How we protect practice and patient information
Practices trust us with their revenue and their patients’ information. This page lists the controls we have in place today. We only list what we do.
Already a client
Call (737) 600-8899 or (616) 797-9171, or email info@sfasolutions.net, Monday through Friday, 8:00 AM to 5:00 PM Central. For a same-day payer deadline, call instead of waiting on the form. Do not put patient names, dates of birth, member IDs, or claim numbers in this form or in email. After a signed BAA, the work is done inside your practice EHR or practice-management system. This public website is not a client login. Monthly reports are reviewed with the practice. Sample layouts are on the sample reports page, and the dashboard example is fictional. If you cannot get into your EHR, call and the team will say which login your practice uses. Fahad Balakh, Director of A/R, leads accounts-receivable work. Muhammad Ans Zahid, Director of Operations, Business Development, and Credentialing, leads credentialing. There is no separate upload portal on this site.
Business Associate Agreement
We sign a BAA with every client before we access any protected health information. It sets out how information is used, protected, returned or destroyed.
Workforce HIPAA training
Team members complete HIPAA privacy and security training.
Multi-factor authentication
Staff use multi-factor authentication on the systems they use for client work.
Encrypted devices
Staff computers used for client work are encrypted.
Annual risk assessment
We complete a HIPAA security risk assessment every year and act on what it finds.
Access you control
We work inside your EHR, PM system and clearinghouse with user accounts your practice creates. You can change or remove access at any time.
Minimum necessary use
Patient information is used only for the billing and revenue cycle work in our agreement and BAA.
No PHI through our website
Website forms collect practice contact details only. Visitors are asked not to send patient information.
Breach notification
We notify clients of breaches of unsecured PHI as required by HIPAA and the BAA.
Data retention
Retention and return or destruction of client data follow the BAA and our Privacy Policy.
We do not hold SOC 2, HITRUST or ISO 27001 certification and do not claim them. Specific obligations are set out in each client’s agreement and BAA. Security contact: info@sfasolutions.net.
Security and compliance questions
Do you sign a Business Associate Agreement?
Yes. We sign a BAA with every client before we access any protected health information.
Do your staff use MFA and encrypted devices?
Yes. Staff use multi-factor authentication on the systems used for client work, and their computers are encrypted.
Do you have SOC 2, HITRUST or ISO 27001?
No. We do not hold third-party security certifications, and we do not claim them. We complete an annual HIPAA security risk assessment and can walk you through our controls.
Do we need to give you our patient records to start?
No. No patient records are required to request an initial review. Patient information is accessed only after a BAA is signed.
Who do I contact with a security question?
Email info@sfasolutions.net or call (737) 600-8899. Mark the subject "Security" and we will route it to the right person.
Find out where your practice may be losing revenue
Request a free practice revenue audit. We review your billing and walk you through where revenue may be slipping. No commitment, and no patient records are required to request an initial review.