Privacy Policy & HIPPA Compliance Policy
HIPAA Compliance Policy
The Health Insurance Portability and Accountability Act of 1996 (HIPAA) mandates the management of access to Protected Health Information (PHI) to ensure the integrity, confidentiality, and availability of electronic PHI (ePHI) data. We are a fully HIPAA-compliant organization.
I. Organization-Specific Information
Organization Details
-
Organization Name: Supportive Touch Massage Therapy
-
Physical Address:
7160 Chagrin Rd
Suite 125
Chagrin Falls, OH 44023
-
Contact Information:
-
Email: massage@supportivetouch.com
Compliance Officer
-
Name: Mandy Bartolovich
-
Title: Owner, LMT
-
Contact Information:
-
Email: massage@supportivetouch.com
-
Technical Infrastructure
-
Security Infrastructure:
-
SSL website security certificate
-
We use a HIPAA-compliant 3rd party provider called Vagaro to collect your personal information required to book an appointment with us. You can learn about Vagaro’s HIPAA compliance here: https://support.vagaro.com/hc/en-us/articles/360034898234-HIPAA-Compliance
-
Technology Tools:
-
Wix: informational website only
-
Vagaro: HIPAA-compliant 3rd party booking app (see above)
-
II. Policy Statement
Purpose
This policy establishes the guidelines for ensuring compliance with the Health Insurance Portability and Accountability Act (HIPAA) to protect the privacy and security of Protected Health Information (PHI).
Scope
This document applies to all employees, contractors, and business associates engaged with the handling, receiving, maintaining, or transmitting of PHI within the organization.
III. Definitions
-
Protected Health Information (PHI): Information that concerns health status, provision of health care, or payment for health care that can be linked to an individual.
-
Covered Entity: A healthcare provider, health plan, or healthcare clearinghouse that processes PHI.
-
Business Associate: A person or entity that performs activities or services for or on behalf of a Covered Entity involving the use or disclosure of PHI.
IV. Roles and Responsibilities
-
HIPAA Compliance Officer: Appointed individual responsible for implementing and overseeing compliance with HIPAA regulations within the organization.
-
Employees: Must adhere to all policies and procedures outlined in this document and report any security incidents or breaches.
V. Privacy Procedures
-
Minimum Necessary Use and Disclosure: PHI should be disclosed only to the extent necessary to accomplish the intended purpose.
-
Patient Rights: Detailed explanation of patients' rights to access, amend, and receive an accounting of disclosures regarding their PHI can be found in the downloads below:
HIPAA Right of Access Videos
OCR has teamed up with the HHS Office of the National Coordinator for Health IT to create Your Health Information, Your Rights!, a series of three short, educational videos (in English and option for Spanish captions) to help you understand your right under HIPAA to access and receive a copy of your health information.
HIPAA Right of Access Infographic
OCR has teamed up with the HHS Office of the National Coordinator for Health IT to create this one-page fact sheet, with illustrations, that provides an overall summary of your rights under HIPAA: