HIPAA Compliance
HIPAA compliance at HighKey Agency
Our clients are physicians. Their patients trust them with some of the most personal information there is, and when a practice brings us in, that trust extends to us. We take it seriously. This page explains when HIPAA applies to our work and how we protect patient information.
When HIPAA applies to our work
- Only what is needed. We collect and use the minimum patient information needed to do the job, and nothing more.
- Limited access. Only team members who need patient information to do their work can see it. Every account uses its own login and two-factor sign-in.
- Secure systems. Patient information is kept only in systems whose vendors have signed a BAA with us and that support HIPAA safeguards.
- Trained people. Every team member and contractor who may see patient information completes HIPAA training and signs a confidentiality agreement.
- A named officer. Our Privacy and Security Officer oversees these practices and answers questions from practices and patients.
- A plan if something goes wrong. If we discover a breach involving a practice’s patient information, we notify that practice without unreasonable delay and within the time required by law and by our agreement.
Patient photos, videos, and testimonials
Before-and-after photos, patient videos, and testimonials are powerful, and they belong to the patient first. We only use patient content when the practice has the patient’s written authorization. We remove or blur details that could identify a patient when they are not needed, and we stop using any content if a patient withdraws consent.
When we film at your practice, our videographers keep patient charts, screens, and patients who have not given consent out of the shot.
Advertising and tracking
We do not put patient health information into advertising platforms. Our ad lead forms ask for contact details and general interest, not medical history, and we set up website tracking so it does not send health information to ad or analytics tools.
How practices can help
- Please do not send patient information by text message, social media message, or regular email. Ask us for the secure way to share it.
- Send us the patient’s signed authorization before we use any patient photo, video, or testimonial.
- Tell us right away if a patient withdraws consent.
This website
The forms on highkeyagency.com are for business inquiries from practices. Please do not enter any patient information in them.
Questions
If you have a question about how we handle patient information, contact our Privacy and Security Officer at [email protected].
This page describes our practices and is for general information. It is not legal advice. For practices we work with, the terms of our Business Associate Agreement govern.