Security & technology
Know the environment your data lives in.
Prospective clients should be able to see how we run security — not a wall of certifications theater. OneSource maintains a HIPAA posture with practical guardrails, and we name the tools we use so you can evaluate fit.
Photo: Unsplash
Practical guardrails
MFA, BAAs, least privilege, and annual training — described plainly.
We name the environment so prospective clients can evaluate fit, and identify commercial relationships only where they exist.
Transparency
Know the environment your data lives in.
Microsoft, SharePoint, Zendesk, Telzio, RingCentral, Retell AI, BastionGPT, and OneSource OS support different parts of the operating environment.
Photo: Unsplash
HIPAA posture in plain language
We design workflows and tooling around HIPAA expectations: minimize unnecessary PHI, keep protected information in controlled U.S.-based systems, enforce multi-factor authentication, limit access by role, and train annually. We describe the controls we actually run — and we keep improving them as the operation and OneSource OS mature.
No offshore PHI handling
Core RCM, billing, credentialing, prior auth, denial management, and payer follow-up stay in house. Protected health information is not shipped offshore for processing.
Secure access and MFA
Access to operational systems is identity-controlled, multi-factor authenticated, and scoped to the work someone is actually doing — not a shared inbox free-for-all.
BAAs for applicable workflows
Where tools are used for HIPAA-regulated workflows, we maintain Business Associate Agreements and treat those vendors as part of the controlled environment — not casual consumer apps.
Least privilege and auditability
Role-based access, structured storage, and the ability to see who touched operational work when it matters. Terminated access is revoked promptly.
Annual HIPAA training
People doing the work complete annual HIPAA compliance training. Process discipline matters as much as the software stack.
Technology used in our work
These are systems OneSource uses to run the business and protect client data. Vendor links open in a new tab.
Microsoft ecosystem
Microsoft 365 business infrastructure with BAA — including identity (Entra), device management (Intune), Teams collaboration, and SharePoint document storage with BAA for applicable HIPAA-regulated document workflows. Encryption in transit and at rest, MFA, and role-based access are part of how we operate day to day.
SharePoint document storage
Structured document storage inside the Microsoft environment with BAA — used for operational packets and records that need controlled access, not casual file sprawl.
Zendesk
Client support and operational ticketing with BAA for applicable workflows — so conversations about claims, enrollments, and follow-through live in a controlled channel.
Telzio
A cloud communications platform OneSource uses in daily workflows. Telzio connectivity is built into OneSource OS, and OneSource RCM is an authorized reseller that can provision, configure, and provide first-line account support. Telzio documentation and account agreements control product capabilities, fees, service levels, data practices, and availability.
Explore Telzio through OneSource RCMRingCentral
Business communications with BAA for applicable workflows — another controlled channel for operational conversations.
Retell AI
Voice AI tooling used in controlled operational contexts where applicable.
BastionGPT
Healthcare-oriented AI environment used where appropriate for operational support work.
OneSource OS
Internally developed RCM operations software secured with enterprise-grade encryption and hosting, protected inside our secure Microsoft environment. Built so enrollment, documents, communications, and claims follow-through have a durable place to live — with human approval still required for consequential actions.
Read more about OneSource OS
Technology names explain the environment we work in. Unless a commercial relationship is stated, listing a product does not imply sponsorship, endorsement, certification, or partnership. OneSource RCM is an authorized Telzio reseller.
Clearinghouses, payer portals, and similar utilities may be used as conduits for claims and enrollment work. That is not the same as outsourcing your revenue cycle labor. If you want to know exactly how a workflow is handled for your practice, ask — transparency is part of the relationship.
Tell us about your practice
Describe the practice, systems, payer mix, and operational issue you want reviewed.