Privacy Policy

Information We Collect

We collect the following types of information:

• Protected Health Information (PHI): Medical records, treatment information, insurance details, and prescription data processed on behalf of your healthcare provider
• Personal Information: Name, contact information, date of birth, Social Security Number (when required for billing)
• Account Information: Login credentials for authorized staff of our practice clients
• Usage Information: Pages visited on this website, features used within our platform

How We Use Your Information

We use your information for:

• Providing administrative services to your healthcare provider, including billing, scheduling, and operational support
• Processing insurance claims and verifying eligibility on behalf of your provider
• Communicating with practice clients about services and updates
• Complying with legal and regulatory requirements
• Improving the quality and reliability of our services

Information Sharing and Disclosure

We may share your information with:

• Healthcare Providers: Your provider and other providers involved in coordinating your care, as directed by your healthcare provider
• Insurance and Claims Processing: Insurance companies and clearinghouses for billing and claims processing
• Legal Authorities: When required by law or court order
• Service Providers: Companies that help us provide our services, all of whom are bound by agreements that protect your information

We will never sell your personal or health information to third parties.

Data Security

We maintain the administrative, physical, and technical safeguards HIPAA requires of a business associate, including:

• Two-step verification on all BCSS Google Workspace accounts
• An annual security risk analysis of our operations (first completed August 2026)
• Role-based access under a written access matrix
• A written data disposal policy based on NIST SP 800-88

Cookies and Analytics

This site uses essential cookies only. Our hosting provider sets one load-balancing cookie, and a session cookie is set when you submit the contact form. We do not use third-party tracking or advertising cookies. No analytics tools that collect personally identifiable information are used on this website.

Your HIPAA Rights

If your health information is processed through our services, you have rights under HIPAA. Because BCSS is a Business Associate, you should contact your healthcare provider directly to exercise these rights. Your provider is responsible for responding to your requests, and we will assist them as needed.

Your rights include the ability to:

• See and get copies of your health records
• Ask for corrections to your health information
• Ask for limits on how your information is used or shared
• Choose how your provider contacts you
• Get a list of who your information was shared with
• Get a paper copy of this privacy policy
• File a complaint with your provider, with us, or with the HHS Office for Civil Rights

For more detail, see our How We Protect Your Health Information page.

Data Retention

We retain different types of information for different periods:

• Health information: Minimum of 7 years after the last date of service, or as required by applicable state law, whichever is longer
• Minor patient records: Retained longer as required by the state in which services were provided (typically until the minor reaches the age of majority plus the standard retention period)
• Billing and financial records: Minimum of 7 years as required for tax and audit purposes

After the applicable retention period, records are securely destroyed using secure data disposal procedures.

State Privacy Laws

Health information governed by HIPAA is generally exempt from state consumer-privacy laws, and those laws apply to BCSS only where it meets their thresholds. If you are a resident of a state with a consumer-privacy law and want to access, correct, or delete the non-HIPAA personal information we hold about you, contact our Privacy Officer and we will honor the request.

Do Not Sell or Share My Personal Information

BCSS does not sell your personal information. We do not share your personal information for cross-context behavioral advertising purposes. We have not sold or shared personal information in the preceding 12 months.

Changes to This Policy

We may update this privacy policy from time to time. We will notify you of any material changes by posting the new policy on this page with a new effective date.

Last updated: October 18, 2026