|
HIPAA Privacy Policy
InDxLogic, Inc. (“InDxLogic”) respects the privacy of visitors to its site. This Health Insurance Portability and Accountability Act (“HIPAA”) privacy policy is intended to protect an individual's privacy and comply with the Privacy Rule promulgated under HIPAA. This policy may change from time to time, so please check it frequently.
Effective April 15, 2005
HIPAA Privacy Policy Implemented April 15, 2005
The Health Insurance Portability and Accountability Act (HIPAA) final Privacy regulations were published on December 28, 2000 with a compliance deadline of April 14, 2003. InDxLogic agrees to adhere to the Standards of Privacy of Individually Identifiable Health Information published by the US Department of Health and Human Services Offices for Civil Rights (CFR 45 Parts 160 and 164).
The Privacy Rule under HIPAA requires that “covered entities” enter into “business associate” agreements with entities that perform services on their behalf involving protected health information (“PHI”). In some instances, to effectively provide service to our clients, it is necessary for us to receive and utilize your PHI.
Therefore, to the extent you are a “covered entity,” and to the extent we act as a “business associate” on your behalf, we are providing you with these written assurances as required for your compliance with the HIPAA Privacy Rule.
HIPAA has established a deadline of April 5, 2005 for all health care providers to implement secure networks for the transmission of all private health information. For information transmission to be considered secure, three elements are necessary:
1) Authentication – identification of the senders/receivers of the information (i.e. must have a unique username)
2) Non-repudiation – verification that the senders/receivers of the information are who they say they are (i.e. must use a password)
3) Integrity – verification that information cannot be tampered with in transit (i.e. the information is sent through a network that cannot be easily “hacked” or “broken into”)
In other words, to be considered “secure” under HIPAA guidelines, the network used by the covered entity must require that users have both a unique username and password and take steps to ensure that data is transmitted over the system in a way such that it cannot be easily intercepted by an entity outside the network. InDxLogic has implemented a secure network that meets these criteria. This network security is similar in design, function and compliance to those used by the banking and financial industries for monetary transactions over the Internet.
InDxLogic is committed to providing the highest data security and integrity standards in its software and operations to meet or exceed the requirements set forth by published HIPAA regulations. Protected Health Information (PHI) shall be used solely under the Treatment, Payment or Healthcare Operations (TPO), as defined by the US Department of Health and Human Services.
In regard to technology use, InDxLogic’s networks are protected by the latest firewall technology and it utilizes SSL (128 bit Secured Socket Layer technology) for transmission of all web-based transactions. All file transfers occur over encrypted communications lines using 128 bit Secured Socket Layer technology and all data is encrypted at the client site and at InDxLogic before such transmission. We utilize Verisign, Inc. as our Certificate Authority for all SSL-based communications. PHI data and personal identifying information that resides at InDxLogic is also encrypted using the Advanced Encryption Standard (AES) Rijndael cipher before storage.
InDxLogic strives to have in place appropriate means to protect your information. We employ industry standard encryption technologies such as SSL (128 bit Secured Socket Layer technology) both internally and externally and utilize the latest firewall technologies to mitigate risks. However, in providing your information over a public or third party network, it is important to understand you do so at your own risk.
All internal InDxLogic processes related to the Protected Health Information (PHI) have been assessed to ensure that current operations comply with HIPAA privacy and security requirements. Each InDxLogic employee, contractor and Strategic Business Partner has received the HIPAA Privacy Training necessary to understand and adhere to the provisions of this important piece of legislation. In addition, on-going employee communication and education of HIPAA-related issues is being facilitated through the internal corporate intranet.
We will, effective April 15, 2005, carry out our responsibilities in compliance with the HIPAA Privacy Rule to protect the privacy of any personally-identifiable PHI that we collect, process or learn of as a result of providing services on your behalf.
Furthermore, we agree that we will:
(1) not use or further disclose PHI except as permitted by you and as required or permitted by law;
(2) use appropriate safeguards to prevent use or disclosure of PHI we have access to;
(3) mitigate, to the extent practicable, any harmful effect that is known to us of a use or disclosure of PHI by us in violation of this assurance;
(4) report to you any use or disclosure of PHI not provided for by our business engagement with you of which we become aware;
(5) ensure that any agents or subcontractors to whom we provide PHI, or who have access to PHI, agree to the same restrictions and conditions that apply to us with respect to such PHI;
(6) make PHI available to you and to the individual who has a right of access as required under HIPAA within thirty (30) days of the request by you regarding the individual;
(7) incorporate any amendments to PHI when you notify us to do so;
(8) provide an accounting of all uses or disclosures of PHI made by us as required under the HIPAA privacy rule within sixty (60) days;
(9) make our records relating to the use and disclosure of PHI available to the Secretary of the Department of Health and Human Services for purposes of determining your compliance with HIPAA; and
(10) at the termination of our representation, return or destroy all PHI received from, or created or received by us on your behalf, and if return is infeasible, the protections as set forth in this engagement letter will continue to extend to such PHI.
Our specific uses of your PHI may include those services as outlined in our original contract with you. By way of example, some of those uses might include, as necessary:
(1) use of PHI to test software and to perform maintenance on any software and hardware products you have purchased from us; and
(2) other uses or disclosures of PHI as permitted by the HIPAA Privacy Rule.
In accordance with the business associate requirements of the Privacy Rule, you may terminate your business relationship with us if we have violated our responsibilities as a business associate under the HIPAA Privacy Rule, or if we engage in conduct, which would result in a violation of the HIPAA Privacy Rule by the client.
Our applications combine proven, government accepted encryption technologies for secure data transfer and storage with other capabilities, such as Electronic Signature to help ensure that the only people who can access a patient's information are those intended to see the information. In addition, our user, group, and role-based security options support privacy without impeding care. Other access controls are built into InDxLogic applications, including automatic password time-outs, length controls for password, unique usernames, electronic signatures; automatic password expirations; and login attempt restrictions.
Each time protected health information is accessed, our solutions track details of the event. Extensive audit trail reports allow organizations to answer queries into who, when and how protected health information has been updated or modified.
While we use SSL encryption to protect sensitive information online, we also do everything in our power to protect user-information off-line. All of our users' information, not just the sensitive information mentioned above, is restricted in our offices. Only employees who need the information to perform a specific job (for example, our billing clerk or a customer service representative) are granted access to personally identifiable information. Our employees must use password-protected screen-savers when they leave their desk. When they return, they must re-enter their password to re-gain access to user information. Furthermore, all employees are kept up-to-date on our security and privacy practices. Every quarter, as well as any time new policies are added, our employees are notified and/or reminded about the importance we place on privacy, and what they can do to ensure our users' information is protected. Existing employees are re-educated about company privacy practices every quarter, and new employees are required to participate in mandatory privacy training. Additionally, the servers that store personally identifiable information and all backup devices and media are in a secure, controlled access environment.
Please direct specific questions about InDxLogic's HIPAA compliance program to hipaa@indxlogic.com
Questions or Concerns?
Please feel free to contact us at hipaa@indxlogic.com if you have questions or concerns about this HIPAA Privacy Policy. | 
