HIPAA Notice of Privacy Practices

This HIPAA Notice describes how Medicare EHR ("we," "us," or "our") handles Protected Health Information ("PHI") when we provide electronic health record and clinic operations services to healthcare organizations.

This notice is provided for transparency. When we process PHI on behalf of a covered entity (such as a hospital, clinic, or practice), we act as a business associate under the Health Insurance Portability and Accountability Act of 1996 (HIPAA), as amended by the Health Information Technology for Economic and Clinical Health Act (HITECH).

A covered entity determines the purposes for which PHI is used. We process PHI only to perform services for the covered entity, as instructed in our agreement with that organization, or as required by law.

We do not use or disclose PHI for our own marketing purposes. Workforce members with access to PHI are authorized based on role and tenant scope.

Subject to the Business Associate Agreement (BAA) with each customer, we may use and disclose PHI for the following purposes:

We implement administrative, physical, and technical safeguards designed to meet the requirements of the HIPAA Security Rule, including:

We configure the platform so that users receive access to PHI based on assigned roles (for example, reception, nursing, clinical, pharmacy, lab, finance, and administration). Covered entities are responsible for provisioning accounts and reviewing access periodically.

We may engage subprocessors (such as cloud hosting, email delivery, payment, observability, or telehealth providers) that create, receive, maintain, or transmit PHI on our behalf. We require subprocessors that handle PHI to agree to appropriate restrictions and safeguards consistent with HIPAA.

A list of material subprocessors is available to enterprise customers upon request. Customers should not send PHI to subprocessors outside the contracted platform without authorization.

Under HIPAA, individuals have rights regarding their PHI, including rights of access, amendment, and accounting of disclosures in certain circumstances. Because we act as a business associate, requests to exercise these rights should generally be directed to the covered entity that maintains the individual's record of care.

We will assist our customers in responding to such requests as required by our BAA and applicable law.

In the event of a breach of unsecured PHI, we will notify the affected covered entity without unreasonable delay and in accordance with 45 C.F.R. § 164.410 and the terms of the BAA.

Notification will include, to the extent known, the identification of each individual whose unsecured PHI has been, or is reasonably believed to have been, accessed, acquired, used, or disclosed, together with any additional information required by law or contract to support the covered entity's breach notification obligations to individuals and regulators.

Enterprise customers may execute a Business Associate Agreement with us before or during onboarding. The BAA defines permitted uses, safeguards, subcontractor requirements, termination provisions, and return or destruction of PHI.

To request a BAA or security documentation package, contact support@medicare-ehr.sl.

We retain PHI for the period necessary to provide services under the customer agreement. Upon termination, we will return or destroy PHI as specified in the BAA, subject to legal retention requirements and backup media constraints described in the agreement.

Customers may configure backup retention policies within the platform's administrative backup settings.

We may update this notice to reflect changes in law, regulatory guidance, or our services. The effective date at the top of this page will be revised when material changes are made. Continued use of the platform after notice of an update constitutes acknowledgment of the revised notice where permitted by contract.

Individuals who believe their privacy rights have been violated may file a complaint with their healthcare provider (the covered entity) or with the U.S. Department of Health and Human Services Office for Civil Rights.

We prohibit retaliation against anyone for filing a complaint or participating in an investigation.

Privacy and HIPAA inquiries: support@medicare-ehr.sl

Postal inquiries: Available to enterprise customers upon request.

For product security controls and technical safeguards, visit the Security page linked below.