Read Me — Transmitting PHI Through This Portal
Why this upload channel satisfies your obligations under the HIPAA Security Rule, and what evidence we will put in your hands to prove it.
The short version. Uploading a census or claims file here is materially safer than emailing it, and it is the method medTRANS requires. Email attachments travel through mail servers you do not control, sit indefinitely in sent folders and inboxes, and are the single most common source of reportable PHI breaches in the broker channel. This portal opens an encrypted, authenticated, logged, one-way channel from your browser directly into the medTRANS case file — the file never becomes an email attachment, never lands in a shared mailbox, and never leaves U.S.-based HIPAA-compliant infrastructure. A Business Associate Agreement is already in place between medTRANS and the hosting provider, and medTRANS will execute a BAA with you or your client's plan on request before you upload anything.
Please do not email PHI to us. If you have already prepared a submission as an email attachment, upload it here instead. If you have already sent PHI to any medTRANS or Complete Captive address by unsecured email, tell us — we will confirm receipt, purge the message, and document it. Reporting it costs you nothing; not reporting it is what creates exposure.
HIPAA Security Rule — Control Mapping
The Security Rule does not certify vendors; it requires safeguards. Below is each transmission-relevant standard, the control that satisfies it here, and who owns it.
| Standard | 45 CFR | How this portal satisfies it | Owner |
|---|---|---|---|
| Transmission Security | §164.312(e) | All traffic to this form is forced over HTTPS/TLS 1.2 or higher with modern cipher suites; plaintext HTTP is refused. File payloads are encrypted in transit and re-encrypted at rest on arrival. | medTRANS |
| Encryption at Rest | §164.312(a)(2)(iv) | Uploaded files and the case database are stored on encrypted volumes (AES-256). Backups are encrypted with the same standard. | medTRANS |
| Access Control | §164.312(a)(1) | Submissions are deposited into a permissioned case-file store accessible only to Underwriting and Executive teams. Every user has a unique account with MFA. | medTRANS |
| Audit Controls | §164.312(b) | Upload, access, download, and deletion events are logged with user, timestamp, and IP, producible on request. | medTRANS |
| Integrity | §164.312(c)(1) | Each file is checksummed on receipt and verified against the stored copy. | medTRANS |
| Person / Entity Authentication | §164.312(d) | The certification block captures the named submitter; output returns only to the recipient designated on this form. | Shared |
| Business Associate Contracts | §164.308(b)(1) §164.502(e) | medTRANS holds executed BAAs across hosting, case-file storage, and the AI/automation layer used in intake, and executes one with you or the covered entity on request. | Shared |
| Minimum Necessary | §164.502(b) | We ask only for fields underwriting rates on. Do not send SSNs, street addresses, or named diagnosis detail unless a field calls for it. | You |
| Breach Notification | §164.410 | medTRANS notifies the covered entity without unreasonable delay and no later than 60 calendar days after discovery of a breach of unsecured PHI. | medTRANS |
The Detail — Expand What You Need
▸ Where the data physically lives: Atlantic.Net HIPAA-compliant hosting Third-party audited
This portal and its case-file storage run on Atlantic.Net HIPAA-Compliant Hosting (HIPAA Business tier) — a dedicated, managed, audited environment purpose-built for ePHI.
- A signed Business Associate Agreement for every HIPAA customer.
- Independent HIPAA/HITECH audit (AT-C 105/205).
- SOC 2 Type II and SOC 3 Type II, audited annually.
- HITRUST-audited data centers, ISO 27001 certified.
- Managed firewall, IDS/IPS, encrypted VPN admin access, log inspection, file-integrity monitoring.
- Encrypted onsite and offsite backups.
- U.S.-based private data centers, 24/7/365 staffed support.
▸ Who can actually see your submission — the access model Restricted by design
- Receipt: automated intake validates the submission and confirms attachments against the requested tier.
- Deposit: files go into a permissioned case-file folder for that employer group — the only copy of record.
- Access: restricted to the Underwriting and Executive teams. No sales, marketing, or general staff access.
- Excluded by design: developers, infrastructure engineers, and vendors hold no PHI access; production PHI is never copied into dev/test.
- AI/automation: runs under an enterprise agreement with an executed BAA; submitted data is not used to train third-party models.
- Output: only the finished Illustration/Indication/Proposal leaves the case file, to the recipient you designate.
▸ Honest scope: what the hosting provider does not cover Shared responsibility
Compliant infrastructure is the floor, not the building. medTRANS's own side of the line includes:
- Application-layer security: TLS enforcement, upload validation, malware scanning, injection/traversal protection.
