Website Privacy Policy & Data Governance
RMI BPO LLC d/b/a MediNexus Billing is committed to transparent data stewardship, safeguarding practice communications, and upholding strict distinctions between website consumer information and federal HIPAA Protected Health Information (PHI).
MediNexus Privacy Policy v4.2
1. Corporate Scope & Legal Entity Identification
This Privacy Policy applies to personal information collected and processed by RMI BPO LLC d/b/a MediNexus Billing ("MediNexus Billing," "we," "our," or "us") through our primary website located at www.medinexusbilling.com, associated subdomains, digital intake forms, practice audit calculators, client consultation scheduling portals, and official administrative email communications.
This policy outlines the protocols under which MediNexus processes information about individual healthcare providers, practice administrators, clinical executives, billing managers, and prospective clients navigating our public web properties. It does not replace or supersede the terms of executed client Master Services Agreements (MSAs) or federally mandated Business Associate Agreements (BAAs).
2. Notice at Collection: Categories of Personal Information Collected
In the past 12 months, MediNexus Billing has collected the following categories of personal information from individuals interacting with our website:
| Category | Specific Data Elements | Source of Collection |
|---|---|---|
| Identifiers | Full name, professional email address, telephone number, job title, and professional credentials (e.g., MD, DO, CPC, Practice Administrator). | Directly provided via web contact forms, audit intake tools, or phone consultations. |
| Commercial Practice Data | Legal practice name, clinical specialty, number of rendering providers, active EHR/EMR platforms, clearinghouse selections, and approximate monthly billing volume. | Free Practice Audit forms and discovery questionnaire submissions. |
| Internet & Network Activity | IP addresses (anonymized at ingestion), browser version, operating system, referrer URL, pages visited, time spent per route, and interaction timestamps. | Automated web server logs and privacy-preserving technical analytics. |
| Geolocation Data | Coarse geographic city and state derived from IP network routing information. Exact GPS coordinates are never requested or stored. | Automated network communication packets. |
| Sensitive Personal Information | None collected through public web intake. We do not collect Social Security numbers, driver's license numbers, or consumer financial accounts via this website. | N/A (Excluded from public web collection). |
3. Automated Telemetry & Log Data Collection
When you visit www.medinexusbilling.com, our enterprise edge cloud infrastructure automatically logs standard web server transactions. These records include your internet protocol (IP) address, user-agent string, HTTP request headers, time and duration of visit, and referring HTTP referrer.
We utilize server-side log telemetry exclusively to:
- Detect, prevent, and mitigate distributed denial-of-service (DDoS) attacks, brute-force attempts, and automated credential stuffing.
- Verify compliance with our TLS cryptographic standards and browser interoperability.
- Diagnose web application performance anomalies and latency bottlenecks across distributed cloud points of presence.
- Maintain audit trails necessary to demonstrate compliance with healthcare cybersecurity controls.
4. Strict Demarcation: Website Personal Data vs. Protected Health Information (PHI)
This public website is designed strictly as an informational and commercial business-to-business (B2B) interface for healthcare providers and clinical administrators. Under no circumstances should patients or healthcare providers submit unencrypted patient records, diagnostic notes, social security numbers, or medical charts through general website contact or consultation forms.
All patient-identifiable healthcare data, clinical encounters, CMS-1500 claim data, UB-04 institutional records, and electronic remittance advices (835 ERA) handled during commercial engagements are classified as Protected Health Information (PHI) under the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and the Health Information Technology for Economic and Clinical Health Act (HITECH).
All such data is processed strictly within dedicated, SOC 2 Type II certified, encrypted clinical transmission pipelines governed by bilateral Business Associate Agreements (BAAs), completely isolated from public web infrastructure. For detailed technical and administrative safeguards governing ePHI, please review our HIPAA Compliance Statement.
5. Commercial & Operational Processing Purposes
MediNexus Billing processes prospective client personal information under the following lawful business bases:
Audit Delivery & Consultation
Calculating clinical coding benchmarks, projected denial reduction rates, and presenting tailored revenue cycle optimization models requested by medical practice leaders.
Contractual Execution & Credentialing
Drafting Master Services Agreements, initiating Business Associate Agreements, and establishing secure electronic clearinghouse credentials on behalf of client practices.
