Built for Healthcare Compliance
ArkCloud RCM implements technical safeguards and collection controls designed to support HIPAA, FDCPA and TCPA obligations. Compliance is a shared responsibility: the platform supports your programme, it does not constitute one.
HIPAA Safeguards
PHI protection & BAA agreements
Technical safeguards designed to support HIPAA Security Rule obligations - field-level encryption of designated PHI fields, access controls and audit logging - and a BAA.
FDCPA Workflows
Fair debt collection practices
Call-time and call-frequency checks that record violations and raise alerts, consent checks before automated contact, and agent scripts carrying the mini-Miranda disclosure.
TCPA Protection
Telephone consent management
Call and text consent recorded per patient, and a patient's do-not-call preferences checked before automated contact. These support your TCPA obligations; they do not discharge them.
State Regulations
Collection rules you configure
Configurable rules for contact cadence, cooldown periods and the disclosure language your letters carry.
PCI-DSS via processor
Payment card security
Card details are designed to go straight from the browser to a PCI-DSS Level 1 processor, so no card number reaches ArkCloud. Online card payment is not enabled in this deployment.
Audit Ready
Comprehensive logging & reporting
Hash-chained audit logs, PHI access logs, and compliance reports you can generate for an examination or review.
HIPAA Compliance
Health Insurance Portability and Accountability Act
PHI Protection
Encryption at Rest and in Transit
AES-256-GCM field-level encryption of designated PHI fields, and TLS 1.2 or later for public traffic. The database volume itself is not encrypted.
Access Controls
Role-based access control (RBAC) with minimum necessary access principles
Data Redaction
Sensitive fields are redacted from application logs
Session Management
Sessions end after an absolute 8 hours (30 days only if the user opts in), and ten failed sign-ins lock the account for 15 minutes
Business Associate Agreements
BAA available
A Business Associate Agreement is available on request for any account that will hold PHI
Subcontractor Management
Vendors that handle PHI are required to sign a BAA before processing it. No online card processor is connected in this deployment, so none is in scope today.
Breach Notification
Incident response
An incident runbook covers operational outages. A written breach-notification procedure has not been completed yet
Breach notification
Acting as a Business Associate, ArkCloud commits to notify the applicable covered entity consistent with HIPAA and the governing BAA.
FDCPA Compliance
Fair Debt Collection Practices Act
Call Time Restrictions
Call-time checks
Each recorded call is checked against 8 AM to 9 PM in the patient's time zone; one outside it is logged as a violation and raises a compliance alert. Calls are not blocked in advance, and no holiday calendar is applied
Contact Frequency Limits
Call-frequency control
Telephone calls are counted per account over the last day and the last seven days, with the weekly default set at Regulation F's seven-in-seven presumption, and an account over the limit is reported as a possible violation.
Required Disclosures
Letter templates you control
Letters and their cadences come from templates your organisation writes, so validation-notice and dispute-rights language is yours to include and review. ArkCloud does not generate or track validation notices
Mini-Miranda Warning
Agent scripts
The account call script shows the debt-collector disclosure ("This is an attempt to collect a debt...") right after identity verification, with first-contact or later-contact wording chosen from the account's contact history. It is on by default and each organisation can turn it off. The seeded letter templates carry the same wording. Saying it on each call, and the wording of your own templates, remain with your team
TCPA Compliance
Telephone Consumer Protection Act
Consent Management
Call, text and email consent recorded per patient with its date and source
Revocation recorded with its date, per channel
Automated calls and texts stop when a recorded preference has no consent for that channel
Do-Not-Call Lists
Per-patient do-not-call, do-not-text and do-not-email flags, set on request and checked before an automated contact
Suppressed contacts are excluded from outbound campaigns
No autodialer
ArkCloud does not place predictive or automatic calls. Agents place calls themselves, through Amazon Connect once your instance is connected
State Regulations
Rules you configure; no state-specific rule set is built in
State-Specific Collection Laws
Statute of limitations
A write-off can be recorded as statute-expired. ArkCloud does not calculate or track state limitation periods
Payment plans carry no interest
Plans divide an existing balance into scheduled instalments. ArkCloud does not apply interest or finance charges, so state rate caps do not arise.
State disclosures are yours to add
Letter templates carry whatever state disclosure language you write into them; ArkCloud does not insert it by state
Licensing Requirements
Licences and bonds are not tracked
ArkCloud does not track collection-agency licences, their expiry, or surety bonds
Licensing remains the agency's responsibility
ArkCloud does not hold a licence register or block activity by state. Confirming where your organisation is licensed to collect is your control, not a platform enforcement.
