Subprocessors
Last updated: 2026-09-24
ClaimCare Pro uses the following third-party processors. Vendors marked Signed have a Business Associate Agreement on file under 45 CFR §164.504(e). Vendors marked Not in scope do not access Protected Health Information.
Active subprocessors
| Vendor | Service used | PHI scope | BAA status | Signed evidence |
|---|---|---|---|---|
| Amazon Web Services | DynamoDB, S3, Lambda, Cognito, CloudWatch, SNS, KMS, AppSync, Bedrock | All PHI at rest and in transit — primary data store | Signed | AWS Artifact, accepted 2026-09-24 |
| Anthropic (Claude models, via AWS Bedrock) | Superbill extraction, denial triage, coding-suggest | Superbill PDFs and claim text sent to Bedrock for inference | Signed | Covered under the AWS BAA — invoked only via Amazon Bedrock (IAM auth, no direct API key); no separate Anthropic agreement exists |
| Claim.MD | 837P/EDI claim submission and 835 ERA retrieval | Full claim payload (subscriber + service lines) and remittance | Signed | Per Claim.MD account dashboard |
| Square | Patient card-not-present payment processing | Patient name, billing address, amount, transaction ID — no diagnosis, no treatment | Signed | Square seller dashboard |
| Vercel / Amplify Hosting | Static asset CDN; SSR runs in customer-region AWS Lambda | No PHI — static marketing assets only | Not in scope | — SSR Lambda runs inside our AWS account, covered by AWS BAA. |
| GitHub | Source code hosting | No PHI — code only; CI runs against synthetic seed data | Not in scope | — |
Customer Business Associate Agreement
ClaimCare Pro signs a BAA with every customer covered entity before any PHI flows through the service.
Download the ClaimCare Pro Business Associate Agreement (PDF)
To request a signed copy — or to send us a pre-signed or negotiated agreement — contact privacy@accuratebillingandcoding.com and we will provide it directly.
Notification of new subprocessors
When ClaimCare Pro adds a new subprocessor that will process PHI, we update this page and notify customers by email at least 30 days in advance. Customers may object to the new subprocessor per the terms of their signed BAA.