MedBillPay911 Privacy Policy
Last updated: October 19, 2026
DRAFT — FOR ATTORNEY REVIEW. This draft was prepared as a starting point and is not legal advice. Have it reviewed by counsel familiar with HIPAA and your state's privacy laws before publishing. Bracketed items require your input.
1. Who we are
MedBillPay911 ("MedBillPay911," "we," "us") is a healthcare billing platform operated by Medical Billing and Consulting 911 (MBC911), a Texas single-member LLC, located at 10998 South Wilcrest Drive, Suite 206, Houston, TX 77099. MedBillPay is a joint venture between Cedric LaRue and Sandra Owens and an MBC911 product. MedBillPay911 helps healthcare practices ("Practices") generate patient statements, deliver them by email and text message, and collect payments through a secure online portal.
ATTORNEY REVIEW REQUIRED: Confirm the operating entity's legal designation and entity-type wording. This identity update does not resolve the draft's remaining legal-review items.
This policy explains what information we collect, how we use it, and the choices you have. It applies to the MedBillPay911 website, patient payment portal, and staff application (together, the "Services").
2. An important note about your health information
MedBillPay911 processes billing information on behalf of your healthcare Practice. When we handle information that identifies you and relates to your healthcare or payment for healthcare — such as your name, dates of service, service descriptions, and amounts owed — that information is Protected Health Information ("PHI") under the Health Insurance Portability and Accountability Act ("HIPAA").
For PHI, your Practice is the "covered entity" and MedBillPay911 is its "business associate." That means:
- Your Practice's Notice of Privacy Practices — not this policy — is the primary document governing how your health information may be used and disclosed. Contact your Practice to obtain a copy.
- MedBillPay911 uses and discloses PHI only as permitted by our Business Associate Agreement with your Practice and by HIPAA, generally limited to billing, payment, and related administrative services.
- Requests to access, amend, or restrict your health records should be directed to your Practice. We will assist your Practice in responding as required by law.
3. Information we collect
Information your Practice provides to us: your name, contact details (mailing address, email address, phone number), date of birth, patient account number, dates of service, service descriptions, charges, insurance adjustments, and balances.
Information you provide: portal login details, identity-verification responses (such as date of birth), payment information, communication preferences, and any messages you send through the Services.
Payment information: card and bank account details are collected directly by our payment processor, [Stripe, Inc.], through fields embedded in the portal. MedBillPay911 does not receive or store full card or bank account numbers. We retain only references issued by the processor together with limited display data (such as card brand and last four digits).
Information collected automatically: IP address, device and browser type, pages viewed, and timestamps. We use session cookies that are necessary for login and security. [We do not use advertising or cross-site tracking cookies. / Describe analytics cookies if any are added.]
4. How we use information
We use information to: deliver statements and payment reminders by email and SMS; process payments and issue receipts; verify identity and secure accounts (including two-factor authentication); maintain records for the Practice; respond to support requests; monitor, audit, and secure the Services; comply with legal obligations; and improve the Services using de-identified or aggregated data that does not identify you.
We do not sell personal information, and we do not use PHI for advertising or marketing.
5. When we share information
We share information only with:
- Your Practice and its authorized staff;
- Service providers that help us operate the Services — including payment processing [Stripe], text messaging [Twilio], email delivery [PROVIDER], and hosting [PROVIDER] — each bound by contracts, and where PHI is involved, by Business Associate Agreements, that restrict their use of the information;
- Legal and safety recipients, where required by law, subpoena, or to protect the rights, safety, or property of patients, Practices, or the public;
- A successor entity, if MedBillPay911 is involved in a merger, acquisition, or sale of assets, subject to the same protections and, for PHI, the requirements of HIPAA and our Business Associate Agreements.
6. Text messages and email
If your Practice has your consent (or another lawful basis) to contact you, you may receive billing notifications by email or SMS. Message and data rates may apply for SMS. You can opt out of SMS at any time by replying STOP, and out of email reminders through the portal or by contacting your Practice. Opting out of reminders does not eliminate your responsibility for amounts you owe, and your Practice may contact you by other means, including mail.
7. Security
We maintain administrative, technical, and physical safeguards designed to protect the information we process, including encryption of data in transit, role-based access controls, two-factor authentication for staff accounts, and audit logging of access to patient records. No system is perfectly secure; if a breach affecting your information occurs, we will notify your Practice and cooperate in any legally required notifications.
8. Retention
We retain information for as long as needed to provide the Services to your Practice and as required by our agreements and by law. HIPAA requires business associates to retain certain records for at least six years. Activity and audit log records are retained for seven years. Those logs are append-only for all users, including administrators, and may be permanently removed only by the automated retention process after they are older than seven years. When other information is no longer required, we delete or de-identify it, or return it to the Practice as our agreements provide.
9. Your choices and rights
- Portal account: you can review your statements and payment history, and update saved payment methods, in the portal.
- Health record rights (access, amendment, accounting of disclosures, restrictions): contact your Practice.
- State privacy rights: depending on where you live, you may have additional rights over personal information that is not PHI (PHI is generally exempt from state consumer-privacy laws). To exercise them, contact us at info@medbillpay911.com. We will not discriminate against you for exercising any privacy right.
- Do Not Track: the Services do not respond to browser Do Not Track signals. [Confirm.]
10. Children
The Services are not directed to children. A parent or guardian may manage billing for a minor patient; portal accounts are intended for adults. We do not knowingly collect information from anyone under 13 outside of billing records provided by a Practice.
11. Changes to this policy
We may update this policy from time to time. We will post the updated version with a new "Last updated" date and, for material changes, provide notice through the Services.
12. Contact us
Medical Billing and Consulting 911 (MBC911)
10998 South Wilcrest Drive, Suite 206, Houston, TX 77099
info@medbillpay911.com · (281) 701-8950
For questions about how your Practice uses your health information, or to exercise HIPAA rights, contact your Practice directly.