Privacy Policy

eBillRCM ("eBillRCM", "we", "us", or "our") delivers revenue cycle management to healthcare providers. This Privacy Policy describes how we gather, use, share, and protect information you supply through our website, our service offerings, related correspondence, and — when you choose to participate — SMS (Short Message Service) and MMS (Multimedia Messaging Service) communications.

We operate in accordance with the Health Insurance Portability and Accountability Act of 1996 (HIPAA), the Health Information Technology for Economic and Clinical Health Act (HITECH), and applicable U.S. state privacy statutes. When we process Protected Health Information (PHI) for a covered entity, we act as a Business Associate pursuant to an executed Business Associate Agreement (BAA).

Our text-messaging practices are designed to comply with the Telephone Consumer Protection Act (TCPA), CTIA messaging guidelines, and other applicable messaging rules. The sections below explain what we collect for SMS/MMS, how we use it, how you opt in and opt out, and how that information is protected.

Practice and contact details submitted through our forms (name, email, phone, practice name, NPI, EHR, monthly claim volume).

Protected Health Information (PHI) processed under a BAA solely to carry out billing, coding, claims, and related work on behalf of our covered-entity clients.

Website usage metrics such as pages visited, referrer, device type, and approximate location, gathered through privacy-conscious analytics. We do not sell this information.

Messages you send us (email, call notes, support tickets) so we can reply and strengthen service quality.

When you enroll in SMS/MMS communications: your name, mobile phone number, and any other details you choose to provide; the content of replies you send to our texts; and limited technical details such as device type, carrier information, and approximate location inferred from area code or IP address when needed for delivery or required by law.

To perform the services you or your practice has retained us for — including claim submission, denial management, payment posting, and reporting.

To contact you regarding your account, audits, regulatory developments, and service notices.

To enhance our offerings, educate staff (using de-identified data only), and uphold operational security.

To satisfy legal, regulatory, and contractual duties, including audit demands and lawful subpoenas.

If you have opted in to SMS/MMS: to send informational, transactional, or promotional texts related to our medical billing and revenue-cycle services; to answer questions and support requests; to improve the quality, security, and relevance of our communications; and to meet legal and regulatory requirements. Texts may include appointment or billing reminders, service updates, company announcements, marketing offers, or important account notices. Message content about patients will follow the HIPAA minimum-necessary standard and will not include clinical detail in SMS.

By giving us your mobile number and confirming that you want texts (for example through a website form, a written agreement, or an SMS keyword), you provide your express written consent to receive SMS and MMS messages from eBillRCM.

How often we text may vary. Message and data rates may apply based on your wireless plan.

We do not share the phone numbers we collect, or the SMS/MMS opt-in consent you provide, with third parties, affiliates, or partners. Your consent applies only to messages from eBillRCM and is not sold, transferred, or reused by any other brand or company.

You can leave the program at any time by replying STOP to any text we send. After you opt out, we will send one final confirmation that you have been removed from our SMS list. For assistance, reply HELP or contact us using the details in the "How to Reach Us" section below.

PHI is processed exclusively under the BAA executed with the covered entity. We use PHI only for treatment, payment, and healthcare operations as allowed by HIPAA and that BAA.

We do not use or disclose PHI for marketing, sale, or any purpose outside the contracted services.

PHI access is restricted to workforce members with a documented business need; each completes annual HIPAA training and executes a confidentiality agreement.

Administrative, physical, and technical controls operate under our SOC 2 Type II program. These encompass role-based access, multi-factor authentication, encryption in transit (TLS 1.2+) and at rest (AES-256), audit logging, intrusion detection, and continuous monitoring.

We apply appropriate administrative, technical, and physical safeguards to protect personal information used for SMS/MMS against unauthorized access, misuse, or disclosure. No electronic channel is perfectly secure, and we cannot promise absolute security of every transmission.

We commission annual third-party penetration tests and HIPAA risk assessments. Identified issues are remediated on a documented schedule.

If a breach involving unsecured PHI occurs, we will notify the affected covered entity within the periods mandated by HIPAA and HITECH, and fully assist with any required notifications.

With clearinghouses, payers, and other parties only as needed to deliver the services we are engaged to provide.

With subcontractors who have executed BAAs and comparable confidentiality commitments.

We do not share personal data (including phone numbers) or consumer opt-in consent with third parties, affiliates, or partners for marketing, promotional, lead-generation, or any other independent use. Consent granted to eBillRCM to send text messages is not transferable and may not be bought, sold, rented, or reused by another brand or company.

If messaging platforms or wireless carriers process phone numbers solely to deliver SMS/MMS that you opted in to receive from eBillRCM, they act only as transmission infrastructure under confidentiality and data-protection obligations. They are not granted rights to use your phone number or opt-in consent for their own marketing or other purposes.

No mobile information will be shared with third parties/affiliates for marketing/promotional purposes. All other categories exclude text messaging originator opt-in data and consent; this information will not be shared with any third parties.

When compelled by law, court order, or to answer lawful regulatory inquiries (for example, HHS Office for Civil Rights audits).

We never sell, rent, or trade personal information or PHI under any circumstances.

We retain PHI for the duration required by the BAA and applicable law (generally a minimum of 6 years from creation or last effective date, consistent with HIPAA §164.530(j)).

Marketing and lead-form information is kept only as long as needed to address your inquiry and for a reasonable follow-up window, after which it is deleted or anonymized.

Personal information tied to SMS/MMS is kept only as long as needed for the purposes described in this policy, or as required by law. When it is no longer needed, we securely delete or anonymize it.

Patients who wish to exercise HIPAA rights (access, amendment, accounting of disclosures, restrictions) should reach the covered entity (their provider) directly. We will assist the covered entity's response as required.

Individuals in California, Colorado, Virginia, Connecticut, Utah, Texas, and other states with applicable privacy laws may have rights to access, correct, or delete personal information we maintain about them — including information related to SMS/MMS enrollment. Use the contact details below to exercise these rights.

You may also request access to, correction of, or deletion of personal information tied to our texting program, subject to any legal or contractual duties that require us to keep certain records.

We will not retaliate against anyone for asserting a privacy right.

We rely on a limited set of strictly necessary cookies to run the website and optional analytics cookies to understand aggregate usage. We do not deploy cross-site advertising trackers.

You may manage cookies through your browser preferences. Turning off strictly necessary cookies may impair site functionality.

eBillRCM is based in the United States. All data is stored and processed in the U.S. Accessing our services from outside the U.S. constitutes consent to that transfer and processing.

Our offerings target healthcare practices, not children. We do not knowingly collect personal information directly from anyone under 13. PHI belonging to pediatric patients is handled solely under the BAA with the treating provider.

We may revise this policy from time to time to reflect changes in technology, law, or our practices. Material updates will appear here with a new "Last updated" date and, when appropriate, will be communicated in writing to active clients.

If we make significant changes that affect SMS/MMS, we may also notify enrolled recipients by text or another suitable method. Continuing to use our SMS/MMS program after those changes means you accept the updated policy.

For privacy questions, BAA requests, SMS/MMS questions, or to exercise privacy rights: info@ebillrcm.com

Email: info@ebillrcm.com

Mail: 12603 FM 529 Rd, Houston, TX 77041

Phone: (713) 732-0936

For texting help while enrolled, you can also reply HELP to any message from us.