Security & Threat Defense
Monitoring endpoint telemetry, blocking malicious IP clusters, preventing unauthorized penetration attempts, and preserving cryptographic verification audit trails.
Regulatory & Statutory Compliance
Demonstrating adherence to state consumer privacy statutes, federal healthcare fraud prevention rules, and preserving corporate legal accounting records.
6. Compliance with HHS OCR Healthcare Tracking Technologies Guidance
In December 2022 and updated in March 2024, the U.S. Department of Health and Human Services (HHS) Office for Civil Rights (OCR) issued formal enforcement guidance regarding the use of online tracking technologies by HIPAA covered entities and business associates.
MediNexus Billing maintains strict compliance with HHS OCR tracking guidance across all digital properties:
- No Third-Party Advertising Pixels on Protected Endpoints: We strictly prohibit third-party social media tracking pixels (e.g., Meta Pixel, TikTok Pixel, or consumer ad retargeting tags) across our website, contact forms, and client portal interfaces.
- No Disclosures of IP + Health Inquiries: In strict alignment with OCR enforcement principles, we do not permit any technology partner to combine user IP addresses or browser fingerprints with medical specialty searches or clinical billing inquiries.
- Privacy-First First-Party Telemetry: All website analytics are restricted to first-party, anonymized technical telemetry configured to scrub query strings and obscure IP octets prior to persistent storage.
7. Information Sharing & Downstream Disclosures
MediNexus Billing does not sell, rent, lease, trade, or monetize personal information or practice profile metrics to any commercial third party. We share information only under strictly delineated conditions:
Vetted Infrastructure Service Providers
We engage certified third-party vendors for enterprise cloud hosting (e.g., AWS GovCloud/SOC 2 certified hosts), edge routing and DDoS mitigation, secure transactional email delivery, and customer relationship management (CRM). All vendors are bound by strict non-disclosure obligations and contractual data processing agreements.
Accredited Healthcare Clearinghouses
During active client engagements, transaction batches and electronic claims are transmitted exclusively to accredited clearinghouses (e.g., Change Healthcare, Waystar, Availity) under executed Business Associate Agreements and EDI trading partner agreements.
Legal & Regulatory Compulsion
We may disclose information if required to do so by applicable federal or state law, valid subpoena, court order, or official inquiry from the Centers for Medicare & Medicaid Services (CMS) or HHS Office for Civil Rights.
8. Data Retention & Cryptographic Destruction Standards
MediNexus Billing retains collected personal information only for the duration necessary to satisfy the commercial purposes for which it was obtained, or as mandated by federal and state regulatory retention statutes:
- Prospective Practice Inquiries: Contact information and Free Practice Audit submissions from prospective clients who do not enter into a formal Master Services Agreement are retained for up to twenty-four (24) months to facilitate follow-up evaluations, after which records are cryptographically sanitized.
- Active Client Practice Records: Records generated during active client engagements are maintained for the duration of the agreement plus seven (7) years to comply with CMS financial audit standards and federal False Claims Act statutes of limitations.
- Web Server Telemetry Logs: Raw IP access and firewall telemetry logs are automatically purged or aggregated on a rolling ninety (90) day retention schedule.
- Destruction Methodology: Digital media sanitization adheres strictly to NIST Special Publication 800-88 Rev. 1 (Guidelines for Media Sanitization) cryptographic wipe and purge standards.
9. Information Security & Technical Safeguards
MediNexus Billing maintains enterprise-grade technical, physical, and administrative safeguards designed to protect personal data against accidental loss, unauthorized access, destruction, alteration, or unlawful disclosure:
All web sessions and form submissions are secured with 256-bit elliptic-curve TLS 1.3 encryption.
Persistent databases and server volumes utilize FIPS 140-2 validated AES-256 hardware encryption.
Mandatory hardware-backed multi-factor authentication and role-based least-privilege permissions.
10. California Privacy Rights (CCPA / CPRA Disclosures)
This section provides mandatory disclosures and describes the rights guaranteed to California residents under the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020 (collectively, "CCPA/CPRA").
Right to Know & Data Portability
You have the right to request that we disclose the categories of personal information collected, the sources of collection, the commercial purposes for collection, and the specific pieces of personal information collected about you in a readily portable format.
Right to Delete Personal Information
You have the right to request deletion of your personal information collected by MediNexus, subject to statutory exemptions (e.g., fulfilling contracts, detecting security incidents, or complying with legal obligations).
