HIPAA and protected health information

1. Our role under HIPAA

When NightingaleMD acts as a Business Associate under an executed Business Associate Agreement, we apply administrative, physical, and technical safeguards designed to support our obligations under HIPAA and HITECH. The covered entity remains responsible for its own HIPAA obligations and for configuring authorized uses of NightingaleMD services.

2. Business Associate Agreements

NightingaleMD enters into a Business Associate Agreement, as appropriate, before processing PHI on behalf of a covered entity. Our BAAs address:

• Permitted uses and disclosures of PHI.
• Safeguards designed to prevent unauthorized use or disclosure.
• Security-incident and breach-reporting obligations.
• Return or destruction of PHI at termination where feasible and required.
• Support for covered-entity obligations involving access, amendment, and disclosure records.
• Applicable obligations for subcontractors that handle PHI.

3. Administrative safeguards

• Assigned responsibility: Designated privacy and security responsibilities for policies, safeguards, risk management, and incident response.
• Workforce practices: Role-appropriate training, confidentiality duties, and access authorization for workforce members who may handle PHI.
• Risk management: Periodic assessment of security risks and remediation of identified gaps.
• Incident response: Documented procedures for investigation, containment, recovery, and required notification.
• Access management: Access granted according to job responsibilities and reviewed as roles change.
• Continuity: Backup, recovery, and contingency measures appropriate to the systems handling PHI.

4. Physical safeguards

We use cloud infrastructure and vendors evaluated under our security and vendor-management processes, including applicable contractual protections and independent assurance reports. Workforce endpoint, workspace, and media controls govern physical access to systems and devices that may handle PHI.

5. Technical safeguards

• Encryption: Encryption protects information in transit and at rest where applicable.
• Access controls: Unique identities, authentication controls, authorization boundaries, and session protections restrict access to authorized users and services.
• Audit and monitoring: Security and operational records support review, investigation, and response for systems that handle PHI.
• Integrity and transmission: Controls are designed to protect against unauthorized alteration and disclosure in storage and transmission.
• Patient matching: Configured workflows may match patients against multiple fields from the customer’s roster, EHR, or other source of truth. Caller ID alone is not proof of identity.

6. Standards-based integrations

Where enabled, NightingaleMD supports standards-based integrations, including FHIR R4 ingestion. Each customer remains responsible for its own interoperability, patient-access, and information-sharing obligations.

7. Breach notification

If NightingaleMD determines that unsecured PHI has been breached while we act as a Business Associate, we will:

• Notify the affected covered entity without unreasonable delay and within the period required by the applicable Business Associate Agreement and law.
• Provide available information needed for the covered entity’s notification obligations.
• Cooperate with investigation, containment, and remediation as required by the agreement and law.
• Maintain documentation in accordance with applicable retention obligations.

8. Individual rights

NightingaleMD supports covered entities in responding to applicable requests involving access, amendment, accounting of disclosures, restrictions, and confidential communications. Patients should ordinarily submit these requests to the provider, health plan, or other covered entity responsible for their record.

9. Ongoing safeguards and independent assurance

Our privacy and security program includes policy review, workforce training, risk management, vulnerability management, incident response, vendor oversight, and monitoring appropriate to the systems in scope.

Our SOC 2 Type 2 observation period began September 15, 2026. The independent report is targeted for December 2026, subject to completion of the audit. Status as of October 2, 2026. Security materials are available to qualified prospects and customers on request.

For information about personal information beyond PHI, see our Privacy policy.

10. Privacy and security inquiries