Security, privacy, and compliance
At Prime Health Services, protecting client data is integral to how we design, build, and operate our services. Our security program combines administrative, technical, and physical safeguards and is reviewed and attested annually (SOC 2 Type II). All information is transmitted encrypted and stored securely in ways that meet CMS expectations and use FIPS 140 2–compliant cryptography; all services are performed and maintained within the U.S.
Prime Health Services incorporates security by design as a core principle across our applications. Our security practices are designed to support essential standards and regulations such as NIST, HIPAA, and HITECH. We’ve instituted multiple complementary layers of security to secure client, server, data, and transmission of all user information.
Encryption. We protect data in transit (TLS/SFTP) and at rest using FIPS 140‑2–aligned controls; keys are keyvault safeguarded and device encryption is enforced where applicable.
- Access controls. We implement least‑privilege RBAC, unique user IDs, 15‑minute inactivity timeouts, and account lockout after five invalid attempts. MFA is required for remote VPN access and for administrative operations; Azure AD (Entra ID) enables enterprise SSO
Monitoring & logging. Application audit logs remain online for at least 180 days; centralized monitoring, alerting, and email/endpoint protections are in place to detect and respond to threats.
Vulnerability management & testing. We run monthly vulnerability scans and hold monthly remediation reviews; we also conduct annual third‑party penetration tests and periodic phishing assessments.
- Physical security. Facilities use badged access, video monitoring, and restricted server‑room access; visitors sign in and are escorted
- Incident Response. We maintain a documented Incident Reporting & Management procedure covering triage, containment, eradication, recovery, and lessons learned. Severity categories drive escalation, communications, and regulatory/client notifications and IR channels are exercised as part of business continuity testing.
We understand that security is not a static discipline and proactively apply processes and technologies to protect against a wide range of attack types. Our response team continuously assesses new vulnerabilities and dynamically adjusts development and operations.
We take the privacy of our customers’ data as an essential principle and ensure confidentiality, integrity, and availability across lifecycle in the cloud and on-premises. Prime Health Services protects customer data throughout our business processes including support with role-based controls that limit access based on need and its intended use.
A strong governance program is in place to oversee data processing activities and lifecycle management, with data stewards to assure cross functional data management.
Data classification. PHI is always treated as Confidential and protected with heightened safeguards across its lifecycle.
- Retention & auditability. Client confidential data and sensitive information are retained per contract and policy (baseline up to 7 years).
Secure disposal. Media and paper containing confidential data are destroyed using approved methods with chain‑of‑custody evidence; assets are sanitized before re‑use or disposal.
Prime Health Services security and privacy measures are designed to support the stringent requirements of our clients and to maintain essential health and privacy standards. Our employees, processes, and operations adhere to required standards and regulations (e.g., HIPAA and data protection and privacy training, SOC 2 attestation).
- SOC 2 Type II — Annual examinations covering Security, Availability, and Confidentiality; reports are available to clients.
- HIPAA — Operations are aligned with the HIPAA Security, Privacy, and Breach Notification Rules and enforced via BAAs
- Industry alignment — Program mapped to CIS Critical Security Controls (IG3) to guide continuous improvement.
Subprocessors
We engage vetted subprocessors to deliver our services. PHS annually reviews their security attestations (e.g., SOC 2, HITRUST, FedRAMP) and monitors control changes as part of vendor risk management.
Vendor | Service | Assurance/Notes |
Microsoft Azure | Cloud hosting (IaaS/PaaS) for production applications and storage | SOC 2; FedRAMP Moderate; annual PHS review; aligned to CMS cloud expectations for claims processing |
Acrometis | Data input services | Attestation reviewed annually (SOC/HITRUST) |
Smart Data Solutions | EDI / Clearinghouse services | Attestation reviewed annually (SOC/HITRUST) |
MultiPlan | PPO network access services | Attestation reviewed annually (SOC/HITRUST) |