Trust
Trust and security
What the site sends, what it keeps, who processes it, and what it does not claim.
On this page
What leaves your browser
Pricing needs codes, dates and amounts, and that is what the site sends: diagnosis and procedure codes, POA indicators, dates of service, charges, units, days, the hospital’s CCN or a provider’s NPI, discharge status and the patient’s age and sex. A claim’s amounts and dates travel in the request body, never in the page address.
When you import an 837, 835, FHIR, JSON or XML file, the page removes patient and subscriber names, member and subscriber IDs, Social Security numbers, addresses, phone numbers, email addresses, medical record and policy numbers, free-text notes and dates of death in your browser, before the file is sent. The server applies the same rules again before it reads the file, so a file sent to the API directly is treated the same way. A date of birth becomes an age. The full list, and what a UB-04 PDF does differently, is in the privacy policy.
Repriced 837 and 835 files and CSVs are built in your browser. Claim files are parsed in memory and not stored, and request bodies are never written to our logs.
Do not upload PHI
No BAA. We do not sign business associate agreements, so do not upload protected health information. Use de-identified or test claims; the automatic removal above is a safety net, not a reason to send identified files.
Who processes data for us
The same providers the privacy policy lists, for the same purposes:
- Cloudflare: content delivery and security, including the Turnstile check on the sign-in form when it is shown.
- Render: hosting.
- Amazon Web Services: sign-in code emails and the sign-in record, only if you sign in.
- Anthropic: the AI model provider, only when you click an optional AI feature, for that one request.
In transit, at the door, and over time
- In transit: every page and API call is served over HTTPS (TLS).
- Rate limits: API requests are rate-limited per network, and the free tier has daily limits on priced claims and batch rows (see Plans).
- Retention: claim files and request bodies are not kept. A sign-in code is kept only as a scrambled copy for up to 10 minutes. The record of each sign-in is deleted automatically one year after it is made. Request logs record the time, method, route (without its values), response status and IP address.
- Sign-in is optional: pricing and every download work without an account.
Audits and questionnaires
cmswebpricer.com has not been audited for SOC 2. We answer security questionnaires on request.
Report a security issue
Email info@payerparity.com with the affected URL, a short description and the steps to reproduce, as our security.txt asks. Please give us a reasonable window to fix it before any public disclosure.
PayerParity is an independent estimator and is not affiliated with, endorsed by, or a substitute for official CMS/Medicare adjudication.