For Health Plan and Health System Clients. 

Key Takeaways 

Here is a short summary of how RevSpring uses AI on your behalf, and the commitments and boundaries that govern it. The full Posture Statement (v1.0) is attached below for complete detail, including regulatory framework mappings.
 

1. How We Think About AI

• Digital Twin Operating Model: Every AI agent at RevSpring is paired with a named human sponsor and works within a pre-approved scope. Every action is logged against both identities, so accountability is never ambiguous.
• Your data boundary does not change: Twins operate under the same BAA, MSA, and data processing terms you already have with RevSpring. The model adds identity, scope, and audit; it does not widen access.

2. Our Eight Commitments to Clients

• No training on your data: Client and patient data is never used to train any model, ours or a third party's.
• Cardholder data is out of scope: No twin can ever receive PAN, CVV, or full track data.
• PHI stays inside the BAA boundary: PHI-touching twins run through a no-retention model gateway, with HIPAA-trained sponsors.
• No cross-tenant leakage: Per-tenant isolation and recurring red-teaming keep your data separate from other clients'.
• Dual-identity logging: Every action is traceable to the twin and its human sponsor, and available on request.
• Twins draft, humans send: A human sponsor reviews and submits any outreach before it reaches you or your patients.
• Disclosure where required: AI involvement is disclosed wherever law or your contract requires it.
• Twins that drift get retired: Declining performance or scope creep triggers retraining, rescoping, or retirement.

3. What We Will Not Do

• Deploy AI agents that act autonomously on your account without your explicit, written authorization.
• Use your or your patients' data to train or improve any model outside the scope of your services with us.
• Let an AI agent take a final action on a payment, refund, write-off, or account closure without a human in the chain.
• Impersonate a specific named RevSpring employee, your employee, or a clinician in AI-generated communication.
• Run AI evaluations, A/B tests, or pilots on your patient population without your prior written approval.

4. Regulatory Alignment

Our AI program is built to align with HIPAA, PCI DSS, SOC 2, TCPA and state communications laws, state privacy laws, and FDCPA/Reg F. Full framework-by-framework mappings are included in the attached Posture Statement and available under NDA on request.

5. What You Can Request

• Audit log extracts: Dual-identity logs of AI actions on your account, scoped to a date range you specify.
• AI Registry entries: The name, sponsor, tier, and status of any twin operating on your account.
• Incident reports: Root cause and remediation details for any AI-related incident affecting your account.
• Annual posture review: A session with your account team and our AI Platform leadership.

Key Takeaways

• Every RevSpring AI agent is a named "digital twin" paired with a named human sponsor, so accountability is never ambiguous.
• Cardholder data is fully out of scope for AI; PHI stays inside your existing BAA boundary.
• Twins draft, humans send: there is no autonomous outbound communication without your team's explicit agreement.

• Audit logs and AI Registry entries are available to you on request, and the full Posture Statement (v1.0) is attached below.