RCM Staff Trust Center
Security, privacy, and compliance resources for clients, prospects, and partners working with RCM Staff.
RCM Staff supports U.S. healthcare organizations with compliance-aware offshore revenue cycle staffing. This Trust Center summarizes our approach to HIPAA-aligned operations, workforce confidentiality, remote work security, access control, and vendor oversight.
RCM Staff is led by Kevin Jamito, CPC, CPB, CPPM, CRCR, CHBME, bringing 18+ years of U.S. healthcare revenue cycle experience to the company's staffing and compliance approach.
A compliance-aware operating model
Practical safeguards designed to support regulated U.S. healthcare workflows across distributed revenue cycle teams.
HIPAA-Aligned Operations
RCM Staff maintains documented policies and procedures designed to support regulated healthcare workflows. Our operational approach is built around privacy, security, and careful handling of protected health information.
Workforce Confidentiality
Team members are expected to follow confidentiality, acceptable use, and minimum necessary standards when supporting client workflows. Workforce training and sanctions policies help reinforce proper handling of sensitive information.
Secure Remote Work Standards
RCM Staff's remote work standards are designed to reduce risk across distributed healthcare support teams. Device security, account separation, MFA, and access controls are core parts of our operating model.
Client-Specific Access Controls
Access is managed based on client workflow needs and the minimum necessary principle. RCM Staff team members use client-approved systems and follow client-specific access procedures, including dedicated VPN connections into a client's network where their environment requires it rather than shared or generic remote access.
How we protect client data
These are the controls in place today. Our security model is still evolving: we are building a SOC 2 readiness program and ISO 9001-aligned quality practices, and we update this list as controls change.
Background checks
Staff complete a background check before they are placed on a client account.
HIPAA training before PHI access
Every team member with access to protected health information completes HIPAA training.
A signed BAA with every client
RCM Staff LLC signs as your Business Associate, with RCM Staff BPO named as our Philippine offshore affiliate.
Multi-factor authentication
MFA is required on RCM Staff company accounts.
A separate work account for client work
All client work runs through a dedicated RCM Staff Microsoft 365 work account, kept apart from personal accounts.
Microsoft Intune device management
Devices used for client work are enrolled in Microsoft Intune so device policies are managed centrally.
Workstation options
By default, specialists use their own device with a separate, managed work profile. A Windows 365 Cloud PC hosted in U.S. Azure regions, or a company-managed Lenovo ThinkPad, is available as an add-on.
U.S. network access when required
When a client requires U.S. IP addresses, specialists connect through a managed VPN with a U.S. exit node (AWS, Ohio region) or work through the client's own remote desktop environment.
Same-day offboarding
When a specialist leaves an account, their access is removed the same day and the client is informed.
Cyber liability insurance
A cyber liability policy with a $1,000,000 limit per claim sits behind these controls. Coverage details
Passwordless client portal sign-in
Clients sign in to the RCM Staff Client Portal with a one-time code sent to their email, so there is no portal password to manage.
RCM Staff does not currently hold SOC 2, ISO, or HITRUST certification. Controls describe our operating model and do not replace your own HIPAA obligations.
Cyber liability coverage behind the safeguards
Controls reduce the likelihood of an incident. Insurance addresses what happens if one occurs anyway. RCM Staff carries a cyber and data risk liability policy placed with an A-rated carrier, so vendor reviewers evaluating us have something concrete to record alongside our policies.
Cyber liability coverage is not a substitute for compliance, and it does not replace your own insurance program or HIPAA obligations. Coverage terms, limits, and exclusions are governed entirely by the policy. A current certificate of insurance is available on request below.
Revenue Cycle Expertise Behind RCM Staff
RCM Staff is led by Kevin Jamito, a U.S. healthcare revenue cycle professional with 18+ years of experience supporting medical billing, coding, collections, and practice management workflows. His background includes professional certifications and association involvement across medical coding, billing, revenue cycle, and healthcare business management.
These are individual certifications and professional affiliations held by Kevin Jamito. They reflect founder-level credentials and do not represent a company-level certification or accreditation of RCM Staff by AAPC, HFMA, or HBMA.
Compliance Resources Available Upon Request
The following documents are available to qualified prospects, clients, and partners. Requests are reviewed before any document is shared.
Security Overview
SecuritySummary of RCM Staff's security practices, remote work controls, and compliance-aware operating model.
Available upon requestHIPAA Privacy and Security Policy
HIPAAInternal policy framework for privacy, security, and PHI handling responsibilities.
Available upon requestPHI Handling and Minimum Necessary Policy
HIPAAGuidance for handling protected health information using the minimum necessary standard.
Available upon requestWorkforce Confidentiality and Acceptable Use Policy
WorkforceStandards for confidentiality, acceptable system use, and workforce behavior.
Available upon requestRemote Work and Device Security Policy
SecurityRequirements for remote work environments, device safeguards, access separation, and secure work practices.
Available upon requestAccess Control Policy
SecurityProcedures for user access, role-based permissions, account management, and access reviews.
Available upon requestIncident Response and Breach Escalation Policy
SecurityProcess for reporting, escalating, investigating, and responding to suspected security or privacy incidents.
Available upon requestHIPAA Training and Sanctions Policy
WorkforceWorkforce training expectations and consequences for policy violations.
Available upon requestVendor/Subcontractor and BAA Policy
Vendor ManagementStandards for vendor oversight, subcontractor review, and business associate agreement handling.
Available upon requestData Retention and Disposal Policy
Data GovernanceGuidelines for retention, secure disposal, and lifecycle management of sensitive information.
Available upon requestBusiness Associate Agreement Template
Legal / HIPAATemplate agreement available for qualified clients when business associate terms are required.
Available upon requestSubprocessor List
Vendor ManagementList of key systems and service providers used to support RCM Staff operations.
Available upon requestCertificate of Insurance (COI)
Insurance / RiskCurrent certificate evidencing RCM Staff's cyber liability coverage, including carrier, limits, and policy period.
Available upon requestRequest RCM Staff's Compliance Packet
Qualified prospects, clients, and partners may request access to selected compliance documents. Requests are reviewed before documents are shared.
Compliance Contact
For compliance-related inquiries, contact compliance@rcmstaff.com.