HIPAA Privacy Policy

Introduction

FIGmd, Inc. (“FIGmd”, “we” or “us”) takes privacy very seriously. We protect the privacy and confidentiality of data that we obtain subject to the terms of a Business Associate Agreement and pursuant to the Health Insurance Portability and Accountability Act of 1996, as amended by the Privacy and Security provisions set forth in the Health Information Technology for Economic and Clinical Health Act (“HIPAA”).

Purpose

This Policy is provided to help you better understand how we at FIGmd, Inc. use, disclose and protect such data in accordance with the terms of Business Associate Agreements.

Scope

Our HIPAA Privacy Policy attests to our commitment to privacy and demonstrates the ways we ensure that patient privacy is protected. Our Privacy Policy applies to the personal health information of all our patients that is in our possession and control.

Enforcement Policy

1. Definitions

   Terms used but not otherwise defined in this Agreement shall have the same meaning as those terms in the Standards for Privacy of Individually Identifiable Health Information at 45 CFR Part 160 and Part 164, Subparts A and E, under HIPAA (the “Privacy Rule”) and the Security Standards for the Protection of Electronic Protected Health Information at 45 CFR Part 160 and Part 164, Sub parts A and C, under HIPAA (the “Security Rule”).

   • Protected Health Information (“PHI”)

     PHI includes all Individually Identifiable Health Information that is transmitted or maintained in any form or medium by a Covered Entity.

   • Covered Entity

     A Covered Entity is a health plan, health care provider or healthcare clearinghouse that must comply with the Privacy Rule.

   • Business Associate Agreement (“BAA”)

     A BAA is a formal written contract between FIGmd, Inc. and a Covered Entity that requires FIGmd, Inc. to comply with specific requirements related to PHI.

2. Use and Disclosure of PHI

   We may use PHI for our management, administration, data aggregation and legal obligations to the extent such use of PHI is permitted or required by the BAA and not prohibited by law. We may use or disclose PHI on behalf of, or to provide services to, Covered Entities for purposes of fulfilling our service obligations to Covered Entities, if such use or disclosure of PHI is permitted or required by the BAA and would not violate the Privacy Rule.

   In the event that PHI must be disclosed to a subcontractor or agent, we will ensure that the subcontractor or agent agrees to abide by the same restrictions and conditions that apply to us under the BAA with respect to PHI, including the implementation of reasonable and appropriate safeguards.We may also use PHI to report violations of law to appropriate federal and state authorities.

3. Safeguards

   We use appropriate safeguards to prevent the use or disclosure of PHI other than as provided for in the BAA. We have implemented administrative, physical and technical safeguards that reasonably and appropriately protect the confidentiality, integrity and availability of the electronic protected health information that we create, receive, maintain or transmit on behalf of a Covered Entity. Such safeguards include:

   • Maintaining appropriate clearance procedures and providing supervision to assure that our workforce follows appropriate security procedures.
   • Providing appropriate training for our staff to assure that our staff complies with our security policies.
   • Making use of appropriate encryption when transmitting PHI over the internet.
   • Utilizing appropriate storage, backup, disposal and reuse procedures to protect PHI.
   • Utilizing appropriate authentication and access controls to safeguard PHI.
   • Utilizing appropriate security incident procedures and providing training to our staff sufficient to detect and analyze security incidents.
   • Maintaining a current contingency plan and emergency access plan in case of an emergency to assure that the PHI we hold on behalf of a Covered Entity is available when needed.

4. Mitigation of Harm

   In the event of a use or disclosure of PHI that is in violation of the requirements of the BAA, we will mitigate, to the extent practicable, any harmful effect resulting from the violation. Such mitigation will include:

   • Reporting to the Covered Entity any use or disclosure of PHI not provided for by the BAA and any security incident of which we become aware.
   • Documenting such disclosures of PHI and information related to such disclosures as would be required for the Covered Entity to respond to a request for an accounting of disclosure of PHI in accordance with HIPAA.

5. Access to PHI

   As provided in the BAA, we will make available to Covered Entities, information necessary to give individuals their rights of access, amendment and accounting in accordance with HIPAA regulations.

   Upon request, we will make our internal practices, books and records, including policies and procedures, relating to the use and disclosure of PHI received from, or created or received by us on behalf of a Covered Entity, available to the Covered Entity or the Secretary of the U.S. Department of Health and Human Services for the purpose of determining compliance with the terms of the BAA and HIPAA regulations.