Change control
Regulatory controls are versioned and updated through ArkCloud's software change process, and changes to a documented control are reflected in the product documentation. Customers remain responsible for determining the requirements applicable to their organisation.
PCI-DSS Compliance
Payment Card Industry Data Security Standard
Secure Payment Processing
Card data is designed to route to a PCI-DSS Level 1 processor
ArkCloud is built so that card details go directly to the processor and never transit or rest in ArkCloud. No processor is connected in this deployment, so online card payment is switched off rather than simulated.
Tokenization
Card data replaced with tokens - no sensitive data stored in system
Card details never reach ArkCloud servers
The payment form submits card details from the browser to the processor over TLS. ArkCloud receives a token, never a card number.
Online card payment is not enabled today
No payment gateway is configured in this deployment. The patient portal says so and declines to post a payment, rather than recording one that was never taken.
Data Protection
No Cardholder Data Storage
System does not store full PANs, CVV2, or magnetic stripe data
Payment attempts audited
Payment attempts are written to the audit trail. There is no separate payment network segment and no live monitoring of it
Where PCI responsibility sits
ArkCloud is designed so that card details go straight from the patient's browser to a PCI-DSS Level 1 processor. That design keeps cardholder data out of ArkCloud entirely, which is what reduces a customer's own PCI scope.
- ArkCloud stores no PAN, CVV2 or magnetic-stripe data, and has no code path that would accept one
- Payment attempts are audited, and duplicate submissions are collapsed by a durable idempotency key rather than charged twice
- ArkCloud does not issue an AOC, ASV scan report or penetration-test summary, and holds no PCI attestation of its own
- Online card payment is not enabled in this deployment; the portal declines rather than simulating a payment
Audit Readiness
Comprehensive Logging and Evidence Collection
Complete Audit Trail
Security events and PHI access logged with user, time and, where available, IP address
Tamper-evident audit logs, hash-chained so a modified record breaks the chain (records written from 2 October 2026; earlier records are checked for deletion and re-ordering)
Seven-year retention policies for account and audit records
Report Generation
Pre-built compliance reports, generated by an administrator for a chosen period
Exports to CSV and Excel. Scheduled delivery is not running yet
Evidence Collection
Call recordings retrieved from Amazon Connect, once your instance is connected
Consent documents and intake forms captured with a recorded e-signature
Compliance reports
- FDCPA compliance and violation summary
- Call-time analysis
- HIPAA access audit and data-access audit
- User access summary
Export Formats
- Excel/CSV for data analysis
Compliance Framework Overview
Where each control sits in the platform. The controls support your compliance programme; they do not guarantee it
Infrastructure Layer
Application Layer
Business Logic Layer
User Interface Layer
How compliance changes reach you
Healthcare and collections regulations change. When a control in ArkCloud changes, it ships as an ordinary versioned release. Tracking which regulations apply to you stays with your organisation.
No regulatory monitoring service
ArkCloud does not run a regulatory-tracking service. Tell us about a rule change that affects a control, and we will say whether and when it changes
Hosted updates
Changes reach every customer when a release is deployed to the hosted service; there is nothing for you to install. Releases can briefly interrupt service
Documentation
The product documentation is updated when a documented control changes. Staff compliance training is not provided
Compliance updates by email
Get an email when our security controls, policies or compliance documentation change. There is no fixed schedule: we write only when something changes.
Compliance Resources
What exists in writing today, and what does not yet
TCPA Compliance Checklist
Step-by-step checklist for maintaining TCPA compliance in your collection operations
State Regulations Matrix
Reference guide for state-specific collection laws and requirements
PCI-DSS position
How card data is kept out of ArkCloud, and what ArkCloud does not hold
Have Compliance Questions?
Email us with questions about these controls, audit support, or to request a BAA.
Email Support
For non-urgent compliance inquiries and documentation requests
[email protected]Urgent questions
There is no phone line. Mark the subject URGENT for compliance questions or audit support
[email protected]Schedule a Compliance Consultation
Talk to us about your specific requirements and how ArkCloud RCM can support your compliance program.
Schedule ConsultationBuilt on a Foundation of Compliance
ArkCloud RCM puts consent, contact and audit controls in the workflow, so your team can see the rules at the moment they apply. Your compliance programme stays yours.