Right to Correct Inaccurate Information
You have the right to request that we rectify any inaccurate personal information maintained in our active administrative systems.
Opt-Out of Sale or Cross-Context Behavioral Advertising
MediNexus does not "sell" or "share" personal information as those terms are defined under California Civil Code § 1798.140. We do not engage in cross-context behavioral ad targeting.
Right to Non-Discrimination
We will not discriminate, deny services, charge differing fee schedules, or reduce service quality if you choose to exercise any privacy rights guaranteed under California law.
Statutory Carve-Out: Please note that patient health data covered by HIPAA or the California Confidentiality of Medical Information Act (CMIA) is statutory exempt from the CCPA/CPRA under Cal. Civ. Code § 1798.146(a).
11. Multi-State Consumer Privacy Disclosures
Residents of Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), Utah (UCPA), Texas (TDPSA), and other states with comprehensive consumer privacy statutes enjoy distinct statutory rights regarding their personal data:
- Right to Confirm & Access: Confirm whether MediNexus is processing your personal data and access such data.
- Right to Correct: Correct inaccuracies in personal data taking into account the nature of the data and purposes of processing.
- Right to Delete: Request erasure of personal data provided by or obtained about the consumer.
- Right to Opt-Out: Opt out of the processing of personal data for targeted advertising, the sale of personal data, or profiling in furtherance of automated decisions that produce legal or similarly significant effects.
- Right of Appeal: If we decline to take action on your consumer request, you may submit a formal appeal by writing to our Privacy Officer with the subject "Privacy Request Appeal." We will respond within 45 days (or the statutory period required by your state).
12. Global Privacy Control (GPC) & Do-Not-Track (DNT) Signals
Global Privacy Control (GPC) is a browser-level specification that allows consumers to signal their privacy preferences to websites automatically. MediNexus Billing recognizes and honors valid GPC opt-out signals delivered by compatible web browsers.
Because we do not engage in cross-context tracking, selling, or sharing of personal information, visiting our website with GPC enabled maintains your privacy by default. Furthermore, while the web industry has not formalized an authoritative universal standard for legacy "Do Not Track" (DNT) HTTP headers, our web architecture treats all visitors under strict non-tracking parameters.
13. Children's Online Privacy Protection Act (COPPA Notice)
www.medinexusbilling.com is an enterprise-oriented commercial website dedicated exclusively to healthcare practitioners, hospital executives, practice managers, and medical organizations. Our services and web interfaces are not directed to, marketed toward, or intended for individuals under eighteen (18) years of age.
We do not knowingly solicit or collect personal information from children under 13 in compliance with COPPA. If we become aware that personal information of a child under 13 has been submitted through our website without verified parental consent, we will take immediate steps to permanently expunge such records from our databases.
14. International Data Transfers & Sovereign US Processing
MediNexus Billing operates exclusively within the United States. Our web servers, databases, administrative facilities, and operational personnel are physically located within continental United States jurisdictions.
If you choose to access www.medinexusbilling.com from outside the United States, please be advised that any information you submit will be transferred to, processed, and stored within the United States, where privacy regulations may differ from those in your home jurisdiction. By using our website, you expressly acknowledge and consent to this transfer and processing within the United States.
15. Policy Modifications & Version History
MediNexus Billing reserves the right to amend or update this Privacy Policy periodically to reflect changes in our operational procedures, emerging technologies, or evolving legal and regulatory frameworks.
Whenever modifications are instituted, we will update the "Last Reviewed" date at the beginning of this policy and increment the internal version number. In the event of material modifications that significantly alter how we process previously collected personal information, we will provide prominent notice through an announcement on our website homepage or via direct email notification to registered practice contacts prior to implementation.
16. Privacy Officer & Contact Inquiries
To exercise your statutory privacy rights under the CCPA/CPRA or applicable state laws, or to submit questions, complaints, or feedback regarding our privacy practices, please contact our designated Privacy Office:
RMI BPO LLC d/b/a MediNexus Billing
Corporate Privacy & Data Protection Office
Verification Process: For your security, consumer requests to know, correct, or delete personal information will require identity verification matching your email and practice details before records can be released or modified. We respond to all verified consumer requests within forty-five (45) calendar days.