Enterprise Healthcare Privacy Policy & HIPAA Compliance Notice

1. Scope & Regulatory Framework

This Privacy Policy describes how CodesForMD ("we", "us", or "our") collects, processes, secures, and discloses information obtained through our Hospital Management System (HMS), Electronic Medical Records (EMR/EHR), Laboratory Information Systems (LIS), and related clinical technology platforms.

Our privacy practices are governed by applicable healthcare privacy and data protection statutes worldwide, including:

• HIPAA: Health Insurance Portability and Accountability Act of 1996, as amended by the HITECH Act of 2009.
• HIPAA Omnibus Rule of 2013: Establishing direct statutory liability for Business Associates.
• GDPR: General Data Protection Regulation (Regulation (EU) 2016/679) for processing special category health data under Article 9.
• PIPEDA: Personal Information Protection and Electronic Documents Act (Canada).

2. Role as a HIPAA Business Associate

When our healthcare provider customers (Covered Entities) utilize CodesForMD to store, transmit, or process patient data, CodesForMD acts strictly as a Business Associate under 45 CFR § 160.103.

In accordance with HIPAA statutory mandates:

• We execute a binding Business Associate Agreement (BAA) with every Covered Entity prior to any production deployment.
• We implement administrative, physical, and technical safeguards that reasonably and appropriately protect the confidentiality, integrity, and availability of electronic Protected Health Information (ePHI).
• We mandate that any downstream subcontractors or cloud infrastructure partners (e.g. AWS, Microsoft Azure) execute equivalent Subcontractor BAAs.
• We report any verified Security Incident or Breach of Unsecured PHI to the Covered Entity without unreasonable delay and within guaranteed contractual timeframes.

3. Categories of Information Processed

Depending on the software modules deployed by your healthcare organization, CodesForMD processes the following categories of data:

A. Protected Health Information (PHI)

Processed solely under customer direction and BAA terms: patient identifiers (name, MRN, date of birth, SSN/national ID), clinical documentation, physician SOAP notes, laboratory analyzer results, prescription dispensing records, diagnostic radiology scans (DICOM), and insurance billing claim details (EDI 837/835).

B. Healthcare Professional & Administrative Data

Credentials, contact information, National Provider Identifiers (NPI), medical license numbers, and digital signatures for doctors, nurses, pharmacists, and billing personnel.

C. Forensic & Audit Telemetry Data

Immutable log records capturing user IP addresses, session timestamps, endpoints accessed, and patient record modifications to fulfill statutory HIPAA forensic audit trail requirements.

4. Zero Data Monetization & Use Restrictions

In the healthcare industry, patient trust is paramount. CodesForMD maintains an explicit, contractually enforceable policy regarding data usage:

Any algorithmic de-identification of data for population health research or platform performance optimization is performed strictly in accordance with 45 CFR § 164.514 (Safe Harbor Method or Formal Expert Statistical Determination).

5. Data Encryption & Storage Standards

All data handled by CodesForMD is protected by multi-layered defense-in-depth cryptography:

• Encryption in Transit: All data transmitted across public and private networks is encrypted using Transport Layer Security (TLS 1.3 or TLS 1.2) with strong cipher suites. Unencrypted HTTP is strictly disabled.
• Encryption at Rest: All databases, disk volumes, object stores, and automated system backups are encrypted using Advanced Encryption Standard (AES) with 256-bit keys managed through dedicated Hardware Security Modules (HSM).
• Cryptographic Multi-Tenancy: Multi-tenant application databases utilize separate per-entity cryptographic salt keys, guaranteeing that one hospital cannot access another entity's data records.

6. Patient Privacy Rights & Access

Under the HIPAA Privacy Rule and international data protection laws, patients hold defined legal rights regarding their health records:

• Right of Access: Patients have the right to inspect and obtain digital copies of their designated record set. We provide our provider clients with patient portal tools (FHIR Patient Access API) allowing instant digital export in C-CDA or PDF format.
• Right to Amend: Patients may request corrections to erroneous clinical or demographic records, which are reviewed and countersigned by licensed clinical personnel.
• Right to an Accounting of Disclosures: Covered entities can generate automated audit reports detailing all disclosures of a patient's PHI outside routine treatment, payment, and health care operations.

7. Data Retention & Secure Destruction

CodesForMD retains healthcare data only for the duration specified in customer service agreements and applicable statutory retention guidelines (typically 7 to 10 years for adult medical records, or until age of majority plus statute of limitations for pediatric charts).

Upon contract termination or written request from a healthcare covered entity, all customer data is either securely exported in standardized formats or permanently destroyed using cryptographic erasure standards compliant with NIST Special Publication 800-88 Revision 1 (Guidelines for Media Sanitization).

8. Privacy Officer & Data Protection Inquiries

If you have questions, concerns, or requests regarding this Privacy Policy or our HIPAA compliance practices, please contact our dedicated Data Protection Officer (DPO) and Chief Privacy Officer:

9. Frequently Asked Questions