Compliance

Built for the rules that govern PI referrals.

MediLink handles protected health information and case data. We treat compliance as a baseline requirement, not an afterthought.

Last updated: May 19, 2026

HIPAAAdministrative, physical, and technical safeguards across the platform.
EncryptionPHI encrypted in transit (TLS 1.2+) and at rest (AES-256).
BAA availableBusiness Associate Agreement presented and accepted at onboarding. A countersigned copy is available on request.
Provider verificationPractices verified against the CMS NPPES registry, with government-issued photo ID checked at signup.

HIPAA

MediLink is a covered entity's business associate when it processes protected health information (PHI) on behalf of medical providers and law firms. We maintain administrative, physical, and technical safeguards consistent with the HIPAA Privacy and Security Rules, including:

  • Access controls with role-based permissions and least-privilege defaults
  • Encryption of PHI in transit (TLS 1.2+) and at rest (AES-256)
  • Audit logging on all PHI access, with tamper-evident retention
  • Workforce training on HIPAA and incident response
  • Documented breach notification procedures consistent with 45 CFR §164.400

Every clinic and firm accepts our Business Associate Agreement at onboarding, and you can read it in full at medilink.vip/baa before you sign up. We are glad to execute it by signature, or to review your own BAA form, on request. We also require a BAA with each infrastructure subprocessor that handles PHI on our behalf.

Data security

  • Hosted on U.S. cloud infrastructure
  • Multi-factor authentication required for all staff and admin accounts
  • Production access restricted to a small, audited group of engineers
  • Continuous vulnerability scanning and periodic third-party penetration testing
  • Backups encrypted and geographically replicated; documented recovery objectives

Provider verification

Before a clinic is matched with referrals, we verify:

  • National Provider Identifier (NPI) and provider taxonomy
  • State medical license status with the applicable licensing board
  • Active malpractice coverage with sufficient limits
  • Sanction screening against OIG-LEIE and SAM exclusion lists

State law & PI-specific rules

Personal injury referrals are governed by overlapping state rules — including fee-splitting, anti-kickback, and physician self-referral restrictions. MediLink's operating model is designed so that attorneys and clinics each contract directly with MediLink for software and verification services, not for case-by-case referral payments. Availability and pricing of certain features may vary by state.

MediLink does not provide legal advice. Each user is responsible for confirming that its use of the platform complies with the bar rules and medical practice regulations of the jurisdictions in which it operates.

Reporting a security issue

If you believe you've found a security vulnerability or a privacy incident affecting MediLink, please call us at +1 (833) 407-1005. We acknowledge reports within one business day and respond on a coordinated-disclosure basis.