Compliance & security

How We Handle Protected Health Information

Before you let an outside team answer your phones or touch your billing, you deserve to know exactly how they treat patient data. Here is our answer, in plain language.

HIPAA-trained agents BAA available Role-based access & audit logs

First, the honest scope

SS Support Network is a business process outsourcing company, not a law firm or a certification body. There is no official "HIPAA certified" stamp any vendor can legitimately hold — so we don't claim one. What we can claim, and back up, is that every healthcare engagement runs on HIPAA-compliant processes: trained people, signed agreements, controlled access, and logged activity. If a prospective vendor tells you they're "HIPAA certified," ask them who issued the certificate.

What that looks like in practice

HIPAA-trained agents. Every agent completes HIPAA privacy and security training before joining a healthcare account, with refresher training thereafter — including the minimum-necessary rule for handling calls and records.
Business Associate Agreement. A BAA is available and expected on any engagement involving PHI. It's part of standard onboarding, not something you have to push for.
Role-based access. Agents get access only to the systems their role requires, under individual named credentials you control. Dispatchers don't see billing; billers don't see what they don't need.
Audit logging. Work happens inside your software, so every action is attributable to a named person and visible to you. We add our own QA reviews on top.
Secure connections. Access to your systems runs over secured, encrypted connections. Your data stays in your systems — we don't copy patient databases onto our own servers.
Offboarding discipline. When an agent rotates off your account, their credentials are removed the same day. Access reviews catch anything that lingers.

Why working inside your software matters

Most of our security posture comes from a structural decision: we work inside your platforms — dispatch software, billing system, phone system, broker portals — instead of pulling your data into ours. That means you keep ownership, you keep visibility of every trip and claim, and revoking access is as simple as disabling a login. It also means there's no second copy of your patient data sitting in a vendor's database waiting to become a problem.

Broker and payer expectations

Brokers like Modivcare, MTM, and Access2Care hold providers to documentation and privacy standards of their own, and our agents work with those requirements daily. We are an independent company and not affiliated with or endorsed by any broker or software vendor — we simply know their rules because we operate under them on behalf of clients every day.

This page describes our operating practices. It is not legal advice — for questions about your own obligations under HIPAA or state law, talk to a qualified healthcare attorney.

Straight answers

Compliance & security questions, answered

Yes. A BAA is available for every engagement that involves protected health information, and we treat signing it as a normal part of onboarding rather than a negotiation. It defines what we may do with PHI, how we safeguard it, and what happens if an incident is ever suspected.

No vendor is — there is no official government HIPAA certification, and we won't pretend otherwise. What actually matters is practice: agents trained on HIPAA before touching an account, a signed BAA, role-based access, audit trails, and a clear incident process. That is what we run and what we can show you.

Only the agents assigned to your account, and only the parts of your systems their role requires. Access is granted per person under your credentials and policies, removed when someone rotates off the account, and every login is attributable to a named individual — never a shared team account.

We work inside your existing software — dispatch platform, EHR, billing system, broker portals — over secured, credentialed connections. Your data stays in your systems, where you can see every action. We do not export patient databases to our own servers or keep copies of your records.

The agent escalates immediately to their supervisor and our compliance lead, access in question is contained, and you are notified promptly under the terms of the BAA with a written account of what happened and what we're doing about it. You will never learn about an issue from anyone but us.

No. HIPAA training, the BAA, access controls, and audit logging are how we deliver every healthcare engagement, not an add-on tier. Pricing is based on the coverage and roles you need — see the pricing page — and the compliance practices described here come standard with all of it.

Want to go deeper? Read our full HIPAA approach or call +1 (657) 777-0006 — 24/7.