MedStack Technology Compliance Policies

Information privacy

General

• Comply with all privacy and data protection laws, regulations, and rules in each jurisdiction where we conduct business.
• The Privacy Official is the Chief Technology Officer (CTO).
• Commit to respecting the privacy rights of individuals and to the protection of their personal health information.

We do not directly collect, use or disclose PHI

• We provide technical services for companies who provide services to individuals, Health Information Custodians (HICs) or Covered Entities (CEs)
  • HIPAA: We serve Business Associates
  • PHIPA: We serve Electronic Service Providers or Health Information Network Providers
• We rely on our customer to manage the following aspect of PHI
  • consent and consent directives
  • collection and limitation of collection
  • use, disclosure and retention
  • accuracy
• If a request, complaint, or issue regarding patient rights, use or disclosure of PHI, accuracy or privacy occurs
  • Inform the requester that we do not manage this directly.
  • Direct the requester to the relevant customer.
  • Document the request and the action taken.

Safeguard privacy

• Apply appropriate physical, administrative and technical safeguards to protect PHI against loss or theft, or from unauthorized access, disclosure, copying, use, disposal or modification.

Publish a Privacy Notice

• Publish a Privacy Notice on our website and in our applications, that provides specific information about our policies and practices relating to our handling of PHI.

Inquiries, complaints, and disputes from data subjects

• Refer requests to our customers
  • Refer requests by individuals for access to their PHI, or correction of their PHI, that is stored in our systems, to our customer who manages that individual’s data.
  • Implement functionality in our systems and associated business processes to enable our customers to provide individuals with access to their PHI and to make corrections or amendments to the records.
• Handle compliance challenges
  • An individual shall be able to challenge our compliance.
  • Challenges must be submitted in writing to the Chief Compliance Officer.

Implement an Information Privacy Program

• Provide privacy and security training for our employees and contractors.
• Have a signed a confidentiality agreement with all of our employees and contractors.
• Implement a process to receive, investigate and resolve questions or complaints from individuals, substitute decision makers and the public.
• Implement a program to monitor and audit access to records of PHI to detect privacy breaches.
• Investigate privacy breaches and make recommendations for corrective action to avoid similar breaches in the future.
• Ensure that agreements or contracts with third parties who require access to PHI, contain provisions to adequately protect PHI.

Verify compliance

• Verify compliance to this policy through various methods, including but not limited to
  • business tool reports
  • internal and external audits
  • and feedback to the policy owner

Enforcement

• Responsible party: All managers and supervisors

References