CareSpottr logo - connecting families with quality disability services
Healthcare Provider Agreement

Provider Service Agreement

Terms for Healthcare Providers Using Carespottr

Last Updated: January 2025

1. Acceptance of Provider Terms

By registering as a healthcare provider on Carespottr, you acknowledge and agree to:

This agreement establishes a Business Associate relationship under HIPAA between you (the Covered Entity) and Carespottr (the Business Associate).

2. Provider Eligibility and Verification

Eligibility Requirements:

To register as a provider, you must:

  • Hold current, valid professional licenses in California
  • Maintain appropriate professional liability insurance
  • Provide disability services in San Diego or Riverside County
  • Comply with all federal and state healthcare regulations
  • Maintain good standing with relevant professional boards

Verification Process:

  • Submit proof of professional licensure
  • Provide National Provider Identifier (NPI) if applicable
  • Verify business entity registration
  • Submit proof of liability insurance
  • Undergo background verification process
3. Business Associate Agreement (BAA)

Definitions:

  • Covered Entity: You, the healthcare provider
  • Business Associate: Carespottr
  • Protected Health Information (PHI): Health information transmitted or maintained by Business Associate on behalf of Covered Entity

Business Associate Obligations:

Carespottr agrees to:

  • Use or disclose PHI only as permitted by this Agreement or as required by law
  • Implement appropriate safeguards to prevent unauthorized use or disclosure of PHI
  • Report to Covered Entity any use or disclosure not provided for by this Agreement
  • Report Security Incidents and Breaches of Unsecured PHI
  • Ensure that subcontractors and agents agree to same restrictions
  • Make PHI available to individuals as required by 45 CFR § 164.524
  • Make PHI available for amendment as required by 45 CFR § 164.526
  • Provide an accounting of disclosures as required by 45 CFR § 164.528
  • Make internal practices, books, and records available to HHS for compliance review
  • Return or destroy all PHI upon termination of services

Covered Entity Obligations:

You (the Provider) agree to:

  • Provide Business Associate with Notice of Privacy Practices
  • Obtain patient authorizations for uses and disclosures as required
  • Notify Business Associate of limitations in authorization or consent
  • Not request Business Associate to use or disclose PHI in violation of HIPAA
  • Notify Business Associate of changes affecting PHI handling obligations
4. PHI Handling and Security Responsibilities

Provider Responsibilities:

As a healthcare provider, you must:

  • Patient Consent: Obtain appropriate patient authorization before sharing PHI through the platform
  • Minimum Necessary: Share only the minimum PHI necessary for each communication or transaction
  • Secure Access: Maintain secure login credentials and never share account access
  • Timely Updates: Keep patient information current and accurate
  • Breach Reporting: Immediately report any suspected security incidents or unauthorized PHI access
  • Staff Training: Ensure all staff with platform access are trained on HIPAA compliance

Critical Requirements:

  • Never include full SSN, financial account numbers, or full dates of birth in platform communications
  • Do not use platform for emergency medical communications
  • Verify patient identity before discussing PHI
  • Log out of platform when not in use, especially on shared devices
5. Profile Information and Content Standards

Required Information:

  • Accurate practice name and location
  • Current contact information
  • Valid professional credentials and licenses
  • Services offered and specializations
  • Insurance and payment options accepted
  • Real-time availability status

Prohibited Content:

You may NOT include in your profile or communications:

  • False, misleading, or unverifiable claims
  • Patient testimonials without proper authorization
  • Guarantees of outcomes or "cures"
  • Comparative statements disparaging other providers
  • Content violating professional ethics or advertising standards
  • Patient PHI in examples or descriptions

Update Requirements:

You must update your profile within 7 days when:

  • Availability status changes
  • Services or specializations are added/removed
  • Contact information changes
  • Credentials or licenses are renewed
  • Insurance acceptance changes
6. Patient Communication Standards

Response Time Expectations:

