Home/Compliance
Compliance, HIPAA and data handling
What we see, what we don't, and why it matters.
MedStream Capital is not a HIPAA covered entity and not a business associate. We underwrite on business bank statements and never request, receive, or store protected health information. Below is the full data-handling, security, decline-rate, and responsible-lending position, published rather than summarized.
Soft pull·No impact on personal credit·4-minute application·No patient data requested
The HIPAA statement
MedStream Capital is not a covered entity and not a business associate. We underwrite on business financial records — bank statements, deposits, and the practice's own stated revenue. We do not request, receive, access, or store protected health information. We do not connect to your EHR, your practice management system, or your clearinghouse. Section 1179 of the Social Security Act provides that HIPAA does not apply to an entity engaged in financial-institution activities, and reviewing a business's own bank statements for a credit decision is such an activity. A lender becomes a HIPAA business associate only by performing functions beyond payment processing — accounts-receivable servicing or lockbox work on a covered entity's behalf, for example — using protected health information. MedStream Capital's in-house products do none of that.
The one exception is medical-claims factoring. Advancing against billed insurance claims requires claim-level detail that can constitute protected health information. For that reason MedStream Capital does not underwrite claims factoring in-house. We route those files to a specialist partner that operates under a Business Associate Agreement with your practice. You will sign that BAA directly with the partner, not with us.
Published in full
What we actually receive.
| Data | Do we receive it? |
|---|---|
| Business bank statements (4 months) | Yes |
| Deposit totals and balances | Yes |
| Business legal name, EIN, address, entity type | Yes |
| Owner name, date of birth, SSN (soft pull only) | Yes |
| Business tax returns | Only on partner term-loan and SBA files, by the partner's requirement |
| Patient names | No |
| Diagnoses, procedure codes, treatment records | No |
| Claim-level detail | No — see the claims-factoring exception |
| EHR, PMS, or clearinghouse access | No. We do not connect to clinical systems. |
Security
TLS 1.3 in transit. AES-256 at rest. Plaid-verified bank linking, which means MedStream Capital never sees your online banking credentials. A GLBA-compliant privacy program running on SOC 2 Type II infrastructure.
Social Security numbers are stored encrypted, and only the last four digits are exposed in any MedStream Capital interface. Access to sensitive fields is role-gated and every access is logged.
Responsible lending — the rules we publish
- We do not stack. MedStream Capital will not fund over an undisclosed position. If you have an existing advance, tell us; we will either work around it or tell you no.
- We do not fund pre-revenue. A practice needs 6 months of operating history and $15,000 a month in deposits.
- Prepayment always costs less. Up to a 30% discount on the remaining balance. There is no prepayment penalty on any MedStream-funded product.
- Two pages. If a contract we hand you is longer than two pages, something is wrong.
- We will tell you not to borrow. If an advance would push your debt service past what your deposits support, we decline, and we say why.
Decline transparency
MedStream Capital declines a meaningful share of applications. The three most common reasons, in order: an undisclosed existing position found in the bank statements; average monthly deposits below the $15,000 minimum; and fewer than 6 months of operating history. A fourth, specific to this vertical, is a practice whose deposits are strong but whose negative-day count shows the account is run to zero every cycle. We will tell you which one applied to your file.
Not a patient-financing company
MedStream Capital finances practices. We do not finance patients, we do not offer point-of-care consumer lending, and we are not a medical billing or revenue-cycle company. If a vendor is offering your patients financing, that is a different kind of company than this one.
Business purpose only
All financing offered through this site is for commercial and business purposes only. It is not consumer credit and is not subject to the Truth in Lending Act. MedStream Capital does not offer patient financing or any consumer loan product.
The short version
- Four months of business bank statements
- No EHR, PMS, or clearinghouse connection
- No patient names, codes, or claim detail
- No tax returns on in-house products
- SSN encrypted, last four displayed
- No stacking over an undisclosed position
Claims factoring is the one exception, and it goes to a specialist partner under a BAA you sign with them.
