Security and HIPAA at Nucleus Align
Billing means handling protected health information every day. This page lists the safeguards Nucleus Align uses, in plain words, and what the HIPAA Security Rule asks of a business associate.
In short: every client gets a signed Business Associate Agreement, all staff have HIPAA training and sign NDAs, every system uses two-step login, and backups are encrypted and automatic. A dedicated compliance officer owns the program.
What safeguards does Nucleus Align use?
We state only what we do. Five safeguards apply to every client.
We do not hold a third-party security certification, and this page does not claim one. If your security team needs a questionnaire answered, book a call and we will go through it with you.
What is a Business Associate Agreement and why does it matter?
A business associate is a company that handles protected health information (PHI) on behalf of a provider. A BAA is the written contract that sets out how the company may use that information and what safeguards it must keep.
Under 45 CFR 164.308(b)(1), a covered entity may let a business associate create, receive, maintain or transmit electronic PHI only after it obtains satisfactory assurances that the business associate will safeguard it. The BAA is how those assurances are put in writing.
We sign one with every client. For what a BAA should contain and who is liable for what, see our guide to HIPAA for billing vendors.
What does the HIPAA Security Rule require of a billing company?
The Security Rule (45 CFR Part 164, Subpart C) applies to business associates directly. It sets three groups of safeguards for electronic PHI.
| Group | Rule section | What it requires, in short |
|---|---|---|
| Administrative | 45 CFR 164.308 | A risk analysis and risk management, a sanction policy, a named security official, workforce security training, and a contingency plan that includes a data backup plan. |
| Physical | 45 CFR 164.310 | Limits on physical access to systems and the places they are housed, rules for workstation use, and control of devices and media. |
| Technical | 45 CFR 164.312 | Access control with unique user identification, audit controls, integrity protection, authentication of people and systems, and transmission security. Encryption is an addressable specification. |
Under 45 CFR 164.308(a)(2), the rule requires the organization to identify the security official responsible for its policies and procedures. Under 164.308(a)(5), it requires a security awareness and training program for all workforce members, including management.
Under 45 CFR 164.308(a)(7)(ii)(A), a data backup plan is a required specification: procedures to create and maintain retrievable exact copies of electronic PHI.
Our compliance officer, workforce training, two-step login and encrypted backups line up with these requirements. This page describes our safeguards. It is not a legal opinion on your own compliance, which stays with your counsel and compliance team.
Where does the team work, and does that change the safeguards?
Our team works from Vancouver, BC, Dubai, UAE and Islamabad, PAK. Nucleus Align LLC has a US registered office at 212 N. 2nd St. STE 100, Richmond, KY 40475.
The same safeguards apply at every location: the BAA, HIPAA training and NDAs, two-step login and encrypted backups. Questions about how offshore work fits HIPAA are answered in our guide to outsourcing safely.
What does this website collect?
The booking form on this site asks for contact details and a short note, and it tells visitors not to include patient information. Details are in our privacy policy. Please never send PHI through the website form.
How do I raise a security question or concern?
Email hello@nucleusalign.com or call +1 332 252 4242, Monday to Friday, 9am to 5pm Eastern. Mark the message as a security or compliance matter. Related pages: terms of use, editorial policy and about us.
- 45 CFR 164.308 Administrative safeguards · eCFR
- 45 CFR 164.310 Physical safeguards · eCFR
- 45 CFR 164.312 Technical safeguards · eCFR
We check every rule, code and deadline against the official source. See our editorial policy.
Common questions
Straight answers from the team that does the work.
Ask a billing lead directly. A 20-minute call, Monday to Friday, 9am to 5pm Eastern.
01Does Nucleus Align sign a Business Associate Agreement?
Yes. We sign a Business Associate Agreement with every client before we handle any protected health information. The agreement sets out how we may use the information and the safeguards we keep. Ask for our standard BAA, or send yours for review, when you book a call.
02Is Nucleus Align HIPAA compliant?
We operate as a business associate under HIPAA. All staff have HIPAA training and sign NDAs, every system uses two-step login, backups are encrypted and automatic, and a dedicated compliance officer owns the program.
03Do you use two-step login?
Yes. Every system we use requires two-step login. A password alone is not enough to open an account, which limits the damage if a password is stolen or reused. This applies to all staff at all locations, so one weak account cannot open client data on its own.
04Are backups encrypted?
Yes. Backups run automatically and they are encrypted. The HIPAA Security Rule lists a data backup plan as a required specification at 45 CFR 164.308(a)(7)(ii)(A), and encryption as an addressable one at 45 CFR 164.312(a)(2)(iv).
05Who is responsible for compliance at Nucleus Align?
A dedicated compliance officer. The HIPAA Security Rule requires every covered entity and business associate to name a security official under 45 CFR 164.308(a)(2). Questions or concerns go to hello@nucleusalign.com, marked as security or compliance.
06Should I send patient information through the website form?
No. The booking form asks for contact details and a short note only, and it says not to include patient information. Share PHI only after a Business Associate Agreement is in place, and only through the channels we agree with you.
Questions from your compliance team?
Book a call and we will answer your security questionnaire and send our BAA.