Security
Effective October 14, 2026
If you run a practice's revenue cycle, you need to know where your patient data goes and who can see it. This page explains how Appeals One, Inc. protects client data, in plain language.
Where your data lives
Client data and protected health information (PHI) live in AppealsOne's own environment on Amazon Web Services (AWS). That environment is covered by the AWS Business Associate Agreement. Client data is not stored on this website, and the website's forms are not used for PHI.
Encryption
Data is encrypted in transit, as it moves between your systems, payer portals, and ours. It is also encrypted at rest, while it is stored.
Who can access it
Access to client data is limited to the people who need it to do the work. Every one of them signs in with multi-factor authentication.
Logging and monitoring
Activity in our environment is logged and monitored, so we can see who accessed what and when, and spot anything unusual.
Business Associate Agreements
We sign a Business Associate Agreement with every client before we touch any PHI. That includes the free recoverable-dollars report. We also require a Business Associate Agreement from any vendor that touches PHI on our behalf.
Working inside your EMR
We work inside your existing EMR and practice systems with the access you grant us, and nothing beyond it.
Security questions and responsible disclosure
If you have a security question, or need details for your own vendor review, emailsecurity@appealsone.com.
If you believe you have found a security issue in our website or services, please report it to the same address. Include enough detail for us to reproduce it. Please give us reasonable time to fix the issue before sharing it publicly, and do not access, change, or keep any data that is not yours while testing. We will acknowledge your report and keep you updated.
Privacy
For how we handle information submitted through this website, see our Privacy Policy. Privacy questions can go to privacy@appealsone.com.