Privacy Policy

In many engagements, clients are HIPAA Covered Entities (or their agents) and Recupera acts as a Business Associate, processing PHI only as permitted by client instructions and applicable agreements (including BAAs where required).

Notice of Privacy Practices: The HIPAA Privacy Rule does not require a Business Associate to create a Notice of Privacy Practices (NPP); Covered Entities provide the NPP to individuals.

As directed by clients, we may process:

• Claimant/patient identifiers (e.g., name, DOB, claim/case identifiers)
• Medical records and related clinical documentation
• Billing records and related documentation returned by custodians
• Authorizations and supporting documents used to request records
• Operational metadata (provider details, date ranges, request status)

We use PHI only to provide the Services requested by the client (record retrieval, quality checks, secure delivery, invoicing, and support).

• We do not use PHI for marketing or advertising.
• We do not sell PHI.

We process PHI only as necessary to perform the Services requested by our clients and as permitted by applicable agreements and law. Access to PHI is restricted to authorized personnel, and PHI is transmitted using secure methods intended to protect confidentiality and integrity. We do not use PHI for marketing and we do not sell PHI.

Recupera maintains a written information security program with administrative, technical, and physical safeguards designed to protect the confidentiality, integrity, and availability of information we process, including PHI where applicable.

Key elements of our program include policies and controls for access management, authentication, secure transmission and storage, monitoring and logging, workforce training, vendor risk management, and incident response.

HIPAA: When acting as a Business Associate, we process PHI only as permitted by applicable agreements and law, and we maintain safeguards consistent with our obligations as a Business Associate. HHS+1

SOC 2: Recupera undergoes SOC 2 examinations, which report on controls relevant to the AICPA Trust Services Criteria (Security, Availability, Processing Integrity, Confidentiality, and/or Privacy). SOC 2 reports are available to clients upon request (typically under NDA). AICPA & CIMA+1

No method of transmission over the Internet or electronic storage is 100% secure. However, we take reasonable measures intended to reduce risk and protect information.

PHI/case artifacts: Retained through the end of the calendar year in which litigation concludes, plus 3 years (unless client instructions or legal hold require otherwise).

Logs (summary):

• Portal audit logs: retained in-application for approximately 180 days (exported/preserved as needed)
• Security and operational logs: retained for 7 years (subject to technical limits)
• Physical security video: retained for ~90 days (exported/preserved if needed)

Data is securely disposed of at end of retention using methods appropriate to the system/media.

Questions about this statement or our privacy practices:

privacy@recuperars.com

If you are an individual (patient/claimant) with questions about records, please contact the organization that requested the records (your insurer, provider, TPA, or law firm). Recupera supports our clients in responding as appropriate.