HIPAA PRIVACY & COMPLIANCE NOTICE

Last Updated: September 2026

1. Our Commitment to Healthcare Data Security
Vital Metrics CAS, LLC ("we," "our," or "the Firm") operates as a technology and financial services provider specializing in the healthcare and medical technology sectors. Because we provide accounting systems architecture and software integration services to healthcare providers and startups, we are fully committed to maintaining the highest standards of data security in compliance with the Health Insurance Portability and Accountability Act (HIPAA) and the HITECH Act.

2. Our Status as a Business Associate
Under HIPAA regulations, our clients are classified as "Covered Entities," and our firm operates strictly as a Business Associate. We do not engage in services until a formal Business Associate Agreement (BAA) is mutually executed. We assume all legal and operational duties required of a Business Associate to ensure the integrity, confidentiality, and security of any Protected Health Information (PHI) we may interact with.

3. Data Minimization & Safe QuickBooks Mapping
To protect patient privacy and reduce system vulnerabilities, we practice strict data minimization. When integrating electronic health records (EHR) or billing platforms like athenahealth with QuickBooks Online:

  • We summarize transactions by aggregate financial batches.

  • We do not import, store, or transmit patient names, social security numbers, or medical case histories within the accounting ledger.

  • Financial transaction records are strictly masked using generic, non-identifiable identifiers.

4. Technical & Physical Safeguards
The Firm employs robust administrative and technical protections to secure data environments, including:

  • Enforced Multi-Factor Authentication (MFA) across all email, ledger, and clinical billing systems.

  • Advanced hardware and cloud encryption for all active files and accounting workflows.

  • Secure, audited credential management systems that prevent credential reuse.

5. Contact Information
For questions regarding our data architecture or to request our standard Business Associate Agreement prior to a consultation, please contact us at andrea.kounelas@vitalmetricscas.com.