Data Processing Agreement

• Process personal health information only as directed by the health information custodian
• Implement appropriate technical and organizational safeguards
• Maintain audit logs of all data access and processing activities
• Report any suspected data breaches within 24 hours
• Ensure secure data residency when required

• End-to-end encryption for all data transmission
• Encryption at rest for all stored data
• Multi-factor authentication for all system access
• Regular security assessments and penetration testing
• Staff background checks and security training

Under HIPAA, patients have the right to:

• Access their personal health information
• Request corrections to inaccurate information
• File complaints with the U.S. Department of Health and Human Services (HHS)
• Request information about how their data is being used