Privacy Policy

2.1 Protected Health Information (PHI)

As a healthcare technology provider, we understand that our services may involve the collection, processing, and storage of Protected Health Information as defined under the Health Insurance Portability and Accountability Act (HIPAA). We are committed to maintaining the highest standards of data protection and HIPAA compliance.

2.2 Business Associate Relationship

When providing services to covered entities, we operate as a Business Associate under HIPAA. We enter into Business Associate Agreements (BAAs) with all covered entity clients that outline our responsibilities and commitments regarding PHI protection. Our BAA template is available on our HIPAA Compliance page.

2.3 PHI Security Measures

• End-to-end encryption for all PHI in transit and at rest
• Multi-factor authentication for system access
• Regular security audits and vulnerability assessments
• Role-based access controls limiting PHI access to authorized personnel only
• Comprehensive audit logging of all PHI access and modifications
• Employee training on HIPAA compliance and data security

3.1 Protected Health Information

Through our AI voice solutions, we may collect and process the following types of PHI:

• Voice recordings and transcriptions of patient interactions
• Patient demographic information
• Medical history and treatment information
• Medication information and care plans
• Insurance and billing information
• Healthcare provider notes and assessments

3.2 Technical Information

• Device identifiers and system information
• Usage data and service performance metrics
• Network information and IP addresses
• Application logs and error reports

3.3 Account Information

• User account credentials and authentication data
• Organization and facility information
• Contact information for administrative purposes

4.1 PHI Usage

We use PHI solely for the following purposes:

• Providing healthcare AI voice services as requested by covered entities
• Processing and analyzing voice data to generate clinical documentation
• Facilitating communication between healthcare providers and patients
• Maintaining and improving service quality and accuracy
• Complying with legal obligations and regulatory requirements

4.2 Service Improvement

We may use de-identified data (with all PHI removed) to improve our AI algorithms and service performance. All de-identification processes comply with HIPAA standards.

5.1 Healthcare System Integrations

Our services integrate with various healthcare management systems, including but not limited to:

• WellSky (Kinnser): Home health management system integration
• Electronic Health Records (EHR) systems
• Practice management systems
• Billing and revenue cycle management systems

5.2 Third-Party Data Sharing

We only share PHI with third parties under the following circumstances:

• As directed by the covered entity or healthcare provider
• With authorized integration partners under signed BAAs
• When required by law or legal process
• In emergency situations to prevent harm to individuals
• For HIPAA-compliant auditing and compliance purposes

6.1 Retention Periods

We retain PHI according to the following schedule:

• Active Patient Records: Retained for the duration of the BAA and active service period
• Voice Recordings: Retained for 30 days after transcription, unless longer retention is specified in the BAA
• Clinical Documentation: Retained according to healthcare provider's record retention policies
• Audit Logs: Retained for 6 years as required by HIPAA
• Backup Data: Retained for 90 days with encrypted storage

6.2 Secure Deletion

Upon expiration of retention periods or termination of services, we securely delete all PHI using NIST-approved methods that ensure data cannot be recovered. We provide certificates of destruction upon request.

Under HIPAA, patients have specific rights regarding their PHI. While we are a Business Associate and do not directly interact with patients, we support covered entities in fulfilling these rights:

7.1 Right to Access

Patients have the right to access their PHI. We will cooperate with covered entities to provide requested information within the timeframes required by HIPAA.

7.2 Right to Amendment

Patients may request amendments to their PHI. We will implement amendments as directed by the covered entity.

7.3 Right to Restriction

Patients may request restrictions on the use or disclosure of their PHI. We will honor such restrictions as communicated by the covered entity.

7.4 Right to Accounting of Disclosures

We maintain detailed logs of all PHI disclosures and will provide accounting information to covered entities upon request.

8.1 Technical Safeguards

• AES-256 encryption for data at rest
• TLS 1.3 encryption for data in transit
• Multi-factor authentication and single sign-on (SSO)
• Regular security updates and patch management
• Intrusion detection and prevention systems
• 24/7 security monitoring and incident response

8.2 Physical Safeguards

• SOC 2 Type II certified data centers
• Biometric access controls and 24/7 security personnel
• Environmental monitoring and fire suppression systems
• Secure destruction of physical media containing PHI

8.3 Administrative Safeguards

• Designated Privacy and Security Officers
• Regular HIPAA training for all employees
• Background checks for personnel with PHI access
• Incident response and breach notification procedures
• Regular risk assessments and security audits