HIPAA Compliance

Sarva Health, Inc. operates as a Business Associate to Covered Entities — including physician practices, group practices, health systems, and medical billing companies — when we process, transmit, or store Protected Health Information on their behalf in the course of providing revenue cycle management services.

As a Business Associate, we are directly subject to the HIPAA Security Rule and the HIPAA Breach Notification Rule. We enter into a Business Associate Agreement (BAA) with every Covered Entity customer before any PHI is processed.

A fully executed BAA is a prerequisite to using Sarva Health's Services in connection with PHI. Our BAA:

• Defines the permitted and required uses and disclosures of PHI;
• Requires us to use appropriate safeguards to protect PHI;
• Obligates us to report breaches to you as required by law;
• Flows down BA obligations to any sub-processors we engage;
• Addresses the return or destruction of PHI upon termination.

To request a BAA or review our standard BAA template, contact compliance@sarvahealth.ai.

Our use of PHI is strictly limited to the purposes specified in each BAA — primarily the provision of RCM services to the Covered Entity. We do not:

• Sell PHI to any third party;
• Use PHI for marketing or advertising purposes;
• Disclose PHI beyond what is required to perform contracted services;
• Retain PHI beyond the period specified in the applicable BAA.

All workforce members who may encounter PHI in the course of their duties receive annual HIPAA Privacy Rule training.

In the event of a breach of unsecured PHI, Sarva Health, Inc. will:

• Conduct an immediate investigation to determine the scope and nature of the breach;
• Notify the affected Covered Entity without unreasonable delay and no later than 60 calendar days following discovery of the breach;
• Provide the information required under 45 CFR § 164.410, including a description of the PHI involved and steps individuals should take to protect themselves;
• Cooperate fully with the Covered Entity's breach notification obligations to individuals, HHS, and media (where applicable).

To report a suspected breach or security incident, contact us immediately at security@sarvahealth.ai.

Where we engage sub-processors (vendors) who may access PHI, we:

• Execute BAAs with each sub-processor before any PHI is shared;
• Conduct due diligence on their security and compliance posture;
• Maintain an up-to-date list of sub-processors available to customers upon request;
• Remain liable to Covered Entities for the acts and omissions of our sub-processors to the extent required by HIPAA.

Access to PHI is granted on a minimum necessary basis. Only workforce members whose job functions require access to PHI are granted such access, subject to:

• Role-based access controls enforced at the application and infrastructure level;
• Multi-factor authentication for all systems containing PHI;
• Mandatory HIPAA training upon hire and annually thereafter;
• Background checks for all employees with access to PHI;
• Immediate access revocation upon termination or role change.

For questions about our HIPAA compliance program, to request a BAA, or to report a suspected privacy or security incident: