Why Healthcare Providers
Choose Exp Credentialing Services

Privacy Policy

×

1. Introduction and Scope of Policy
Exp Credentialing Services ("we," "our," "us," or the "Company") is unequivocally committed to safeguarding the privacy, confidentiality, and integrity of your data. This comprehensive Privacy Policy outlines our data governance framework, detailing the methodologies by which we collect, process, transmit, and protect your information when you engage our business-to-business (B2B) medical credentialing, provider enrollment, and revenue cycle management (RCM) services ("Services"), or when you interact with our digital properties and web portals.

2. Categories of Information We Collect
In the execution of our Services, it is functionally necessary for us to collect, store, and process highly sensitive professional, corporate, and identifying data. The categories of data we process include, but are not expressly limited to:
• Corporate Identity and Financial Data: Employer Identification Numbers (Tax IDs), corporate structuring documentation, group National Provider Identifier (NPI) numbers, and institutional banking details necessary for Electronic Funds Transfer (EFT) setups.
• Provider Identity and Credentialing Profiles: Practitioner names, Social Security Numbers (SSNs), state medical licenses, Drug Enforcement Administration (DEA) certificates, board certifications, malpractice claims history, and the exhaustive curriculum vitae (CV) data requisite for populating profiles on the Council for Affordable Quality Healthcare (CAQH) ProView database.
• Digital Interaction and Behavioral Data: When interacting with our web portals, we automatically collect log files, IP addresses, browser typologies, and session data. We may also utilize cookies or session replay technologies for quality assurance and to enhance the functionality of our secure client portals.

3. Utilization and Transmission of Information
Exp Credentialing Services operates primarily as a data processor and intermediary credentialing delegate between your healthcare organization and various commercial and federal payers (e.g., CMS/Medicare, Medicaid, BlueCross BlueShield). The data collected is actively and strictly utilized to:
• Execute complex provider enrollment applications, conduct Primary Source Verification (PSV), and strategically negotiate payer contracts on your behalf.
• Initialize, populate, and maintain compliance attestations on secure clearinghouses and credentials verification organizations, such as CAQH.
• Facilitate end-to-end revenue cycle management operations and claim scrubbing via secure clearinghouses, executed strictly under the parameters of executed Business Associate Agreements (BAAs).
We unequivocally do not sell, rent, or trade your personal, professional, or corporate data to unaffiliated third parties for marketing or promotional objectives.

4. Sub-Processors and Third-Party Disclosures
We may disclose necessary data subsets to authorized third-party service providers and sub-processors who assist us in hosting, analytics, IT support, and secure data storage. All such third-party engagements are governed by strict confidentiality agreements and BAAs that mandate data protection standards compatible with and at least as protective as our own internal policies.

5. Security Safeguards and Regulatory Compliance (HIPAA)
We maintain a rigorous architecture of administrative, technical, and physical safeguards designed to ensure absolute compliance with the Health Insurance Portability and Accountability Act (HIPAA) Privacy and Security Rules, as well as applicable state data privacy mandates. All Protected Health Information (PHI) and sensitive practitioner documentation are transmitted and stored utilizing enterprise-grade, end-to-end encryption protocols in transit and at rest. Furthermore, our infrastructure utilizes role-based access controls (RBAC) to ensure that sensitive data is accessible exclusively to authorized credentialing personnel.

6. International Data Transfers
In the event that our operational architecture requires the transfer of data across international borders, such transfers are executed utilizing legally recognized transfer mechanisms, including Standard Contractual Clauses (SCCs), to ensure that the receiving entities maintain data protection protocols that mirror domestic legal standards.

7. Data Retention Protocols
We retain your personal and practitioner credentialing data exclusively for the duration necessary to fulfill the business purposes delineated in your executed Master Service Agreement (MSA) and to manage ongoing re-credentialing schedules. Upon the termination of our engagement, data will be retained or securely destroyed in accordance with legally mandated retention periods relevant to healthcare compliance and federal auditing standards.

8. Jurisdictional and State-Specific Privacy Rights
Depending upon your geographic jurisdiction, you may be entitled to specific statutory rights under legislations such as the California Consumer Privacy Act (CCPA), the Virginia Consumer Data Protection Act (VCDPA), or the Washington My Health My Data Act (MHMDA). Subject to legal and contractual limitations, these rights may afford you the ability to:
• Request formal access to the specific categories of data we process.
• Request the correction of materially inaccurate or incomplete credentialing data.
• Request the deletion or restriction of your historical credentialing profiles upon the formal termination of your contract.
To exercise these rights, requests must be submitted in writing to our designated Compliance Officer through our official contact channels.

9. Dynamic Policy Modifications
Given the rapidly evolving nature of healthcare compliance laws, state medical board regulations, and federal data requirements, we reserve the right to dynamically amend this Privacy Policy. Your continued utilization of our website and our B2B services following the posting of any updates constitutes your legal acknowledgment and acceptance of those modifications.

Acknowledge & Close

Terms of Service

×

1. Acceptance of Terms
By accessing the website or utilizing the services provided by Exp Credentialing Services (“Company,” “we,” “us,” or “our”), you (“Client,” “Provider,” or “User”) agree to be bound by these Terms of Service (“Agreement”). If you do not agree to these terms, you are prohibited from using our website or services. This Agreement governs all aspects of the provider credentialing, enrollment, revenue cycle management (RCM), and related administrative services provided by the Company.

2. Description of Services
Exp Credentialing Services provides business-to-business healthcare administrative services, including but not limited to primary source verification, commercial and government payer enrollment (e.g., Medicare, Medicaid), CAQH profile management, hospital privileging, and revenue cycle management. We act as an administrative agent on your behalf. We do not guarantee credentialing approval, specific reimbursement rates, or network inclusion, as final determinations rest solely with the respective insurance payers, hospitals, or regulatory bodies.

3. Client Obligations and Accuracy of Information
3.1. Document Submission: Client agrees to provide all requested documentation promptly.
3.2. Representation of Accuracy: Client warrants that all information provided is true, accurate, current, and complete. The Company shall not be held liable for any delays, application rejections, or financial losses resulting from omitted, falsified, or expired information provided by the Client.
3.3. Duty to Update: Client must immediately notify the Company of any changes to their professional standing, including disciplinary actions, malpractice claims, or license expirations.

4. Fees, Billing, and Non-Refundability
4.1. Payment Terms: Fees for services will be outlined in a separate Service Agreement or invoice.
4.2. Non-Refundable Services: Due to the administrative nature of credentialing, all fees paid are strictly non-refundable once the Company has initiated the application or verification process, regardless of the final credentialing decision made by the payer or facility.
4.3. Late Payments: Failure to remit payment within fifteen (15) days of the invoice date may result in the immediate suspension of all services. Unpaid balances are subject to a late fee of 1.5% per month or the maximum amount permitted by law.

5. Limitation of Liability
TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, IN NO EVENT SHALL EXP CREDENTIALING SERVICES, ITS AFFILIATES, DIRECTORS, EMPLOYEES, OR AGENTS BE LIABLE FOR ANY INDIRECT, PUNITIVE, INCIDENTAL, SPECIAL, CONSEQUENTIAL, OR EXEMPLARY DAMAGES. The Company is not responsible for processing delays caused by third parties, including CMS, state medical boards, or commercial insurance networks. In no event shall the Company’s cumulative liability to the Client exceed the total amount paid by the Client to the Company for the specific service in dispute during the three (3) months immediately preceding the claim.

6. Indemnification
Client agrees to defend, indemnify, and hold harmless Exp Credentialing Services and its personnel from and against any and all claims, damages, obligations, losses, liabilities, costs, or debt, and expenses (including but not limited to attorney’s fees) arising from Client’s use of and access to the services, Client’s violation of any term of this Agreement, or Client’s violation of any third-party right.

