HIPAA Notice

Effective Date: 08-01-2026 Last Updated: 08-01-2026

BIOS HEALTHCARE LOGISTICS PRIVATE LIMITED

Important: About This Notice

BIOS Healthcare is a revenue cycle management (RCM) company. We are not a hospital, physician practice, or health plan, and we do not have a direct treatment relationship with patients. Under the Health Insurance Portability and Accountability Act ("HIPAA"), BIOS Healthcare typically acts as a Business Associate to healthcare provider organizations ("Covered Entities"), performing billing, claims, coding, collections, and related administrative functions on their behalf.

Because of this role, BIOS Healthcare does not issue its own HIPAA Notice of Privacy Practices to patients. A Notice of Privacy Practices is issued by the Covered Entity — your healthcare provider or health plan — describing how they use and disclose your health information. This page explains how BIOS Healthcare handles protected health information ("PHI") in its capacity as a Business Associate, and where to go if you have questions about your own health information.

If you are a patient looking for information about how your health information is used, please contact your healthcare provider directly and request their Notice of Privacy Practices.

1. Our Role as a Business Associate

BIOS Healthcare provides services such as medical billing, claims submission, coding support, payment posting, denial management, and patient statement/collections support to healthcare provider Clients. In performing these services, we may receive, create, transmit, or maintain PHI on behalf of our Clients.

Our access to and use of PHI is governed by:

A signed Business Associate Agreement ("BAA") with each Client
The HIPAA Privacy Rule, Security Rule, and Breach Notification Rule
The Health Information Technology for Economic and Clinical Health (HITECH) Act
Applicable state health privacy laws

2. How We Use and Disclose PHI

As a Business Associate, BIOS Healthcare uses and discloses PHI only as permitted or required by:

Our BAA with the applicable Client
Written instructions from the Client
Applicable law

Permitted uses generally include activities necessary to perform RCM services, such as:

Submitting claims to payers on behalf of providers
Posting payments and reconciling accounts
Following up on denied or underpaid claims
Generating patient billing statements
Supporting audits, compliance reviews, and Client reporting obligations

BIOS Healthcare does not use PHI for its own marketing purposes, does not sell PHI, and does not use PHI outside the scope authorized by our Clients and applicable law.

3. Safeguards We Maintain

BIOS Healthcare maintains administrative, physical, and technical safeguards designed to protect the confidentiality, integrity, and availability of PHI, consistent with the HIPAA Security Rule. These include, among others:

Role-based access controls and unique user authentication
Encryption of PHI in transit and, where applicable, at rest
Audit logging and monitoring of systems containing PHI
Workforce HIPAA training and confidentiality agreements
Physical security controls at facilities where PHI is processed
Documented incident response and breach notification procedures
Regular risk assessments

4. Breach Notification

If BIOS Healthcare discovers a breach of unsecured PHI, we will notify the affected Client(s) in accordance with the timelines and procedures required under HIPAA and our BAA, so that the Client can fulfill its own notification obligations to affected individuals and, where applicable, regulators.

5. Your Rights as a Patient

Because BIOS Healthcare is a Business Associate and not your healthcare provider, patient rights under HIPAA — such as the right to access your medical records, request corrections, receive an accounting of disclosures, or file a complaint — are exercised through your healthcare provider or health plan, not through BIOS Healthcare directly. If you have questions about a medical bill or statement you received that references BIOS Healthcare, you are welcome to contact us using the information below, and we will direct you appropriately or assist within the scope of our authorization from the applicable Client.

You also have the right to file a complaint with the U.S. Department of Health and Human Services, Office for Civil Rights, if you believe your privacy rights have been violated:

Website: https://www.hhs.gov/hipaa

6. Subcontractors

Where BIOS Healthcare engages subcontractors that may have access to PHI in connection with our services, we require those subcontractors to agree to protections at least as stringent as those in our BAAs with Clients, as required under HIPAA.

7. Website and PHI

Our public website is intended for general business information and is not a secure channel for transmitting PHI. Please do not submit PHI, patient identifiers, or medical records through website contact forms or general email. Clients with active service agreements should use the secure channels designated in their onboarding and operational procedures.

8. Contact Us

If you have questions about this Notice or about BIOS Healthcare's role as a Business Associate, please contact:

BIOS HEALTHCARE LOGISTICS PRIVATE LIMITED
5-4/1, MAIN ROAD VELANGI
KARAPA, East Godavari, Andhra Pradesh, India, 533260
Email: info@bioshcl.com

9. Changes to This Notice

We may update this Notice from time to time to reflect changes in our practices or applicable law. The "Last Updated" date above reflects the most recent revision.