HIPAA Compliance
Protecting patient health information is fundamental to everything we do. Learn how we maintain the highest standards of privacy and security.
Our Commitment to HIPAA
As a business associate handling protected health information (PHI) on behalf of healthcare providers, we are fully committed to compliance with the Health Insurance Portability and Accountability Act (HIPAA) and the HITECH Act. Safeguarding patient data is not optional — it is a core requirement of our partnership with every client.
We maintain comprehensive policies, technology controls, and staff training programs designed to prevent unauthorized access, use, or disclosure of PHI. Our compliance program is reviewed and updated regularly to reflect changes in regulations and industry best practices.
How We Protect PHI
Administrative Safeguards
- Designated Privacy and Security Officers overseeing compliance programs
- Workforce training on HIPAA policies, procedures, and incident reporting
- Business Associate Agreements (BAAs) with all covered entity clients
- Regular risk assessments and compliance audits
- Documented policies for access management and workforce clearance
Physical Safeguards
- Secure facilities with controlled access to work areas and systems
- Workstation security policies and clean desk requirements
- Secure disposal of physical media containing PHI
- Device and media controls for hardware that stores or accesses PHI
Technical Safeguards
- Encryption of PHI in transit and at rest
- Unique user identification and role-based access controls
- Automatic session timeouts and audit logging of system access
- Multi-factor authentication for remote access
- Regular vulnerability assessments and patch management
- Secure, HIPAA-compliant cloud infrastructure and backup systems
Business Associate Agreements
We execute a Business Associate Agreement (BAA) with every covered entity client before accessing any PHI. Our BAA defines permitted uses, required safeguards, breach notification procedures, and subcontractor requirements in accordance with 45 CFR § 164.504(e).
Breach Notification
In the unlikely event of a breach of unsecured PHI, we follow documented incident response procedures. We notify affected covered entities without unreasonable delay and no later than 60 days, providing the information required under the Breach Notification Rule.
Employee Training & Accountability
All team members with access to PHI complete HIPAA training upon hire and annually thereafter. Access is granted on a minimum-necessary basis, and violations of our privacy policies result in disciplinary action up to and including termination.
Your Role as a Covered Entity
HIPAA compliance is a shared responsibility. We work closely with your practice to ensure proper authorization for disclosures, secure transmission of patient data, and alignment on policies. We are happy to discuss our compliance program with your compliance officer or legal counsel.
Questions About Our Compliance Program?
We welcome inquiries from compliance officers, practice administrators, and legal teams. Contact us to request our BAA, security documentation, or to schedule a compliance review call.