7. Confidentiality and Data Security (HIPAA)
Both parties agree to maintain the confidentiality of all proprietary business information. The handling of any Protected Health Information (PHI) in the scope of Revenue Cycle Management or related services shall be governed strictly by a separate Business Associate Agreement (BAA) executed between the parties.

8. Term and Termination
The Company reserves the right to terminate or suspend access to our services immediately, without prior notice or liability, for any reason whatsoever, including a breach of the Terms. Sections regarding Limitation of Liability, Indemnification, and Fees shall survive termination.

9. Force Majeure
Exp Credentialing Services shall not be held liable for any failure to perform its obligations if such failure results from circumstances beyond our reasonable control, including acts of God, governmental actions, cyber-attacks, global pandemics, or systemic failures of third-party payer portals.

10. Governing Law and Jurisdiction
This Agreement shall be governed by and construed in accordance with the laws of the State of New York. Any legal action or proceeding arising under this Agreement will be brought exclusively in the federal or state courts located in New York County, New York.

11. Amendments
We reserve the right, at our sole discretion, to modify or replace these Terms at any time. Continued use of the services after any such changes constitutes your acceptance of the new Terms of Service.

12. Contact Information
Exp Credentialing Services — 383 Madison Ave, New York, NY 10179
Email: info@expcredentialingservices.com

Close

HIPAA Compliance

×

Our Commitment to Data Security
At Exp Credentialing Services, we understand that trust is the foundation of the healthcare industry. We are fully committed to maintaining the highest standards of data privacy and security, strictly adhering to the requirements of the Health Insurance Portability and Accountability Act of 1996 (HIPAA), the HITECH Act, and the final Omnibus Rule.

Our Role as a Business Associate
Exp Credentialing Services operates as a Business Associate to our clients (Covered Entities). We recognize our legal and ethical responsibility to safeguard all Protected Health Information (PHI) and Personally Identifiable Information (PII) that we access, process, or store on your behalf. We will not access or process any PHI until a formalized Business Associate Agreement (BAA) is executed between Exp Credentialing Services and your organization.

USA-Based Operations & Data Sovereignty
• 100% US-Based Team: All credentialing specialists, RCM account managers, and support staff are located within the USA. We do not offshore our core data processing.
• Domestic Data Storage: All client data, provider credentials, and PHI are stored on secure, HIPAA-compliant cloud servers geographically located within the United States.

Technical Safeguards
• End-to-End Encryption: All data in transit is encrypted using TLS 1.2 or higher. All data at rest is encrypted using AES-256 bit encryption.
• Access Controls: We utilize strict Role-Based Access Control (RBAC) — employees are granted the minimum level of access necessary for their specific job functions.
• Authentication: Multi-Factor Authentication (MFA) is required for all staff accessing internal networks, client portals, and databases.
• Audit Controls: Our systems automatically log all access and activity related to ePHI, creating a tamper-proof audit trail.

Administrative Safeguards
• Mandatory Training: Every employee undergoes comprehensive HIPAA privacy and security training upon hire, with mandatory annual re-certification.
• Designated Privacy Officer: We have a designated HIPAA Privacy and Security Officer overseeing our compliance programs.
• Vendor Management: Any third-party software or clearinghouse must pass a stringent security review and sign a BAA.

Physical Safeguards
• Facility Security: Our US office spaces feature monitored access controls ensuring only authorized personnel can enter data-processing areas.
• Workstation Security: We enforce clean-desk policies and automatic screen locks on all company devices. No unauthorized physical media is permitted on our network.
• Secure Disposal: Physical documents containing sensitive information are cross-cut shredded by a certified secure destruction vendor.

Breach Notification Protocol
In the unlikely event of a suspected or confirmed data breach involving your PHI, we are legally and contractually obligated to notify your designated compliance officer without unreasonable delay, allowing your organization to meet its federal and state breach notification requirements.

Contact Our Compliance Team
Exp Credentialing Services — Attn: HIPAA Privacy & Security Officer
383 Madison Ave, New York, NY 10179
Email: info@expcredentialingservices.com

Close