Privacy Policy

We are in the business of helping healthcare and regulated organizations stay compliant, so protecting your information is not a side concern for us. It is the work. This notice explains, in plain language, what we collect, why we collect it, who we share it with, and the choices you have. If anything here is unclear, ask us. We would rather answer the question than leave you guessing.

Who this notice covers

This notice applies to the people and organizations we work with while providing credentialing, provider enrollment, compliance, and HR services. That includes:

• The practices, clinics, programs, and organizations that engage us, who we call our clients.
• The individual providers we credential and enroll on a client's behalf.
• People who contact us through our website, by email, or by phone.
• Vendors and professional partners we work with to deliver our services.

It does not cover information that has been anonymized or aggregated so that it no longer identifies anyone.

How we collect your information

We collect information in three main ways:

• Directly from you, such as when you fill out our contact form, email us, sign an engagement, or send us the documents we need to credential a provider.
• From sources you authorize us to use, such as state licensing boards, the National Practitioner Data Bank, CAQH, primary source verification organizations, and payers, as part of credentialing and enrollment.
• Automatically and minimally. Our website sets no advertising or tracking cookies and does not profile visitors. Our hosting provider keeps standard server logs, including IP addresses, for security and reliability.

What we collect

What we handle depends on the service, and for credentialing it is sensitive by nature. We treat it that way. It can include:

• Contact and business information, such as name, role, practice name, email, mailing address, and phone number.
• Provider credentialing information, such as Social Security number, date of birth, National Provider Identifier (NPI), DEA registration, state license numbers, education and work history, board certifications, malpractice history, and CAQH profile details.
• Account and payment information. Payments are processed by Stripe, and we do not see or store your full card or bank account numbers.
• Protected health information, only when an engagement requires it, and only under a Business Associate Agreement.
• Anything else you choose to send us, such as the contents of an email or a message through our contact form.

We practice data minimization. We ask for what the work requires, and nothing more.

How we use your information

We use your information to:

• Provide the services you or your organization hired us to perform, such as credentialing, enrollment, compliance program work, and HR support.
• Communicate with you about your engagement, your deadlines, and upcoming renewals.
• Submit applications and attestations to payers, CAQH, ProviderOne, PECOS, and other systems on your behalf.
• Verify credentials with the appropriate primary sources.
• Process payments and keep accurate business records.
• Meet our own legal, tax, and regulatory obligations, and protect against fraud.

We do not sell your information, we do not build advertising profiles, and we do not feed your data into third-party artificial intelligence products.

When we share your information

We share your information only as needed to do the work or to meet a legal obligation:

• With the payers, credentialing systems, and verification organizations required to credential and enroll your providers.
• With service providers who support our operations under confidentiality obligations, such as our website host, the email delivery service that carries contact-form submissions to us, our payment processor, and secure document storage.
• With the specialists and the referral attorney we bring into an engagement, under confidentiality agreements, and only as far as the work requires.
• When the law requires it, such as valid legal process, or to protect rights, safety, or property.
• As part of a business transaction, such as a sale or merger, in which case your information stays subject to this notice.

We do not sell your personal information, and we do not share it for anyone else's advertising.

HIPAA and health information

When we handle protected health information on behalf of a covered entity, we act as a Business Associate under HIPAA, and we sign a Business Associate Agreement before that work begins. In that role we use and disclose protected health information only as the agreement and the law allow. We also handle consumer health data consistent with the Washington My Health My Data Act and comparable Oregon requirements. Where an engagement involves a federally assisted substance use disorder program, we handle those records under 42 CFR part 2, which is stricter than HIPAA: consent is required before records are used or disclosed for treatment, payment or operations, records are not used in any proceeding against a patient absent consent or a qualifying court order, and every onward disclosure carries the notice that rule requires. Since February 16, 2026 those obligations have been enforced under HIPAA’s civil and criminal penalty scheme, and we hold ourselves to them accordingly. If you have a question about how your health information is handled, ask, and we will walk you through it.

How we protect your information

We use administrative, technical, and physical safeguards suited to the sensitivity of what we handle, including access controls, encryption where appropriate, secure storage, confidentiality agreements with everyone who touches your file, and multi-factor authentication on the systems that support it. No safeguard is perfect, and we will not pretend otherwise, but security is part of the service, not an afterthought. If a breach affecting your information ever occurs, we will notify you and the appropriate authorities as required by law.

Your privacy rights and choices

Depending on where you live, you may have the right to access the information we hold about you, ask us to correct information that is wrong, ask us to delete information, and ask how we collected and used it. To make a request, email service@brightrowan.com. We will verify your identity first, to protect you, and we will respond within the time the law requires. Exercising a right will never cause us to treat you differently. Some information we may be required to keep, for example to bill for services, meet credentialing recordkeeping rules, or comply with the law, and we will tell you when that is the case.

How long we keep your information

We keep information for as long as the engagement requires, and as long as the law, our professional obligations, and credentialing recordkeeping standards require, then we dispose of it securely. Retention periods vary by the type of information and the reason we hold it.

Bright Rowan Insights panel

If you join the Bright Rowan Insights research panel, we collect your email address and the role you select, and nothing else. We do not collect your name, your employer, or any identifier that would let us or anyone else connect an answer back to you. Survey questions are closed-response only, with no free-text boxes.

Your answers are reported in aggregate. No finding is published on fewer than ten responses. Your employer never receives your individual answers, and neither does any sponsor. Panel members are not solicited for Bright Rowan consulting work.

We keep panel contact details for twenty-four months from your last response, then delete them. You can leave the panel at any time by emailing service@brightrowan.com, and we will delete your record.

Changes to this notice

We keep this notice current. When we make a meaningful change, we will update the date at the top. Changes that affect information we already hold will not apply retroactively without your consent where the law requires it.

Contact us

Questions, requests, or concerns about your privacy can go to:
Bright Rowan, LLC
Vancouver, WA
service@brightrowan.com
We answer within one business day.