Prisco / HIPAA compliance
HIPAA compliance and PHI safeguards.
How we protect protected health information, and what you can expect from us before, during and after the work.
Our commitments
An agreement first. Safeguards throughout.
- A Business Associate Agreement is signed before any PHI is handled, including for a pilot. You may use your own agreement or ours.
- We meet the HIPAA Privacy, Security and Breach Notification Rules that apply to a Business Associate.
- Only the minimum necessary PHI is made available, and only to the staff who need it.
- HIPAA applies to a Business Associate directly, wherever it is located. Our BAA, access controls and breach procedures are built for that.
Some payer contracts and state programs restrict offshore access to PHI. We review yours with you before any work begins.
Safeguards we maintain
Administrative, physical and technical.
Administrative
- Risk analysis: regular review of where PHI lives and moves, with a documented fix for each risk
- Policies and training: written policies, HIPAA training and confidentiality agreements
- BAAs and vendors: agreements signed before PHI access, with the same standard for any subcontractor
- Incident response: report, contain and document incidents in line with breach notification rules
- Contingency plans: backup and recovery so that data and work survive an outage
Physical
- Controlled facilities: delivery centers limited to authorized staff, with biometric entry
- Clear desk and screens: no paper, phones or personal storage at workstations; screens positioned and locked
- Device and media controls: external printing and removable or recording media disabled on work systems
- Secure disposal: PHI returned or destroyed as your agreement states, with a record
Technical
- Unique IDs and role-based access: each person has their own login and sees only what the role needs
- Multi-factor sign-in for access to client systems
- Encryption and VPN: AES-256 for data at rest and in transit, and a secure VPN into client EHRs
- Audit logs: endpoint and access activity logged and reviewed
- Automatic logoff: idle sessions close on their own
How PHI moves through our process
- ReceiveThrough a secure, agreed channel
- Limit accessOnly the staff who need it
- Code and reviewWith quality checks
- ReturnEncrypted, logged, confirmed
- Retain or disposeAs your agreement states
Documents
Read the details.
BAA & offshore PHI safeguards
How we sign and honor a Business Associate Agreement as an India-based vendor.
Terms & conditions
The terms that govern use of our website and services.
Privacy policy
How we collect, use and protect information.
Do not send PHI through the website or by ordinary email. This page describes our safeguards and is not legal advice.