Compliance
HIPAA Compliance & Healthcare Data Privacy Solutions
Medtransic is HIPAA compliant. This page sets out how we protect your patients' protected health information (PHI).
Our HIPAA Commitment
Medtransic is a HIPAA-compliant business associate that understands the critical importance of protecting patient privacy and maintaining the confidentiality, integrity, and availability of protected health information.
Hosted Under a Signed BAA
The Medtransic client portal runs on Amazon Web Services under a signed Business Associate Agreement. Files travel over HTTPS and are stored encrypted.
Who Can See Your Client Records
Access is set by role, so each person sees only what their job needs.
- Operations manager: has access to client records.
- Credentialing team: sees only credentialing data and what each payer requires.
- Billing: billing records stay with operations.
Administrative Safeguards
Comprehensive policies and procedures to protect PHI access and usage.
Physical Safeguards
Workstations with controlled access to PHI.
Technical Safeguards
Advanced encryption, access controls, and audit logging systems.
Staff Training
Regular HIPAA training for all team members.
Business Associate Agreement
As your business associate, Medtransic enters into a comprehensive Business Associate Agreement (BAA) with each healthcare provider client. This agreement ensures:
- Proper use and disclosure of PHI only as permitted or required
- Implementation of appropriate safeguards to prevent unauthorized use or disclosure
- Reporting of security incidents and breaches, as the agreement and HIPAA require
- Ensuring subcontractors also comply with HIPAA requirements
- Return or destruction of PHI upon contract termination
Security Measures
Technical Safeguards
- Portal files sent over HTTPS and stored encrypted
- Two-factor authentication on every Medtransic staff portal account
- Role-based access controls and user permissions
- Comprehensive audit logging and monitoring
Administrative Safeguards
- Designated HIPAA Security Officer
- Regular staff HIPAA training
- Incident response and breach notification procedures
- Regular security risk assessments
Breach Response Protocol
In the unlikely event of a security incident, we have established comprehensive breach response procedures:
Immediate Response
Contain and assess the incident
Client Notification
Notify the affected practice without unreasonable delay, and no later than 60 days after discovery (45 CFR 164.410)
Regulatory Reporting
Report to HHS and other authorities as required
Questions About Our HIPAA Compliance?
Our HIPAA Security Officer is available to answer any questions about our compliance measures and security protocols.
Contact Our Security Officer