Snapshot 91877
Normalized text
Scripts and page chrome removed; this is what change detection compares.
Skip to main content
Privacy Policy
Last Updated: May 15, 2025
Introduction
EasyPA ("we," "our," or "us") is committed to protecting the privacy and security of your information. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our prior authorization automation platform (the "Service"). As a HIPAA-compliant service provider, we take our responsibilities regarding Protected Health Information (PHI) extremely seriously.
Information We Collect
We collect several types of information to provide, improve, and protect our Services:
Protected Health Information (PHI): To automate prior authorizations, we process PHI as defined by HIPAA, which may include patient identifiers, diagnosis codes, procedure codes, and clinical documentation. This information is handled in accordance with our Business Associate Agreements (BAAs) with covered entities.
User Account Information: When clinic staff or administrators register, we collect names, email addresses, job titles, and credentials necessary for account management and service provision.
Usage Information: We collect data about how you interact with our platform, including features used, time spent, and actions taken. This helps us improve our service and user experience.
System Integration Data: Information necessary to integrate with your electronic health records (EHR) system, practice management software, and other healthcare systems.
Technical Data: IP addresses, device information, browser type, and system logs that help us maintain security and optimize performance.
SMS for Authentication
If you choose to sign up using a phone number, EasyPA will use SMS solely for authentication purposes, such as sending one-time verification codes or login confirmations. We do not use SMS for marketing or promotional messages.
Your phone number is stored securely and is not shared with third parties for advertising purposes. Message and data rates may apply based on your mobile carrier. You may opt out of SMS-based authentication at any time by contacting our support team at info1@easypa.ai, although this may limit your ability to access your account.
EasyPA Patient App — AI Processing of Denial Letters
When you upload an insurance denial letter to EasyPA Patient, the document content is processed by third-party AI services to generate your appeal letter:
What we send:
The image or PDF of your denial letter (which may contain protected health information)
Your name, date of birth, address, member ID, group number, and insurance company name from your profile
Who processes it:
Nova Pro (via Amazon Bedrock) — generates the appeal letter from the extracted denial information
Amazon Textract — extracts text from images and PDFs
All processing occurs within AWS HIPAA-eligible services under a Business Associate Agreement (BAA)
How it is used:
Solely to extract the denial reason and generate a personalized appeal letter for you
Data is encrypted in transit and at rest (TLS 1.3 / AES-256)
Data is not used to train AI models
AWS Bedrock retains no inputs or outputs after processing
Your denial letters and generated appeals are stored in your private S3 bucket and DynamoDB record, accessible only to you
Account deletion:
You can delete your account and all associated data at any time from the Profile screen in the app. This permanently removes your appeals, uploaded denial letters, profile information, and login credentials.
How We Use Your Information
We use the information we collect to:
Process and automate prior authorization requests
Predict approval likelihood and suggest documentation improvements
Analyze patterns to improve authorization success rates
Provide customer support and technical assistance
Maintain and improve our platform
Ensure compliance with HIPAA and other applicable regulations
Generate aggregated, de-identified insights about prior authorization trends
Detect and prevent fraud or unauthorized access
How We Store and Protect Your Data
Your data is hosted in secure AWS environments within the United States, with the following safeguards:
End-to-end encryption for data in transit and at rest
Role-based access controls and multi-factor authentication
Regular security assessments and penetration testing
Automatic logging of all data access events
Regular backup procedures and disaster recovery planning
Physical security measures at all data centers
We retain PHI only for as long as necessary to fulfill the purposes outlined in this Privacy Policy and our BAAs, or as required by law. Non-PHI data may be retained longer for service improvement and analytics purposes.
Third-Party Service Providers
We may engage trusted third-party service providers to help us operate our business and deliver services. These providers are contractually obligated to protect your information and can only use it for specified purposes:
Cloud Infrastructure: AWS (Amazon Web Services) for secure hosting and storage
Communication Services: Twilio for secure messaging capabilities
Fax Services: Phaxio for digital fax transmission
AI and Machine Learning: Azure OpenAI and AWS Bedrock (with appropriate safeguards for PHI)
Analytics: De-identified and aggregated data analysis tools
All third-party providers who may access PHI are bound by appropriate Business Associate Agreements.
Your Rights and Choices
As a B2B platform, EasyPA primarily serves healthcare providers and organizations. End users (clinic staff) have certain rights regarding their personal information:
Access and update your account information through your profile settings
Request information about how your personal data is used
Opt-out of certain non-essential communications
For patients whose information is processed through our system, we act as a Business Associate. Patients should direct privacy requests to their healthcare provider (the Covered Entity), who can then work with us to fulfill appropriate requests.
Customer Responsibilities
Our customers (healthcare providers and organizations) are responsible for:
Obtaining appropriate consent from patients for sharing information with us
Ensuring the accuracy of patient data submitted to our platform
Managing user accounts and access privileges within their organization
Notifying us promptly of any potential data breaches or unauthorized access
Complying with all applicable privacy laws and regulations
Cookies and Analytics
We use cookies and similar technologies to enhance your experience, analyze usage patterns, and improve our Services. These technologies collect information about how you interact with our platform, but do not access PHI. You can manage cookie preferences through your browser settings, though this may impact certain functionality.
Our analytics tools use de-identified and aggregated data to help us understand usage patterns and improve our services. We do not use third-party analytics providers that would have access to PHI.
Data Deletion and Access Requests
To request access to, correction of, or deletion of your personal information or PHI, please:
For clinic staff personal information: Contact us directly at info1@easypa.ai
For patient PHI: Contact your healthcare provider, who will coordinate with us as necessary
We will respond to all legitimate requests within the timeframes required by applicable law, typically within 30 days.
Changes to This Privacy Policy
We may update this Privacy Policy periodically to reflect changes in our practices or for other operational, legal, or regulatory reasons. We will notify customers of material changes through email or notices on our platform. Your continued use of our Services after such modifications constitutes your acknowledgment of the modified Privacy Policy.