- Identity and access management: unique accounts, MFA, role-based authorization, periodic access reviews.
- Application audit logging of who opened which case file and when.
- Workforce controls: HIPAA training, confidentiality agreements, background checks, sanctions policy.
- Written policies and a current risk analysis, reviewed annually.
- Named Privacy Officer and Security Officer.
- Incident response and breach notification procedures.
- Downstream BAAs with every subcontractor that touches PHI.
- Retention/secure destruction of submissions that never bind, and third-party penetration testing of this application.
▸ Why this portal is safer than the email you were about to send
Brokers frequently assume email is acceptable because it is customary. Customary is not the standard; §164.312(e) is. Compare:
| Risk | Email attachment | This portal |
|---|---|---|
| Encryption in transit | Opportunistic at best — TLS between mail servers is not guaranteed and silently downgrades to plaintext | Enforced TLS 1.2+; plaintext connections refused |
| Misdelivery | One autocomplete error sends a full census to the wrong recipient — the leading cause of reportable breaches | No addressee to mistype; the channel has exactly one destination |
| Persistence | Copies live in your sent folder, our inbox, both mail archives, and every mobile device that synced | One controlled copy in the case file, with a defined retention clock |
| Access control | Whoever has mailbox access has the PHI, including delegates and assistants | Role-scoped to the assigned underwriting team |
| Audit trail | Effectively none — you cannot prove who opened it | Immutable log of every access event, producible on request |
| Onward forwarding | Trivial and untracked | Governed by the Outbound Communication and Recipient Protocol |
▸ What to strip before you upload — minimum necessary
- Remove Social Security numbers entirely. Use the TPA's member/subscriber ID instead.
- Names are optional — a unique subscriber ID plus dependent sequence is sufficient at every tier. Keep the family key intact.
- ZIP code only — five digits. Street addresses are not used in rating.
- Large-claim reports: diagnosis and claimant ID are needed for clinical review; claimant names are not.
- Do not password-protect files — the channel is already encrypted.
▸ Retention, destruction, and what happens if the case never binds
- Bound cases: retained as the underwriting file of record for the policy term plus statutory/reinsurance retention.
- Declined/non-bound submissions: retained 24 months, then securely destroyed per NIST SP 800-88.
- Early deletion on request, subject to legal-hold obligations, confirmed in writing.
- No secondary use — your client's PHI is used only to underwrite your client's case.
▸ Your own obligations as the sending party
1. Confirm your authority to disclose. Your disclosure to medTRANS rests on your own BAA with the plan or written authorization from the plan sponsor — we cannot cure its absence.
2. Secure your own end. The encrypted channel starts at your browser; submit from a managed device and delete your working copy when the case closes.
Evidence We Will Put In Your Hands
Every item below is available to you, your client, or their auditor. Request them at compliance@completecaptive.com.
Business Associate Agreement
medTRANS's standard BAA plus confirmation the Atlantic.Net BAA is in force.
Available on request
SOC 3 Type II report
Public-facing attestation on security, availability, confidentiality controls.
Publicly shareable
SOC 2 Type II report
Full detailed control testing and auditor opinion.
Under NDA
HIPAA / HITECH audit attestation
Third-party CPA attestation covering administrative, physical, technical safeguards.
Available on request
Security Policy Summary
Access control, MFA, audit logging, workforce training, incident response.
Available on request
Subcontractor register
Every downstream party that may touch PHI, with confirmed executed BAAs.
Available on request
Risk analysis attestation
Confirmation of the date of our most recent §164.308(a)(1)(ii)(A) security risk analysis and remediation status.
Under NDA
Penetration test summary
Executive summary of the most recent third-party application penetration test, with remediation confirmation.
Under NDA
Breach notification procedure
Our §164.410 notification process, timelines, and the standing contact for reporting a suspected incident from your side.
Available on request
Access log for your submission
On request, the audit trail showing every medTRANS user who accessed your client's case file, with timestamps.
Available on request
Privacy & Security questionscompliance@completecaptive.com — ask for the Privacy or Security Officer by name.
Suspected incident on either sideReport immediately to compliance@completecaptive.com. Same-day acknowledgement.
Request for Stop-Loss Proposal
Fields marked * are required. Every field below matches the RFP Questionnaire PDF (CCMS 2026-08), page for page.
Drop supporting files for this case
Each zone below is owned by a named Claude Agent. Files route to that agent automatically on drop. All PHI/PII is transmitted through this secure, encrypted upload channel — never as an email attachment.