01Scope of this policy
This Privacy Policy applies to information handled by ERO Billing (“ERO,” “we,” “us”) in two settings:
- Client services — billing and revenue cycle work we perform on behalf of treatment-center clients; and
- Our website and business contacts — information from visitors to erobilling.com, our business profiles (including Facebook), and people who email or otherwise contact us about our services.
ERO is a business-to-business service provider. We work for treatment centers, not directly for patients. If you are a patient of a treatment center, that center’s privacy notice — and its Notice of Privacy Practices for health information — governs how it collects and shares your information in the first place. See Section 4 for how to reach the right place with a health-information request.
Please note: This page is our privacy policy. It describes our practices in plain terms and is not legal advice, and it does not replace any Business Associate Agreement, client services agreement, or a treatment center’s Notice of Privacy Practices.
02Information we collect
A. Information from our clients
To do billing work, our clients (treatment centers) and their staff provide us with business and operational information, which may include:
- Facility, contact, and account information for the center and its authorized staff;
- Credentialing, enrollment, and payer information needed to bill on the center’s behalf;
- Billing, claims, authorization, and collections information; and
- Limited patient-related information that is included in, or necessary for, a claim, verification of benefits, authorization, or payment — handled as described in Section 4.
B. Information you give us directly
- Your name, work email, phone number, organization, and role when you contact us;
- The contents of emails and other messages you send us; and
- Information you provide when asking about our services.
C. Information collected automatically online
When you visit our website or view our business profiles, the hosting and platform providers involved may automatically collect standard technical information, such as device and browser type, pages viewed, approximate location from IP address, and timestamps. See Section 8 for cookies.
We do not ask patients to send us their health information through this website or by email. If you are a patient, please contact your treatment center directly.
03How we use information
We use information only for the purposes it was provided for, including to:
- Provide our five services: billing and revenue cycle management, insurance verification (VOB), claims and denial follow-up, credentialing, and collections reporting;
- Submit, track, and follow up on claims with payers on a client’s behalf, as directed by that client;
- Communicate with clients, payers, and our service providers about that work;
- Maintain records, reporting, and accounting for the work performed;
- Respond to inquiries about ERO and operate, secure, and improve our website and business operations; and
- Comply with law, payer requirements, and our agreements with clients.
We do not use patient-related information for marketing. We do not sell personal information.
04HIPAA & health information
When ERO handles protected health information (PHI) for a client, we do so as that client’s Business Associate under HIPAA — only as permitted by our Business Associate Agreement with the client and by HIPAA, and only to perform services for that client.
That means, in practice:
- Minimum necessary: We use and disclose only the minimum PHI needed to complete the billing task.
- No independent use: We do not use a client’s PHI for our own independent purposes, marketing, or sale.
- Safeguards: We apply administrative, physical, and technical safeguards appropriate to protect PHI, and we require subcontractors that handle PHI to agree to appropriate protections.
- Reporting: We report uses, disclosures, and security incidents involving PHI to the affected client as required by our agreement and applicable law.
If you are a patient
Rights under HIPAA regarding your health information — such as requesting access to, or an amendment of, your records — are exercised through your treatment center, which is the covered entity that provided your care. Please contact that center directly. If you send a PHI request to ERO, we will direct it to the relevant client where we can identify it, and we will not be able to act on it independently.
Some state laws provide additional privacy protections for health and other personal information. Where those laws apply, we follow them in performing services for our clients.
06Security
We use reasonable administrative, physical, and technical safeguards designed to protect information against unauthorized access, use, and disclosure — including access controls, limiting access to those who need it for their work, and secure systems for billing operations.
No system can be guaranteed completely secure. Please do not send sensitive health information to us through an unsecure public website form or ordinary email. Clients should use the secure channels established in their services arrangement with ERO.
07Retention
We keep client and billing records for as long as needed to provide the services, meet payer, legal, accounting, and contractual requirements, and resolve follow-up on claims and denials. Business contact information is kept for as long as it remains relevant to our business relationship or inquiry. When information is no longer needed for those purposes, we dispose of it in a manner appropriate to its sensitivity.
Records that belong to a client are handled and returned or disposed of as that client’s agreement with ERO directs.
09Your choices & rights
- Business contacts: You may ask us to correct or delete contact information we hold about you, or to stop contacting you about our services, by emailing info@erobilling.com. We will respond in accordance with applicable law.
- Depending on your state of residence, you may have rights to know, access, correct, or delete personal information, and to opt out of a sale or certain sharing. ERO does not sell personal information. To make a request, contact us at the email or mailing address in Section 12 and tell us the nature of your request and your relationship to ERO, so we can identify the right records.
- Patients: For health-information requests, contact your treatment center — see Section 4. ERO cannot independently grant access to records held on a client’s behalf.
- Verification: We may need to verify your identity and authority before acting on a request, and in some cases a request about client records must be directed to, or approved by, that client.
10Children
ERO’s services are offered to businesses, not to individuals seeking treatment, and our website is not directed to children. We do not knowingly collect personal information directly from children through this website. Patient information that appears in billing records is provided by our clients in connection with care those clients provide, and is handled under Section 4.
11Changes to this policy
We may update this Privacy Policy from time to time. When we do, we will post the updated version at this link and change the “Effective & last updated” date at the top of this page. Material changes to how we handle PHI are also governed by our Business Associate Agreements with clients.
12Contact us
Questions about this Privacy Policy or our privacy practices:
ERO Billing
3513 50th St, Ste. 200
Lubbock, TX 79413
Service area: United States
For patient health-information requests, please contact your treatment center directly — ERO provides billing services to centers and cannot act independently on those requests (see Section 4).