HCBS PRO LLC ("HCBS PRO," "we," "us," "our") supports home and community-basedservices providers with billing, revenue cycle management, compliance and the Gimbal Application. When you use our services, you trust us with your information, including health information that belongs to our clients' patients and participants. We take that responsibility seriously.
This Privacy Policy explains what information we collect, how we use and share it, how we protect it, and the choices and rights you have.
This policy applies to:
Health information is handled differently. When we process protected health information (PHI) for a healthcare provider, we act as that provider's HIPAA business associate. In that case, the Business Associate Agreement (BAA) with the provider and the HIPAA rules govern the PHI, and the provider's own Notice of Privacy Practices applies to patients. Section 4 explains this in more detail.
In this policy, "you" means visitors to our website, our clients and their authorized users, and anyone else who contacts us.
We collect only the information we need to provide our services, meet our contracts and legal duties, and keep our systems secure.
| Category | Examples | Where it comes from |
|---|---|---|
| Contact information | Name, work email, phone number, job title, organization name | You, your employer, website forms |
| Account information | Username, user ID, role, login and authentication details | You or your organization's administrator |
| Client service data | Claims, billing, authorization,credentialing and payer records our clients submit | Our clients and their payers |
| Protected health information | Patient or participant names, Medicaid IDs, dates of service, diagnosis and service codes | Our clients, under a BAA (see Section 4) |
| Communications | Support tickets, emails, call notes, chat and text messages | You |
| Technical information | IP address, browser type, device information, timestamps, server and security logs | Automatically, when you use our website or Gimbal |
How we collect it
When we process PHI for a healthcare provider, we act as that provider's business associate under the Health Insurance Portability and Accountability Act (HIPAA) and the HITECH Act.
For PHI, we:
If you are a patient or participant, please send requests about your health information,such as access, amendment or an accounting of disclosures, to your healthcare provider.If you contact us, we will forward your request to that provider and help them respond.
We use the information we collect to:
When you submit a contact, demo, consultation or newsletter form, we collect only what you choose to give us, usually your name, work email, phone number and organization name.
We use that information to:
Please do not include patient or health information in website forms. These forms are notdesigned for PHI.
We send marketing emails only to business contacts who have given us their information or opted in. Every marketing email includes an unsubscribe link, and you can also opt out by emailing contact@hcbspro.com. We honor opt-out requests promptly and within the time the law requires.
Opting out of marketing does not stop service messages about your account or our work for your organization.
We do not sell or rent personal information to third parties for their own marketing.
We send text messages only to people who have opted in, for example by checking a consent box on a form, texting a keyword to us, or agreeing verbally on a recorded call.
We do not share or sell mobile numbers or text-messaging opt-in data with third parties or affiliates for their marketing. We share this information only with the service providers that deliver our messages, such as our texting platform and the mobile carriers.
We do not sell personal information or PHI. We share information only in these cases:
| Who | Why | Safeguards |
|---|---|---|
| Service providers | Cloud hosting, email, texting, payment processing, IT support | Written contracts; a BAA when PHI is involved |
| Payers and clearing houses | Submitting claims and authorizations for our clients | Only the minimum data needed |
| Our clients | Reporting on the work we do for them | Access limited to authorized users |
| Government and legal authorities | When required by law, subpoenaor court order | We disclose only what the law requires |
| A buyer or successor | A merger, acquisition or sale of assets | The same protections continue to apply |
Our website does not currently use advertising cookies or third-party tracking. TheGimbal Application uses essential session cookies or tokens to keep you signed in and to secure your session. You cannot turn these off and still use the application.
If we add analytics or other cookies, we will update this policy and ask for consent where the law requires it.
When we no longer need information, we securely delete or anonymize it.
Our safeguards include:
No system is completely secure, but we work continuously to protect your information.
If we discover a security incident, we follow our documented incident response plan:
| Who we notify | When |
|---|---|
| Affected clients (covered entities), forbreaches of unsecured PHI | Without unreasonable delay, and no later than 60 days after discovery, or sooner if the BAA requires |
| Affected individuals, for breaches of personal information | As state law requires; for New York residents, within 30 days of discovery |
| Regulators, such as the New York Attorney General | As applicable law requires |
Where we act as a business associate, the covered entity is usually responsible for notifying patients, and we provide the information it needs to do so.
Depending on where you live, you may have the right to:
How to make a request : email contact@hcbspro.com with the subject line "Privacy Request," or call +1 (516) 299-9600. We will confirm your identity before acting on arequest, and we will respond within 45 days. If we need more time, we will tell you why.
If your information was provided by your employer or healthcare provider, we may refer your request to them, since they control that data.
HCBS PRO has a Privacy and Security Officer who is responsible for:
Contact : contact@hcbspro.com (subject: "Attn: Privacy Officer")
Our website and services are built for healthcare businesses and their staff. They are notdirected to children under 13, and we do not knowingly collect personal information from them online. If we learn that we have, we will delete it. Any information about minors who receive care is PHI that we process only for our clients under a BAA.
Our website and the Gimbal Application may link to or integrate with third-party sites,such as payer portals and state Medicaid systems. Their own privacy policies apply, and we encourage you to read them.
We review this policy at least once a year. When we make changes, we post the new version on this page and update the "Last updated" date. If a change is significant, we will also notify clients by email or through the Gimbal Application before it takes effect.
If you have questions about this policy or how we handle your information, please contact us:
Filing a complaint :
If you are not satisfied with our response, you may contact:
We will not retaliate against anyone for filing a complaint.