Strict Enterprise Scope
This document describes the regulatory privacy guidelines enacted by Jorvus LLC (“JORVUS”, “we”, “our”, or “us”) across all cloud-hosted EHR endpoints, revenue cycle processing pipelines, credentialing databases, and administrative services provided to medical entities.
Scope & B2B Applicability
Jorvus LLC operates exclusively as a Business-to-Business (B2B) healthcare technology and specialized revenue cycle solutions vendor. Our software platform, clinical documentation modules, and financial adjudication pipelines are licensed directly to covered healthcare practices, ambulatory centers, surgical groups, and Management Services Organizations (MSOs).
JORVUS does not furnish direct patient care, diagnose clinical conditions, or triage medical emergencies. Individuals seeking details regarding clinical data held within their healthcare provider’s record must direct inquiry requests directly to their treating physician or provider organization under HIPAA privacy rules.
Protected Health Information (PHI) & HIPAA Compliance
In furnishing software-as-a-service (SaaS) EHR tools and billing execution, JORVUS functions strictly in the regulatory capacity of a Business Associate as defined under 45 CFR § 160.103 pursuant to the Health Insurance Portability and Accountability Act of 1996 (HIPAA), the Health Information Technology for Economic and Clinical Health (HITECH) Act, and the final HIPAA Omnibus Rule.
Prior to establishing integration access or receiving, storing, transmitting, or processing any Protected Health Information (PHI), JORVUS executes a binding, comprehensive Business Associate Agreement (BAA) with the licensing Covered Entity. Our BAAs stipulate:
PHI is used exclusively to facilitate adjudication, electronic filing, and technical validation as contractually instructed by the covered client.
Strict enforcement of physical, administrative, and technological controls adhering to 45 CFR § 164 Subpart C Security Standards.
Contractual obligation to notify client administrative teams without unreasonable delay upon discovery of any confirmed security compromise.
Downstream data clearinghouses and infrastructure hosting partners maintain congruent BAA obligations matching our institutional terms.
Information We Collect
We gather only data essential to deliver institutional EHR features, provider credentialing, and revenue management. Categories include:
A. Practice Operational Data
Organizational details including National Provider Identifiers (NPIs), practice tax identification numbers (TIN), state medical licenses, commercial insurance credentialing packages, billing locations, and administrative contact records.
B. Transmitted Claims & Encounter Files
ANSI ASC X12 standard electronic transaction formats (including 837P, 837I, 835 Remittance, 270/271 Eligibility, and 276/277 Claim Status files), diagnostic ICD-10 coding sets, CPT codes, modifiers, and associated provider clinical notes uploaded for audit defense.
C. Technical & System Telemetry
Network IP addresses, hardware identifiers, audit event logs, session authentication tokens, API request payloads, cryptographic handshake verification records, and browser runtime metrics logged for operational security.
How Information Is Used
JORVUS processes incoming records strictly under direct authorization from our client practices to accomplish the following enterprise objectives:
- Revenue Cycle Processing: Scrubbing, validation, transformation, and submission of billing claims directly to commercial, Medicare, and Medicaid payers.
- Clearinghouse Interoperability: Orchestration of real-time electronic data interchange (EDI) across clearinghouse networks and payer endpoints.
- Denial Adjudication & Recovery: Identification of claim rejection patterns, payer remittance reconciliation, and secondary dispute filings.
- Platform Integrity & Audit Readiness: Continuous internal system monitoring, intrusion anomaly analysis, and validation against federal statutory guidelines.
Data Disclosure & Business Associate Agreements
Disclosures of operational data or PHI are rigidly limited to the downstream conduits strictly necessary to finalize adjudication:
1. Certified Healthcare Clearinghouses: Transmission of claim sets via encrypted secure FTP (SFTP) or synchronous REST APIs configured with certified EDI gateways.
2. Healthcare Payers: Submission of claim batches and medical records to commercial insurance carriers, state Medicaid entities, and CMS fiscal intermediaries.
3. Vetted Infrastructure Sub-processors: High-security cloud hosts and database instances operating within the continental United States bound by executed HIPAA Business Associate Agreements.
4. Compulsory Legal Compliance: Disclosure mandated by valid court summons, federal subpoenas, or administrative audits governed strictly under 45 CFR § 164.512.
Data Security & Storage Architecture
Our infrastructure employs multi-tier institutional defense-in-depth security engineered for zero-trust environments:
Applied to all structured tables, unstructured document vaults, and system snapshots at rest.
Enforced across all external endpoints and internal service mesh micro-connections.
Granular role-based privileges with mandatory hardware-bound or app multi-factor auth.
Data Retention Protocols
JORVUS retains transactional billing records, transmission logs, and related clinical data files in strict accordance with client contracts, CMS requirements, and federal statutory standards. Unless otherwise stipulated in an executed service SLA:
- Statutory Claim Logs: Financial adjudication records and EDI acknowledgments are preserved for seven (7) years to align with CMS record retention requirements.
- Security & Audit Logs: Access logs, authentication sequences, and modification histories are securely stored for six (6) years under HIPAA Security Rule § 164.316(b).
- End-of-Contract Deletion: Upon termination of a licensing agreement and conclusion of required transfer reconciliations, JORVUS executes cryptographic sanitization or returning of all Covered Entity data per BAA guidelines.
Your Rights & Legal Inquiries
Authorized practice representatives with questions regarding data handling policies, audit reviews, or compliance verification can contact our internal office directly: