Karepoint Billing Service LLP is a revenue cycle management company serving behavioral health and substance use disorder treatment facilities in the United States. We provide verification of benefits, prior authorization, concurrent review, and related billing services.
Important: This Privacy Policy applies to information collected through our website at mykarepoint.com. Our obligations regarding protected health information (PHI) handled in the course of providing services to client facilities are governed by separate Business Associate Agreements (BAA), HIPAA, and 42 CFR Part 2.
Through our website contact form, we collect the following information from prospective clients:
We do not collect, store, or process patient information through our website. Our contact form explicitly prohibits the submission of protected health information.
Form Submission Method: Inquiry data is collected via Microsoft Forms or exported to Excel/SharePoint for lead management. Submissions are routed to info@mykarepoint.com and stored within our Google Workspace and Microsoft 365 environments.
Information submitted through our website is used solely for the following purposes:
We do not sell, rent, or share your contact information with third parties for marketing purposes. We do not use your information for automated decision-making or profiling.
In our role as a business associate to HIPAA-covered entities, Karepoint handles protected health information in accordance with the Health Insurance Portability and Accountability Act (HIPAA) and its implementing regulations.
A signed Business Associate Agreement (BAA) is executed with every client facility before any protected health information is exchanged. The BAA governs our permitted uses and disclosures of PHI, our security obligations, our breach notification duties, and our compliance with all applicable regulations.
Note: No PHI should be submitted through our website contact form. All PHI-related communications and data handling occur under the terms of the applicable BAA after a client engagement has been formally established.
Substance use disorder patient records that we handle on behalf of client facilities are subject to the federal confidentiality regulations at 42 CFR Part 2, which impose stricter protections than standard HIPAA requirements.
Our commitments under 42 CFR Part 2 include:
These obligations are incorporated into every Business Associate Agreement we execute with client facilities serving patients whose records are subject to 42 CFR Part 2.
Our website and operations use the following third-party services:
Data Sharing: We do not share your contact information with third parties for marketing purposes. Your data remains within Karepoint's systems (Google Workspace and Microsoft 365) and is not sold, rented, or disclosed outside of our organization except as required by law.
We implement appropriate technical and organizational measures to protect contact information submitted through our website, including:
No system is 100% secure. We cannot guarantee absolute protection against all possible threats. However, we employ industry-standard safeguards consistent with the sensitivity of the data we handle.
Website inquiry data (contact form submissions) is retained for two years from the date of submission. This retention period allows us to nurture prospective relationships and respond to follow-up inquiries within a typical B2B sales cycle.
After two years, inquiry data is permanently deleted from our systems unless the prospect has become a paying customer.
If you become a customer: Your data transitions from our website inquiry system to our Business Associate Agreement (BAA) and is retained in accordance with HIPAA and applicable state law medical records retention requirements, which typically range from 6 to 10 years depending on your state and the services provided.
Deletion method: Data is permanently removed from all systems, including email archives, Excel records, and SharePoint repositories.
Regarding information you submit through our website, you may contact us to:
To exercise any of these rights, contact us at the address below. We will respond within a reasonable timeframe.
Note: If you are a resident of California, the European Union, or the United Kingdom, you may have additional rights under applicable privacy laws (CCPA, GDPR, UK GDPR). Contact us for more information about your specific rights under your local jurisdiction.
For questions about this Privacy Policy, our data practices, or to exercise your rights, please contact us.
For questions about this Privacy Policy, HIPAA compliance, 42 CFR Part 2 obligations, or to request information about your data, please reach out to our team directly.
info@mykarepoint.comWhen you engage Karepoint as a service provider to handle protected health information (PHI) or substance use disorder patient records, a Business Associate Agreement (BAA) is executed before any PHI is processed or accessed.
Our BAA is based on the HHS Model Business Associate Agreement and incorporates all required HIPAA Safeguards Rules and 42 CFR Part 2 protections.
The BAA governs:
Important: This Privacy Policy addresses information collected through our website. The BAA is a separate, legally binding agreement that applies only to PHI handled in the course of providing services to client facilities.
No PHI should ever be submitted through our website contact form. All PHI-related communications occur under a signed BAA, with separate data handling, security protocols, and access controls.