HIPAA Privacy Policy
This page describes how EnrollMD handles provider information, our data practices, and how we maintain privacy standards in our credentialing and enrollment workflows.
Last updated: January 2026
Our Role and Data Handling
EnrollMD provides provider credentialing and payer enrollment support services to healthcare providers and practice organizations. In performing these services, we may receive, handle, and transmit protected health information (PHI) and personally identifiable information (PII) on behalf of our clients.
We operate as a Business Associate under HIPAA when we handle PHI on behalf of covered entities. We maintain Business Associate Agreements (BAAs) with our clients where required by law.
Information We Collect
To perform credentialing and enrollment services, we may collect and process the following types of provider information:
- Provider name, contact information, and practice details
- National Provider Identifier (NPI)
- State medical licenses, DEA certificates, and board certifications
- Malpractice insurance certificates and coverage history
- Education, training, and work history documentation
- Social Security Number (SSN) or Tax Identification Number (TIN) - collected only through secure intake
- CAQH ProView credentials and profile data
- Medicare and Medicaid enrollment information
Secure Intake Practices
We do not collect sensitive provider documents through our public website contact form. This includes SSNs, license copies, malpractice certificates, DEA registrations, and any other sensitive credentials.
After initial contact through our website, we provide a secure intake process for document collection. This process uses encrypted file transfer and access controls appropriate for handling sensitive provider information.
How We Use Provider Information
Provider information we collect is used exclusively for the purpose of providing our credentialing and enrollment services, including:
- Preparing and submitting payer enrollment applications
- Setting up and maintaining CAQH ProView profiles
- Preparing Medicare PECOS enrollment applications
- Preparing state Medicaid enrollment documentation
- Tracking application status and follow-up requirements
- Maintaining credentialing files and recredentialing schedules
We do not sell, share, or disclose provider information to third parties for marketing, advertising, or other purposes unrelated to the services we are providing.
Data Retention
We retain provider information for the duration of our engagement and for a period thereafter as required by applicable law and our contractual obligations. Upon termination of services, we provide clients with copies of their provider files and securely dispose of retained copies in accordance with our data retention policies.
Third-Party Disclosures
In providing our services, we transmit provider information to payers, CMS, state Medicaid agencies, CAQH, and other entities as necessary to complete enrollment and credentialing applications on behalf of our clients. These disclosures are made in the course of service delivery and in accordance with applicable privacy law.
Website Data
Our website may use cookies and analytics tools to understand website usage and improve our services. We do not use website tracking tools to collect personal health information or sensitive provider credentials.
Our public website contact form should only be used to request a consultation or ask general questions. Do not submit sensitive provider documents, SSNs, license copies, or malpractice certificates through the public contact form.
Contact Us About Privacy
If you have questions about our privacy practices, data handling, or would like to request information about data we hold, please contact us through our secure channels.