authorized by the covered entity’s BAA. No PHI is sold, shared for marketing, or disclosed to any party not covered by an executed BAA.

Permitted disclosures include, but are not limited to:

• To payers and insurance carriers — for claim submission, adjudication, and payment (45 CFR 164.502(a)(1)(ii)).
• To clearinghouses — for electronic claim transmission under a separate BAA (45 CFR 164.504(e)).
• To subcontractors acting as business associates— under executed BAA agreements, limited to services required by RevalonMD’s operations (45 CFR 164.504(e)(2)).
• As required by law — including court orders, subpoenas, public health authority requests, and law-enforcement requests within the limits of 45 CFR 164.512.
• For breach notification — to HHS and to affected individuals and covered entities within 60 days of discovery (45 CFR 164.412).
• To the covered entity — RevalonMD returns or securely destroys all PHI upon BAA termination, or extends protections if return or destruction is infeasible (45 CFR 164.504(e)(2)(ii)(J)).

Your Rights as a Patient Under HIPAA

Under HIPAA, patients retain all six privacy rights whether billing is handled in-house or by an outsourced business associate like RevalonMD: the right to access records, request amendments, receive an accounting of disclosures, request restrictions, request confidential communications, and receive a paper copy of this notice.

These rights are governed by the HIPAA Privacy Rule (45 CFR 164 Subpart E) and are exercised through your healthcare provider — the covered entity. RevalonMD, as a business associate, supports your provider in fulfilling these requests.

Table 2 — Patient Rights Under HIPAA

How RevalonMD Protects Your PHI (Security Safeguards)

RevalonMD implements HIPAA-required administrative, physical, and technical safeguards under the HIPAA Security Rule (45 CFR 164.300–318) to protect electronic Protected Health Information (ePHI) from unauthorized access, use, or disclosure. These safeguards are reviewed and updated annually.

Table 3 — RevalonMD HIPAA Security Safeguards

RevalonMD’s Business Associate Agreement and Your Provider’s Responsibility

Yes. RevalonMD signs a Business Associate Agreement (BAA) with every covered-entity client before any PHI is exchanged, as required under 45 CFR 164.504(e). No PHI is accessed, processed, or transmitted without an executed BAA in place.

The BAA defines RevalonMD’s obligations as a business associate: using PHI only as permitted, implementing the required safeguards, reporting breaches, ensuring subcontractors comply, and returning or destroying PHI at contract termination. Your healthcare provider (the covered entity) remains responsible for issuing their own Notice of Privacy Practices to patients and for directing RevalonMD’s permissible uses of PHI.

RevalonMD integrates with all major EHR platforms and practice management systems — including Epic, athenahealth, eClinicalWorks, Kareo, DrChrono, and others — without requiring covered-entity clients to replace or change their existing technology stack. Our billing workflow adapts to the provider’s EHR; PHI data flows use the BAA-approved channels regardless of platform, ensuring the minimum-necessary standard and BAA obligations are maintained across every system integration.

2026 Update: Substance Use Disorder PHI Protections

Effective February 16, 2026, the HIPAA Privacy Rule was updated to align with 42 CFR Part 2 (SUD Record Confidentiality). Covered entities and their business associates must update their NPP to address new Substance Use Disorder (SUD) PHI protections. RevalonMD’s notice and internal procedures reflect this update.

The 42 CFR Part 2 alignment — finalized by HHS OCR and effective February 16, 2026 — strengthens protections for SUD treatment records held by programs regulated under Part 2. Key changes that affect billing operations:

• Consent-based disclosure: SUD PHI from Part 2 programs may be disclosed for payment and health care operations only with patient consent, except in specific limited circumstances (e.g., medical emergency, audit, evaluation under 42 CFR Part 2.53).
• NPP update required: Covered entities serving patients with SUD diagnoses must update their NPP by February 16, 2026, to disclose the new consent requirements. RevalonMD notifies client practices of this obligation.
• Billing-BA obligations: RevalonMD applies Part 2-compliant handling to any SUD PHI received from Part 2-regulated programs — including restricting re-disclosure and honoring consent limitations in the billing workflow.

How to File a HIPAA Privacy Complaint

Complaints regarding RevalonMD’s privacy practices may be filed with RevalonMD’s Privacy Officer or directly with the HHS Office for Civil Rights (OCR). No retaliation will occur against any individual for filing a good-faith complaint.

File with RevalonMD’s Privacy Officer:

File with HHS Office for Civil Rights: Complaints may be submitted to HHS OCR at hhs.gov/hipaa/filing-a-complaint or by calling 1-800-368-1019 (TTY: 1-800-537-7697). OCR may investigate complaints and impose civil monetary penalties up to $71,162 per violation (adjusted annually for inflation; source: HHS OCR Enforcement, current 2026).

Effective Date, Review Cadence, and Contact Information

Effective date: 2026-06-10. This notice is effective for all PHI RevalonMD receives, uses, or discloses on or after this date under any Business Associate Agreement with a covered entity.

Review cadence:RevalonMD reviews this notice annually per HIPAA’s requirement to promptly update the NPP when material changes occur (45 CFR 164.520(b)(3)). Mandatory review triggers include any material change to RevalonMD’s privacy practices, any update to the HIPAA Privacy Rule or OCR guidance, and any regulatory change affecting PHI handling in the medical billing context — including 42 CFR Part 2 updates. The HIPAA compliance in medical billing guide addresses the broader compliance framework.

Last reviewed: June 2026 by RevalonMD Compliance & HIPAA Office (CHC, CHPC). Reviewed by RevalonMD Leadership & Editorial Review.

Contact for questions:Direct questions about this notice to RevalonMD’s Privacy Officer at support@revalonmd.com or via revalonmd.com/contact. Do not submit PHI through email or the contact form — those channels are for practice profile and general inquiries only.

Related: RevalonMD’s compliance and security program · Business Associate Agreement · HIPAA compliance in medical billing · Privacy Policy · Billing & Coding Disclaimer · Contact RevalonMD