HIPAA Compliance Statement
Protecting Your Health Information
Last Updated: January 2025
Encrypted Storage
Data encrypted at rest and in transit
Access Controls
Role-based permissions and audit logs
BAA Agreements
Contracts with all service providers
The Health Insurance Portability and Accountability Act (HIPAA) establishes national standards for protecting sensitive patient health information from being disclosed without the patient's consent or knowledge.
Protected Health Information (PHI) includes:
- Diagnosis and treatment information
- Medical history and conditions
- Test results and prescriptions
- Healthcare provider communications
- Insurance and billing information
- Any health data linked to personal identifiers
Carespottr as a Business Associate:
Under HIPAA, Carespottr functions as a Business Associate when we:
- Store and transmit PHI on behalf of healthcare providers
- Facilitate communications containing health information
- Process appointment and booking data that includes health details
Provider Responsibilities:
Healthcare providers using Carespottr remain Covered Entities under HIPAA and are responsible for:
- Obtaining patient consent before sharing PHI
- Ensuring only minimum necessary PHI is disclosed
- Maintaining HIPAA compliance in their practice
- Training staff on privacy and security requirements
We implement comprehensive security measures required by HIPAA's Security Rule:
✓ Access Controls
- Unique user IDs and strong password requirements
- Automatic session timeouts
- Role-based access permissions (minimum necessary principle)
- Multi-factor authentication for administrative access
✓ Encryption
- In Transit: TLS 1.2+ encryption for all data transmission
- At Rest: AES-256 encryption for stored data
- Backups: Encrypted backup storage with secure access
✓ Audit Controls
- Comprehensive logging of system access and PHI activities
- Regular audit log reviews
- Tamper-proof audit trail retention
- Automated monitoring and alerting for suspicious activity
✓ Integrity Controls
- Data validation and verification mechanisms
- Protection against unauthorized PHI alteration or destruction
- Regular integrity checks and backups
✓ Transmission Security
- Secure messaging protocols
- End-to-end encryption for sensitive communications
- Network security and firewall protection
Security Management Process:
- Regular risk assessments and vulnerability testing
- Documented security policies and procedures
- Incident response plan with breach notification protocols
- Sanction policy for workforce violations
Workforce Training:
- HIPAA Privacy and Security Rule training for all staff
- Regular security awareness updates
- Clear policies on PHI handling and access
Business Associate Management:
- Signed Business Associate Agreements with all vendors
- Regular compliance audits of partners
- Vendor security assessment and monitoring
Infrastructure Security:
- HIPAA-compliant data center hosting (AWS/Azure with BAA)
- Physical access controls and surveillance
- Environmental controls (fire suppression, temperature monitoring)
- Secure disposal procedures for hardware and media
Device and Media Controls:
- Encrypted mobile devices and workstations
- Secure media disposal and data wiping protocols
- Inventory tracking of devices with PHI access
In the event of a breach of unsecured PHI, we will:
- Immediate Response: Contain and investigate the breach within 24 hours
- Risk Assessment: Determine the scope and severity of the incident
- Provider Notification: Notify affected covered entities without unreasonable delay (within 60 days)
- Individual Notification: Work with providers to notify affected individuals as required
- Regulatory Reporting: Report to HHS Office for Civil Rights if required
- Remediation: Implement corrective actions to prevent future incidents
We maintain detailed incident response plans and conduct regular breach response drills.
Under HIPAA, you have the right to:
- Access: Request and receive a copy of your PHI in our possession
- Amendment: Request corrections to inaccurate or incomplete PHI
- Accounting: Receive an accounting of PHI disclosures made by us
- Restrictions: Request restrictions on certain uses and disclosures of PHI
- Confidential Communications: Request to receive communications in a specific manner or location
- Breach Notification: Be notified if your unsecured PHI is breached
To exercise these rights, contact us at: carespottr@gmail.com with subject line "HIPAA Privacy Rights Request"
We adhere to HIPAA's Minimum Necessary Rule by:
- Only collecting PHI essential for platform functionality
- Limiting PHI access to authorized personnel who need it for their role
- Disclosing only the minimum PHI necessary for each purpose
- Regularly reviewing data collection and retention practices
- Implementing technical controls to enforce minimum necessary access
Retention Periods:
- PHI: Retained for minimum 6 years as required by HIPAA
- Audit logs: 7 years minimum
- Business Associate Agreements: 6 years after termination
Secure Disposal:
- Electronic PHI: Secure deletion with data overwriting
- Backup media: Encryption and secure physical destruction
- Documentation: Shredding of physical records
We maintain HIPAA compliance through:
- Regular Audits: Annual comprehensive HIPAA compliance audits
- Vulnerability Testing: Quarterly penetration testing and security assessments
- Policy Reviews: Annual review and update of all HIPAA policies
- Staff Training: Quarterly privacy and security training for all personnel
- Vendor Management: Ongoing monitoring of business associate compliance
- Continuous Improvement: Regular updates based on evolving threats and regulations
For HIPAA-related questions, concerns, or to exercise your privacy rights:
Privacy Officer: Carespottr Privacy Team
Email: carespottr@gmail.com
Subject Line: "HIPAA Inquiry" or "Privacy Rights Request"
We will respond to all HIPAA-related requests within 30 days as required by law.
I Acknowledge and Accept
By clicking below, you confirm that you have read and understand this HIPAA Compliance Statement.
Notice of Privacy Practices: This HIPAA Compliance Statement serves as our Notice of Privacy Practices. By using Carespottr, you acknowledge understanding of how we protect and handle your Protected Health Information.
Last Updated: January 2025 | For our complete Privacy Policy, visit Privacy Policy