Beacon DENTAL SOLUTIONS
Menu
Book a 15-minute callBook a call

Your patient data

Where does your patient data go? Two places, both named in your agreement.

Most billing companies do not answer this question on their website, so far as we can tell. We would rather answer it first, because it is the question a careful practice owner asks third and worries about first.

Your patient records stay in your practice-management system, and Beacon builds no copy of them. The insurance data we work on is handled inside our own United States-hosted environment, under the business associate agreement you sign, and nowhere else. Naming both places matters when something goes wrong at a vendor, which is how a lot of healthcare breaches happen.

No Beacon database of your patients

We do not build a copy of your patient list. We work your insurance data inside our own United States-hosted environment under our business associate agreement, and we keep no patient database of our own. The only data we keep for our own use is de-identified and carries no patient identity at all.

No exports, no downloads, no spreadsheets

Nobody at Beacon pulls a report of your patients onto their own machine. Files, downloads and local copies cannot leave the hosted environment we control, and the insurance data we work on stays inside it, in the United States, under the business associate agreement you sign.

Named logins you can revoke

Every person who touches your system has their own named account with least-privilege access, created by you. No shared credentials, except where a payer portal offers no named-user option, in which case the credential is held in a vault and every session is attributed to a named individual. You can see who did what, and you can switch any of them off in seconds without calling us.

The part most companies skip

Part of our delivery team will be overseas. Here is exactly how it is contained.

Plenty of billing companies at this price point use an offshore team, and few say so on their website. We would rather tell you, and then tell you what stops it being a risk.

  • They will work through a window, not on their own machines. Our delivery partner will reach a United States hosted environment that Beacon controls. Protected health information will not be stored on their systems and will not be permitted to come to rest outside the United States, under the agreement they sign before any access.
  • Multi-factor authentication, no exceptions. Anyone touching patient data signs in with a second factor. This is the one requirement no delivery partner gets to flex on.
  • They sign a subcontractor business associate agreement before they get any access, with safeguards at least as protective as the ones Beacon owes you, including offshore and cross-border terms.
  • We do not work government-program claims at all. Medicaid, Medicare, CHIP, TRICARE, any other state or federal program, and any managed-care plan administering one are outside what Beacon does, onshore and offshore. They stay with your practice or your existing biller.
  • We stay responsible. Beacon remains liable for what its subcontractors do, to the same extent as for its own staff. That is in your agreement, not just in this paragraph.

Our commitment on compliance, stated plainly

Signed business associate agreementBefore any access
Written HIPAA program and security policiesIn force before we hold your data
Annual security risk analysisCompleted before we hold your data
Named security officerAppointed, named in your agreement
Cyber liability and errors-and-omissions coverBound before your start date
Massachusetts written information security programIn force before we hold your data

Take the overview with you now. We will send the standard business associate agreement too, before you commit to anything.

The one-page security overview Where your patient data goes, the containment diagram and the compliance basics. PDF, 1 page, 101 KB.

The same thing, drawn

Three layers, one line that patient data never crosses.

If you take one picture away from this page, take this one. Show it to whoever asks you the hard question about offshore billing.

How Beacon contains patient data Three layers. At the top, inside the United States, your practice-management system, which holds every patient record. Beacon builds no copy of it. Below it, still inside the United States, a hosted environment that Beacon controls; Beacon staff reach your system from there using named, revocable logins with multi-factor authentication and least-privilege access. A dashed line marks the United States border. Below that line, outside the United States, the delivery team Beacon will appoint. A screen image is sent down to them and their keystrokes and clicks are sent back up, but files, exports, downloads and local copies cannot cross the line, so no patient record is ever stored outside the United States. INSIDE THE UNITED STATES Your practice-management system Every patient record lives here, and Beacon builds no copy of it. Beacon keeps no patient database of its own. YOUR SYSTEM Named logins, created by you and revocable by you Multi-factor authentication · least privilege · full audit trail A hosted environment Beacon controls All Beacon work happens here, on machines Beacon runs, inside the United States. Protected health information is not permitted to come to rest anywhere else. BEACON-CONTROLLED A screen image, down Pixels only. Nothing to save. Keystrokes and clicks, up The work, done inside your system. Files cannot cross No exports, downloads or local copies. Ever. OUTSIDE THE UNITED STATES The delivery team we appoint, overseas They will see a screen and type into it. Nothing is stored on their side. Subcontractor agreement signed before access · multi-factor authentication, no exceptions Medicaid, Medicare, CHIP and TRICARE are outside Beacon’s scope, so none of it comes here.

Scroll sideways to see the whole diagram.

The screen image and the keystrokes cross the line. Files, exports, downloads and local copies do not, which is why there is nothing outside the United States to lose.

One more thing, said out loud

We use de-identified data, and you get something for it.

Beacon strips identity from the billing data it works with, and will combine it with the same from other practices as we take them on. We use that to spot payer patterns, improve our own workflows and build automation.

This is in your agreement in plain terms, because we would rather you read it than discover it. De-identified means de-identified to the California standard, which is stricter than the federal one: we do not name your practice in anything external without your written permission, and our subcontractors are not allowed to touch it for their own purposes.

Our public commitment on de-identified data. We will maintain and use this data only in de-identified form. We will not try to re-identify it or help anyone else do so. And we will bind anyone we give it to by the same two promises, in writing.

What you get back, at no extra charge and for as long as you are a client: payer-trend reporting on denials and turnaround from day one, benchmarking against the aggregate once there is enough of it to be worth showing you, and the benefit of every workflow improvement that comes out of it.

Ask for the agreement