Source: https://www.mediprocity.com/frontpage/mediprocity-hipaa-statement
Timestamp: 2019-04-24 06:46:17+00:00

Document:
This Notice applies to the network owned or managed by Mediprocity, Inc. (“Mediprocity.com”).
State and federal law require Mediprocity Inc. to Maintain the privacy of your health information provide you with this notice about our legal duties and privacy practices and your legal rights pertaining to health information.
We reserve the right to change our information practices and to make the changes effective for all protected health information we maintain. Should our information practices change, we will change our Notice of Privacy Practices and make the new Notice available to you.
Technical safeguards mean the technology and the policy and procedures for its use that protect electronic protected health information and control access to it.
The Security Rule’s technical safeguards do not mandate a specific technology solution but rather employ the adaptable requirement that an entity uses any and as many security measures as are reasonable and appropriate. These security measures are required to meet several standards, as described below. Mediprocity meets -- and in many cases exceeds -- these standards while bringing innovative flexibility and features to healthcare users.
Mediprocity does not keep non-encrypted patient information on file - only our users will keep this on file. Mediprocity does not send patient information. Any health records that are on our website are secured using SSL or fully encrypted and controlled by the user.
Access means the ability or the means necessary to read, write, modify, or communicate data/information or otherwise use any system resource.
The access control standard § 164.312(a)(1) requires that a covered entity must: Implement technical policies and procedures for electronic information systems that maintain electronic protected health information to allow access only to those persons or software programs that have been granted access rights as specified in §164.308(a)(4).
Mediprocity has implemented administrative and technical security control mechanisms including but not limited to login time-outs, encryption, unique user IDs and logging to support client compliance with information security regulations and guidelines. Users should be aware these technical controls operate in combination with User selected controls implemented on User owned and operated mobile devices, web browsers, and personal computers. Users should implement appropriate access controls on devices used to access Mediprocity. Users should implement timeouts of shorter duration than the desktop application which is set for 2 hours when using a browser. Users on desktops or laptops should implement a much shorter timeout that would enable their system to go to sleep and enable password protection. As a general recommendation, security controls should be stricter on mobile devices or any computer located in publicly accessible areas, e.g. login time outs should be immediate or very short on these devices.
Mediprocity sets application timeouts based on typical use models and to accommodate standards across multiple client organizations. Users should set device-specific timeouts to match their organization security policies.
Mediprocity is not liable for any harm related to relaxed or absent access control mechanisms on User owned and operated devices including but not limited to mobile phone screen locks or personal computer desktop screen time-outs.
Mediprocity has the ability to monitor and collects a report on the failed logins and access auditing. If an organization administrator needs a report on users associated with their org may request one from Mediprocity Security with the date range, organization name. The organization admin panel does, however, allow any super admin to invite/deactivate and see who is active in their organization. For a detailed report request please contact Mediprocity Support.
Unique user identification § 164.312(a)(2)(i).
Assign a unique name and/or number for identifying and tracking user identity.
Implement electronic procedures that terminate an electronic session after a predetermined time of inactivity. Users of Mediprocity have to enter their password and encryption key after 2 hours of inactivity, and every time the application is re-opened, in order to view or respond to information on the platform.
The mobile apps do not have automatic logoff. iOS does include an extra layer with a user enable PIN. But both apps do remain in a logged-in state. Mediprocity recommends all users who utilize the apps, enable a 4-digit PIN on their apps. Should you have your apps stolen or lost, you may do one of the following (a) get to the closet computer, log into your Mediprocity account and change your password. This sends a signal to the lost device for remote log off. (b) contact your system administrator to log into your account and change your password to trigger the remote log off. (c) contact Mediprocity support by calling: 636-812-0242 or for immediate response email Support and we will update your password and trigger the remote log out. Mediprocity Support can also see if your app was accessed during the time period you specify for the lost device.
Implement electronic procedures that terminate an electronic session after a predetermined time of inactivity. Users of Mediprocity have to enter their password and encryption key after 2 hours of inactivity, and every time the application is reopened, in order to view or respond to information on the platform.
Encryption and decryption § 164.312(a)(2)(iv).
To protect sensitive health information from unauthorized access, all data on the Mediprocity network is protected using the Secure Sockets Layer (SSL) protocol. All data that is encrypted on our platform is using triple-layer encryption end-to-end using 256-bit Advance Encryption Standard.
(AES) encryption for message data both in motion and at rest and 4096-bit RSA encryption for key exchange between members of a conversation.
Additionally, Mediprocity has another private layer of encryption that is proprietary to our company that is on top of the AES 256.
Mediprocity records and examines network activity to protect users, technical infrastructure and electronic health information from security violations.
No PHI is stored locally that is not encrypted on mobile devices. Users who have a mobile device can keep themselves logged in, but Mediprocity recommends that mobile users logout of their mobile app after each use prevent any data breach. In the event a user has a lost or stolen mobile device, Mediprocity can lock the user's account from the main platform. Also, users can log in and under My Account - Preferences users can simply send an automatic logoff signal to that device and/or installed the app by changing their password. This will send a signal to the registered device and auto-logout rendering all PHI on that device useless.
Integrity means the property that data or information have not been altered or destroyed in an unauthorized manner. Mediprocity archives all messages and referral content for 6 years per standards required.
The integrity standard § 164.312(c)(1) requires that a covered entity must: Implement policies and procedures to protect electronic protected health information from improper alteration or destruction.
Mediprocity protects the integrity of electronic health information on its secure platform via end-to-end encryption and decryption of communication between users over the SSL protocol.
To verify identity upon website access, Mediprocity authenticates with either login or registration. Existing user login requires a username and password and encryption key.
Mediprocity makes daily backups of all our data, we also make 2-week offsite HIPAA controlled backups of all data. Mediprocity has a full Disaster Recovery §164.310 (d) in place. Although Mediprocity does have redundancy and load balancing in place, should a serious disaster arise it could take up to 24 hours to fully bring the system back online. The disaster recovery plan does include proper backups.
By creating an account on Mediprocity and using the service you have bound yourself to this policy and will observe and report abuse to Mediprocity.
Make false statements, libelous, abusive, obscene or discriminatory.
Upload or provide links to spam, junk mail, viruses, chain letters or pyramid schemes.
Attempt to or actually override any security component included in or underlying Mediprocity.
Interfere or disrupt Mediprocity servers or databases and mobile applications.
Any of the DO NOT infractions shall be considered a trespass and computer fraud and/or abuse and will be punished to the full extent of the law by State and Federal limits.

References: § 164
 §164
 § 164
 § 164
 § 164
 §164