Privacy

What happens when you send something

1. Your browser sends up to four PDF, JPG, or PNG files totaling 3 MB, a description, or both over an encrypted connection when you choose Continue. The phone handoff can send up to eight separate pictures.
2. The server reads it during that request. It does not put the original in a document bucket, database, analytics system, or investigation record.
3. The server attempts to remove obvious patient names, Medicare/member numbers, Social Security numbers, birth dates, patient contact details, account identifiers, signatures, and barcode or QR content it detects. Automated removal can make mistakes.
4. Only minimized provider, company, service, code, date, amount, and allegation information remains after that removal step.
5. Ordinary help-only questions do not create investigative evidence records. Sanitized, non-identifying information from unusual, repeated, or potentially useful reports may be retained to identify patterns involving providers, services, solicitations, or businesses.
6. For a phone handoff, encrypted, de-identified coordination data remains available to the original computer only until the 15-minute phone link expires. Any separately retained evidence follows the same identifier-removal rule as direct intake.

Phone upload privacy

The QR code contains a random, short-lived link—not your name, Medicare number, provider, or document information. Phone pictures follow the same in-memory original-file processing and are never stored as original images.

To coordinate the phone and computer, Medicare Test Help temporarily stores only encrypted text after personal-identifier removal, picture count, and the short result. The link expires after 15 minutes; expired sessions are deleted automatically and whenever new sessions begin.

Story follow-up privacy

If a story needs a few more details, a high-entropy continuation identifier keeps answers and later photos with the same anonymous report. The identifier contains no story, category, provider, or person information and expires after 15 minutes. Sanitized answers and extracted evidence may update the original retained evidence record; they do not count as another independent person or report.

Sanitized pattern records

When a report may help identify a repeated pattern, Medicare Test Help can retain a sanitized narrative, provider or business identifiers, service details, sanitized filenames, file-level source/provenance labels, cautious rule-based triage, and links to other sanitized reports. Triage means review priority; it is not a conclusion that fraud or a legal violation occurred.

Help-only questions are not kept as investigative evidence unless there is a documented cross-domain signal. Watch records are normally retained for one year; investigative leads for two years; and minimal junk or abuse metadata for up to 30 days. Scheduled cleanup removes expired records. Authorized reviewers can correct triage, mark duplicates, or queue sanitized evidence for deeper Nightbeat review, and those actions are audited.

Investigative evidence does not retain patient names, Medicare/member numbers, Social Security numbers, birth dates, patient home addresses, patient phone numbers or email, account/member IDs, signatures, unrelated medical history, or identifiable original documents. If identifier removal cannot be verified, no evidence record is created.

Optional follow-up email

You can use Medicare Test Help and receive the initial result without giving us an email. After a potentially useful sanitized report is processed, you may choose to provide one email address so an authorized reviewer can ask a question about that submission or, if you select it, share a relevant update. There are no newsletters or marketing messages, and we do not sell or share the address.

The email is encrypted and stored in a separate protected contact table. It is not added to the sanitized narrative, evidence entities, classification features, clusters, public results, or Nightbeat handoff packages. Ordinary evidence reviewers see only whether follow-up is available; revealing the address requires a separate contact-access allowlist and creates an audit event.

Contact information expires no later than 180 days after consent and never later than the linked evidence record. An authorized reviewer can delete it independently without deleting useful sanitized evidence. This separation also supports future consumer deletion requests.

Important limits

Automated reading and redaction can make mistakes. Cover your Medicare number and Social Security number before photographing a document when that is easy to do. Do not submit documents belonging to someone else unless you are authorized to help them.

This independent service is not Medicare, an insurer, or a health care provider. It does not provide medical advice, decide coverage, or determine that fraud occurred.

Security and incidents

We restrict file types and sizes, verify file contents, read PDFs through a static-only path that does not run scripts or open attachments, normalize images, rate-limit intake, avoid third-party OCR, and do not place submitted contents in application logs. If an unauthorized disclosure of identifying health information occurs, applicable notification duties may include notice to affected people and the Federal Trade Commission.

If you do not choose the optional follow-up form, no contact information is retained and Medicare Test Help cannot email you. A phone result disappears when its 15-minute link expires. Keep your original paperwork and take any needed notes before leaving the page.