1. Understanding Our Role Under HIPAA
The Health Insurance Portability and Accountability Act (HIPAA) establishes requirements for protecting certain health information.
Healthcare providers and other covered entities have responsibilities under HIPAA's Privacy, Security, and Breach Notification Rules.
When HealthVision creates, receives, maintains, or transmits protected health information on behalf of a covered entity in a business-associate capacity, applicable HIPAA obligations and contractual requirements govern that activity.
Verification required before publishing[Verification required: Confirm the legal entity serving as business associate and the exact services covered.]
2. Protecting Electronic Health Information
The HIPAA Security Rule establishes administrative, physical, and technical safeguard requirements for electronic protected health information.
Our security approach is intended to support these principles:
- Confidentiality: Protecting information against unauthorized access or disclosure.
- Integrity: Supporting the accuracy and integrity of electronic records.
- Availability: Supporting authorized access to information when needed.
- Accountability: Establishing responsibilities for access and information handling.
Security controls and implementation details are subject to product configuration, operational processes, and the applicable service agreement.
3. Access Controls and User Accountability
HealthVision includes role-based access controls and supported audit functionality to help healthcare organizations manage access to electronic records.
These capabilities support practices in assigning permissions based on staff responsibilities and reviewing available system activity.
Healthcare organizations remain responsible for configuring users and permissions appropriately within their environments.
Verification required before publishing[Verification required: Confirm authentication controls, audit coverage, administrator settings, and account-management responsibilities.]
4. Business Associate Agreements
Where required under HIPAA, a Business Associate Agreement (BAA) establishes the responsibilities of HealthVision and a healthcare organization regarding protected health information.
Applicable agreements address matters such as:
- Permitted uses and disclosures of protected health information.
- Safeguards and security responsibilities.
- Reporting of unauthorized disclosures and security incidents.
- Subcontractor obligations.
- Assistance with applicable patient rights.
- Return or destruction of information when required.
The terms of an executed BAA govern the applicable relationship.
Learn more: Business Associate Agreement →
5. Security Incidents and Breach Response
Healthcare information security requires preparation for potential security incidents.
When an incident affects protected health information, applicable HIPAA requirements and contractual provisions determine investigation, cooperation, and notification responsibilities.
HealthVision's internal procedures and customer agreements must define appropriate reporting channels and responsibilities.
Verification required before publishing[Verification required: Confirm incident response procedures, breach notification contacts, and contractual reporting periods.]
6. Working With Healthcare Service Providers
Healthcare software may rely on third-party services for hosting, prescribing, laboratory connectivity, insurance transactions, and other supported functions.
When a subcontractor creates, receives, maintains, or transmits protected health information on behalf of a business associate, the applicable HIPAA requirements must be addressed.
Specific integration providers, data-sharing arrangements, and responsibilities are governed by the relevant agreements.
7. Patient Privacy Rights
Patients may have rights under HIPAA concerning access to their health information, amendments, accounting of certain disclosures, and other privacy matters.
Healthcare providers generally administer these requests as the covered entities responsible for their patients' records.
If you are a patient seeking access to your records or have concerns about how your healthcare information is used, contact your healthcare provider.
HealthVision may assist healthcare organizations with applicable requests as required by contractual arrangements.
8. Sensitive Health Information
Some categories of healthcare information may be subject to additional legal protections, including certain substance use disorder treatment records under 42 CFR Part 2.
The applicability of these requirements depends on the nature of the information, the organization, and the relevant data-processing arrangements.
Verification required before publishing[Verification required: Determine whether HealthVision supports any Part 2-regulated workflows and the associated confidentiality, consent, and record-handling requirements.]
9. Contact Us About HIPAA and Security
For questions regarding HealthVision's HIPAA responsibilities, security documentation, or Business Associate Agreements, contact:
HealthVision Compliance Team
Email: [Verified Compliance Email]
Legal Entity: [Registered Legal Entity]
Address: 1305 22nd St
Suite 230
Oak Brook, IL 60523
For patient medical records or patient privacy requests, contact the healthcare provider responsible for those records.
Related pages: Privacy Policy · Business Associate Agreement · Patient Portal Terms & Privacy