HIPAA Notice

Last updated: August 2026

Our Commitment

Xylo Med Solutions provides medical billing and revenue cycle management services that involve access to Protected Health Information (PHI) on behalf of client healthcare practices. We are committed to handling this information in alignment with the Health Insurance Portability and Accountability Act (HIPAA) and applicable state privacy laws.

Business Associate Relationship

When providing billing, claims recovery audit, or related services, Xylo Med Solutions acts as a Business Associate to client practices under a Business Associate Agreement (BAA), consistent with HIPAA requirements. This agreement governs how PHI may be used, disclosed, and protected in the course of our services.

Safeguards We Apply

• Role-based access controls limiting PHI access to staff who need it to perform billing functions
• Secure, encrypted transmission of claims and billing data where technically supported
• Audit trails for access to billing and claims systems
• Confidentiality and security training for staff handling PHI
• Defined incident response procedures in the event of a suspected data security issue

Minimum Necessary Standard

We limit our use and disclosure of PHI to the minimum necessary to perform billing, claims recovery, and related revenue cycle functions on behalf of client practices.

Patient Inquiries

If you are a patient of one of our client practices and have questions about how your billing information was handled, please contact your provider's office directly, as they maintain the primary relationship with you and the associated medical record.

Reporting a Concern

If you believe there has been an issue with how PHI was handled in connection with our services, please contact us at info@xylomedsolutions.com so we can investigate promptly.

This page is a general-purpose template describing our intended approach to HIPAA-aligned data handling and does not constitute legal advice or a substitute for a formal HIPAA compliance program. We recommend having this notice, along with your internal policies and Business Associate Agreements, reviewed by qualified legal counsel before publishing it live.