Do not send PHI until the workflow is formalized.
Clinovian operates from India with U.S.-provider-facing contractual safeguards. Initial intake does not request PHI. Where PHI is required after scope approval, Clinovian uses a BAA-governed secure transfer workflow with minimum-necessary access.
De-identified intake default
The initial fit assessment, no-PHI AR audit, and pre-scope discussion use de-identified information. No PHI is requested or required before scope approval and BAA execution.
BAA before any PHI
Where the engagement requires access to clinical records, a Business Associate Agreement is executed before any protected health information is transferred.
Minimum-necessary access
Clinical records accessed only to the extent required for the specific engagement scope. No bulk data processing.
Secure transfer only
Records transferred through agreed secure channels only — not email attachments, not shared drives, not unencrypted transfer.
India-based processing disclosed
Clinical review is performed from India. This is disclosed to every client at engagement. Cross-border processing is governed by the BAA and engagement terms.
Clinical consulting only
Clinovian is not a law firm. Not a covered entity. Not a bulk claims processor. It is a physician-led clinical consulting practice for high-value denial disputes.
Engagements are structured so Clinovian may retain de-identified, non-client-identifiable learning points for internal quality improvement, pattern analysis, and methodology development. These learning points exclude PHI, client identity, payer contract terms, case identifiers, financial identifiers, and any information that could reasonably re-identify the client or patient. This clause supports the denial-pattern intelligence that makes the desk's output improve over time.
Clinovian is not bulk offshore claims processing. It is a physician-authored clinical argument practice for high-value disputes where the medical record must be translated into payer-review logic. That distinction determines how data is handled, how access is scoped, and why the engagement model is fundamentally different from volume-processing outsourcing.
Start low-risk. No PHI required for the first step.
Send a de-identified denial rationale. PHI workflow formalized only after scope approval.