Martin Billing SolutionsBack to portal

Legal

Business Associate Agreement (BAA) Notice

Martin Billing Solutions (MBS) is BAA-ready for HIPAA-covered agencies. This notice summarizes how we operate as a Business Associate and how to execute a BAA with us.

Effective date: July 15, 2026

This page is maintained by Martin Billing Solutions and describes current practices for the MBS Client Success Portal. It is provided for transparency and should be reviewed by qualified counsel before use as a binding legal document.

1. Our Role

When your agency (a HIPAA-Covered Entity) uses the MBS Client Success Portal to process Protected Health Information (PHI), MBS acts as a HIPAA Business Associate under 45 C.F.R. Parts 160 and 164. A written Business Associate Agreement (BAA) is required before PHI is exchanged.

2. BAA-Ready Posture

  • MBS will sign a mutually acceptable BAA with any contracted agency that transmits PHI.
  • Our operational, administrative, and technical safeguards are designed to align with the HIPAA Security Rule.
  • Subprocessors that touch PHI are covered by downstream BAAs or equivalent contractual protections.

3. Permitted Uses and Disclosures

MBS uses and discloses PHI only as necessary to provide contracted revenue cycle, credentialing, compliance, and reporting services; as required by law; and as expressly permitted by the executed BAA.

4. Safeguards

  • Strict multi-tenant isolation enforced by database-level Row Level Security.
  • Role-based access with least-privilege defaults; invitation-only account provisioning.
  • Encryption of PHI in transit; encryption of PHI at rest at the storage layer.
  • Comprehensive audit logging of record access, changes, and downloads.
  • Session timeouts, password reset flows, and administrative user management controls.
  • Append-only financial ledger and soft-delete with audit-preserved Trash.
  • Regular security scans, RLS isolation testing, and production readiness checks.

5. Breach Notification

MBS will notify affected agencies of any discovered Breach of Unsecured PHI without unreasonable delay, and in any event within the timeframe specified in the executed BAA and applicable law.

6. Subcontractors

MBS engages a limited set of vetted subprocessors (for example, cloud hosting, database, email delivery, and error monitoring). Each subprocessor that may access PHI is bound by written agreements requiring safeguards materially equivalent to those in the BAA.

7. Access, Amendment, and Accounting

MBS will support your agency's HIPAA obligations related to individual rights of access (§ 164.524), amendment (§ 164.526), and accounting of disclosures (§ 164.528) using Portal features and, where necessary, direct assistance from MBS staff.

8. Return or Destruction of PHI

Upon termination of the underlying service agreement, MBS will return or destroy PHI in accordance with the BAA and applicable retention requirements. Where return or destruction is infeasible, MBS will extend BAA protections to such PHI and limit further uses and disclosures.

9. What This Notice Is Not

This page describes our posture and process. It is not a BAA and does not by itself create Business Associate obligations. A BAA takes effect only when executed in writing by both parties.

10. Request a BAA

Agency administrators may request the current MBS BAA template by contacting compliance@martinbillingsolutions.com. For security questions, contact security@martinbillingsolutions.com.