HIPAA Security and Privacy Rules
We support privacy review with access controls, audit records and campaign consent preferences, while your team determines its obligations and the procedures it needs.
Subject type: United States law and regulation. The HIPAA Security and Privacy Rules apply to covered entities and their business associates. This page describes product controls. It is not a compliance determination.
What is built
- Care Medical records provides controlled access and activity evidence.
- Patient portal is included as a patient-facing review surface.
- Engage campaigns uses recorded consent preferences in its supported workflow.
Customer and deployment scope
NextHealth products are built for facilities in the UAE, the wider GCC and nearby markets. A deployment that would hold regulated US data is assessed for that purpose before anything is agreed. This page does not say every deployment is suitable for regulated US use.
Business associate agreement and security documentation
No business associate agreement is published on this site. Whether one is offered for a deployment, and on what terms, is decided through contract review, and contract material is published only after approval. Ask our team for the current security documentation for your deployment. This page lists controls only.
What your reviewer sees
Review representative roles, record activity and campaign preferences with the people responsible for privacy. A portal is a surface to assess, not proof of an automated rights-request workflow. A marketing preference does not establish the legal basis for every use of health information. Examine contracts, access procedures, disclosures, retention and technical documentation alongside any demonstration.
Official source
U.S. Department of Health and Human Services: HIPAA for professionals. The department publishes the rules and its guidance. No legal compliance determination, certification, automatic rights handling, contractual term or transfer arrangement is claimed.
What we claim, precisely
The system holds the evidence; the facility's accountable person attests. Nothing here asserts that a facility is compliant.
Common questions
-
No. It identifies product controls and records for review. Your organisation must assess the applicable requirements, processing arrangements, contracts and procedures before making a compliance determination.
-
No agreement is published on this site. Whether one is offered for a deployment is decided through contract review. It is not assumed from this page.
-
No. Suitability depends on the deployment, the hosting, the contracts and your organisation’s own assessment. This page does not say a deployment meets HIPAA requirements.
Not answered here? Contact the team
NXH Flow