Last reviewed: October 6, 2026

This HIPAA compliance statement describes how MCM South Medical Billing Service, LLC handles protected health information (PHI) for the mental and behavioral health practices we serve. It describes our role. It is not a certification, and it is not legal advice. For the HIPAA basics, start with HHS.

1. HIPAA compliance statement: our role as a business associate

MCM South is a business associate. A business associate is an organization that performs functions on behalf of a covered entity that involve PHI. Your practice is the covered entity. We handle PHI only to perform the billing work you ask for, such as eligibility checks, claim submission, denial follow-up, appeals, and credentialing.

2. Who is responsible for what

HIPAA compliance is shared among three parties, and this HIPAA compliance statement shows where each one fits.

• Your practice decides who can access PHI, trains its staff, and runs its own risk assessments.
• Your EHR or practice-management vendor secures its own platform.
• MCM South uses PHI only for the billing services you request, and follows the Privacy Rule and Security Rule requirements that apply to business associates. See HHS on the Security Rule.

No billing company can make a practice compliant on its own. Choose partners who say so.

3. Minimum necessary

The minimum necessary standard limits PHI use and disclosure to what a task needs. For us, that means sending a payer only what it needs to process a claim, verify a benefit, or review an appeal. Credentialing needs far less PHI than appeals do, and we treat each task that way.

4. Breach notification

The Breach Notification Rule requires notice when unsecured PHI is breached. Business associates must notify the covered entity, and the covered entity has its own notice duties. State laws can add requirements, so practices should check the law where their patients live. If you suspect an incident involving our systems, contact us right away through the contact page.

5. Substance use disorder records (42 CFR Part 2)

Records from certain substance use disorder programs get extra protection under 42 CFR Part 2. If any of your records fall under Part 2, tell us before you share them so we can handle them correctly. Your practice, with counsel, decides whether Part 2 applies.

6. State law can be stricter

Some states protect mental health records more tightly than HIPAA does, and the rules differ from state to state. Practices that treat patients in more than one state should keep their compliance documents for each. Confirm with counsel or a compliance officer where real exposure exists. This HIPAA compliance statement is operational guidance for practices, not a substitute for that advice.

Does HIPAA apply to a medical billing company?

Yes. A billing company that creates, receives, maintains, or sends PHI for a provider is a business associate, and HIPAA applies to it directly for the rules that cover business associates. For a practice, that means the billing partner you choose is part of your compliance picture, not outside it.

What this means day to day

• We use PHI only for the billing services you request.
• We limit what we use and send to what each task needs.
• We send claims, appeals, and credentialing files to payers and clearinghouses only as those tasks require.
• We do not ask for PHI through this website.
• We do not claim a HIPAA certification. This HIPAA compliance statement describes our role and nothing more.

If a payer, auditor, or your own compliance officer needs more detail about how we work, ask us through the contact page.

Do not send PHI through this website

Keep patient information out of contact forms and ordinary email. Read the Privacy Policy and Terms of Service alongside this HIPAA compliance statement. Questions about your practice? See who we serve, our services, and the billing FAQ, or schedule a free consultation.