Security and privacy
Health information, handled the way the law and the patient expect.
Payerworks is a business associate to every customer it serves. These are the controls that make that promise true, written plainly so the person reviewing us can check them.
The controls
What protects the data, and how to check it
Encryption, everywhere, under keys we manage
Every file and every record is encrypted at rest under keys that belong to us, and every transfer runs over an encrypted connection. A file arrives over SFTP under the partner’s own key and lands encrypted.
Access by role, and nothing by default
A person sees what their role needs and no more. Staff who do not work a lane cannot open it, and the functions that move files run under a role that can read the files and cannot delete them.
An audit trail that holds no patient detail
Every action that changes a record is written to an audit log that names the actor, the time and the row, and never the patient. Logs are built to be read by auditors without becoming a second copy of the data they describe.
Files that are never deleted
What a payer sent is the record. Our endpoint keeps every version of every file, and no function in the product can remove one.
Backups you can restore, proven
Data is backed up daily and across regions, and the backups are restored on a schedule into disposable encrypted copies, because a backup that has not been restored is a hope.
Agreements before any data moves
A business associate agreement is signed with every customer, and a trading partner agreement with every payer, before a single file carries a patient. Vendors that could touch health information sign their own agreement with us first.
Reviews
Reviews and attestations
Questions from a security review, a privacy officer or a payer’s compliance desk are answered by a person. Write to us from the form below and say who you are reviewing us for.
Payerworks publishes each independent attestation as it is issued. Until one is, this page claims none.
Responsible disclosure
Found a security problem? Tell us first.
If you believe you have found a weakness in payerworks.com, the Payerworks API or anything else Payerworks runs, report it through the form on this page with “Reporting a security problem” chosen, or by email to the address below. A person reads every report and replies.
What to send
- What you found and where: the page, the route or the host.
- The steps that show it, with the request and answer if there is one. Use the sandbox and a test key; invented data shows a problem as well as real data does.
- What someone could do with it, as you understand it.
- How to reach you for questions, if not the email you send from.
What we ask of you
- Do not open, keep or share health information or any data that is not yours. If you come across some, stop, tell us what you saw, and delete what you copied.
- Do not test against another customer’s key, account or files, and do not try to reach a payer through us (there is no payer connection to reach).
- Do not run a test that slows or stops the service for others, and do not try social engineering or physical access.
- Give us a reasonable time to fix it before you tell anyone else, and tell us when you plan to.
What we do
- We acknowledge a report by email, usually within a business day.
- We tell you what we found, and again when it is fixed.
- We credit you by name when it is fixed, if you want to be credited.
- Payerworks has no paid bug bounty. A report is thanked, not paid.
Report it on the form below, or write to security@payerworks.com. The same contact is published for tools, under RFC 9116, at /.well-known/security.txt.
Talk to us
What happens next
- 1
A person at Payerworks reads what you sent, usually within a business day.
- 2
One reply by email names the next step: our trading partner details, where each of your payers stands, or a key for the API.
- 3
Nothing follows unless you answer. There is no sequence behind this form.
Or write to security@payerworks.com.