  • Contact Requests: Respond within 2 business days
  • Booking Requests: Confirm or decline within 24 hours
  • Patient Messages: Respond within 2 business days for non-urgent matters

Professional Standards:

  • Maintain professional, respectful tone in all communications
  • Provide clear, accurate information about services
  • Clearly explain fees, insurance coverage, and payment policies
  • Honor scheduling commitments or provide reasonable notice of changes
7. Reviews and Reputation Management

Review Policy:

  • Families may leave reviews based on their experience
  • All reviews are moderated for appropriateness
  • You may respond professionally to reviews
  • Do not include PHI in review responses

Prohibited Actions:

  • Soliciting positive reviews in exchange for benefits
  • Posting fake reviews or using review manipulation services
  • Threatening or retaliating against reviewers
  • Asking patients to remove negative reviews
8. Fees and Payment Terms

Platform Fees:

Current fee structure:

  • Basic Listing: Currently free
  • Featured Placement: Pricing available upon request
  • Verification Badge: Subject to qualification and review

Payment Processing:

Carespottr does NOT process patient payments. All financial arrangements are between you and your patients/clients.

We reserve the right to modify fee structures with 30 days notice to providers.

9. Security Incident and Breach Procedures

Reporting Obligation:

You must immediately report to Carespottr:

  • Suspected or confirmed security incidents
  • Unauthorized access to your account
  • Lost or stolen devices with platform access
  • Any suspected breach of PHI

Carespottr's Breach Response:

If we discover a breach involving your patients' PHI, we will:

  1. Notify you without unreasonable delay (within 60 days)
  2. Provide details of the breach and affected individuals
  3. Describe mitigation steps taken
  4. Assist with required breach notifications

Your Breach Responsibilities:

As the Covered Entity, you are responsible for:

  • Notifying affected patients as required by HIPAA
  • Reporting breaches to HHS and media (if applicable)
  • Conducting breach risk assessments
  • Maintaining breach documentation
10. Agreement Term and Termination

Term:

This Agreement is effective upon your acceptance and continues until terminated by either party.

Termination by Provider:

  • You may terminate with 30 days written notice
  • You remain responsible for any pending patient matters
  • Profile will be removed from public directory

Termination by Carespottr:

We may suspend or terminate your account for:

  • Violation of this Agreement or Terms of Service
  • Loss of required licenses or credentials
  • Professional misconduct or ethical violations
  • Repeated patient complaints
  • HIPAA violations or security breaches
  • Fraudulent or deceptive practices

Effect of Termination:

  • Profile removed from platform within 5 business days
  • PHI returned or destroyed per your written instruction
  • Audit logs retained per HIPAA requirements (6 years)
  • Outstanding obligations remain enforceable
11. Professional Liability and Indemnification

Provider Responsibilities:

  • Maintain professional liability insurance with adequate coverage
  • Comply with all applicable standards of care
  • Meet all state and federal healthcare requirements
  • Ensure proper informed consent and documentation

Indemnification:

You agree to indemnify and hold harmless Carespottr from claims arising from:

  • Your provision of healthcare services
  • Medical malpractice or negligence claims
  • Your violation of professional standards or regulations
  • Unauthorized disclosure of PHI by you or your staff
  • Misrepresentation of credentials or services
Questions About This Agreement?

For questions about this Provider Agreement or HIPAA compliance:

Email: carespottr@gmail.com

Subject Line: "Provider Agreement Question"

Privacy Officer: Carespottr Privacy Team

I Acknowledge and Accept

By clicking below, you confirm that you have read and agree to this Provider Service Agreement, including the Business Associate Agreement (BAA) under HIPAA.

By completing provider registration, you acknowledge that you have read, understood, and agree to be bound by this Provider Service Agreement, including the Business Associate Agreement provisions. This agreement is binding and enforceable under California law and HIPAA regulations.

Last Updated: January 2025 | Also see: Terms of Service |Privacy Policy |HIPAA Compliance