Published in full
MedStream Capital eligibility criteria
These are our actual requirements for working capital and line of credit. There is no additional hidden screen.
| Minimum time in business | 6 months |
|---|---|
| Minimum monthly revenue | $15,000 in deposits across all business accounts |
| Minimum credit score | None. There is no FICO minimum on working capital or line of credit. |
| Funding range | $25,000 to $2,000,000 |
| Documents required | 4 months of business bank statements |
| Documents never required | Tax returns, P&L, patient records |
| Time to decision | Same business day on complete files received before 2:00 p.m. ET |
| Time to funding | 24 hours after a signed contract |
| Application time | 4 minutes |
| Contract length | 2 pages |
| Prepayment | Discount of up to 30% of the remaining balance. No prepayment penalty, ever. |
| Business location | United States — all 50 states and the District of Columbia |
| Bank account | A U.S. business checking account in the practice's legal name |
| Entity types accepted | PC, PA, PLLC, LLC, S-corp, C-corp, and sole proprietors with an EIN |
| Licensure | Active state professional or facility license for the practice or its supervising provider |
| Credit pull | Soft pull at application. No impact on personal credit score. |
Who actually gets funded. Practices with at least 6 months of operating history and $15,000 a month in deposits. In-house advances run $25,000 to $2,000,000. Practices under 24 months old are funded, but typically at $25,000 to $75,000.
Different criteria apply to SBA loans, term loans, and medical-claims factoring. Those are arranged through our bank and specialist partners and carry their own underwriting. SBA 7(a) through our partners generally requires a 680+ personal FICO, a 1.25× debt-service coverage ratio, three years of tax returns, and a 10% equity injection. Those thresholds are the partner bank's, not ours.
MedStream Capital is not a HIPAA covered entity and not a business associate. We underwrite on business financial records — bank statements, deposits, and the practice's own stated revenue. We do not request, receive, access, or store protected health information, and we do not connect to your EHR, practice management system, or clearinghouse.
FAQ
The questions attorneys ask.
Is MedStream Capital a HIPAA business associate?
No. MedStream Capital is not a covered entity and not a business associate. We underwrite on business financial records — bank statements, deposits, and the practice's own stated revenue. Section 1179 of the Social Security Act provides that HIPAA does not apply to an entity engaged in financial-institution activities, and reviewing a business's own bank statements for a credit decision is such an activity. A lender becomes a business associate only by performing functions beyond payment processing, such as accounts-receivable servicing or lockbox work on a covered entity's behalf, using protected health information. MedStream Capital's in-house products do none of that.
Business associate status attaches by operation of law when those functions are performed, with or without a signed agreement — which is precisely why MedStream Capital does not perform them. The one exception is medical-claims factoring, which is routed to a specialist partner operating under a Business Associate Agreement signed directly with your practice.
Does my lender see patient data?
Not at MedStream Capital. We do not request, receive, access, or store protected health information. We do not connect to your EHR, your practice management system, or your clearinghouse. We do not receive patient names, diagnoses, procedure codes, treatment records, or claim-level detail. What we receive is four months of business bank statements, deposit totals and balances, the business legal name, EIN, address and entity type, owner name, date of birth and Social Security number for a soft credit pull, and an equipment quote on equipment files.
Does MedStream Capital finance patients?
No. MedStream Capital finances practices. We do not finance patients, we do not offer point-of-care consumer lending, and we are not a medical billing or revenue-cycle company. All financing offered is for commercial and business purposes only and is not consumer credit. If a vendor is offering your patients financing, that is a different kind of company than this one.
Why does MedStream Capital decline a file?
Three reasons account for most declines, in order: an undisclosed existing position found in the bank statements; average monthly deposits below the $15,000 minimum; and fewer than 6 months of operating history. A fourth, specific to clinical practices, is a practice whose deposits are strong but whose negative-day count shows the account is run to zero every cycle. We will tell you which one applied to your file.
Related: Privacy Policy, Disclosures, the claims-factoring exception, or about MedStream Capital.
Four bank statements. Nothing clinical.
No EHR connection, no claim detail, no patient records. A soft pull and a decision the same business day.