1. About This Notice
This Notice of Privacy Practices describes how health information about you may be used and shared when you or your medical practice uses the Telemedcore platform. It also explains your rights regarding that information. We are required to provide this notice under the HIPAA Privacy Rule (45 CFR 164.520).
Please read this notice carefully. If you have questions, contact us at the email address listed at the end of this page.
2. Who This Notice Applies To
This notice applies to medical practice tenants that use the Telemedcore platform to manage real patient data in production mode. These accounts handle Protected Health Information (PHI) and are subject to HIPAA requirements.
This notice does not apply to educational institution tenants operating in simulation mode. Simulation accounts use only fictitious training data and carry no HIPAA liability. For more details, see our Business Associate Agreement, Section 8.
3. How We Protect Your Information
We use multiple layers of security to keep health information safe:
- Encryption at rest. All stored data is encrypted using industry-standard encryption, the same standards used by banks and government agencies.
- Encryption in transit. All data sent between your browser and our servers is protected with modern TLS encryption.
- Practice isolation. Each practice’s data is kept completely separate from other practices using comprehensive security controls. One practice can never see another practice’s data.
- Role-based access. The platform uses multiple roles, each with different levels of access. Users only see the data they need for their role.
- Audit logging. Every access to health information is recorded in a comprehensive audit log with integrity controls that tracks who accessed what, when, and from where.
- Multi-factor authentication. The platform supports MFA to add an extra layer of security beyond passwords.
- Session timeout. Sessions automatically end after a period of inactivity to prevent unauthorized access on unattended devices.
- Strong passwords. All accounts require strong passwords meeting security complexity requirements.
While we implement these technical and administrative safeguards, no security system is impenetrable. These controls reduce-but do not eliminate-the risk of unauthorized access or data breach. We will notify affected parties of any breach in accordance with HIPAA Breach Notification Rule requirements.
For a comprehensive overview of our security architecture and threat detection capabilities, see our Security page.
4. How Health Information May Be Used and Shared
Health information handled through the Telemedcore platform may be used or shared in the following ways:
- Treatment. Providers may access patient records to deliver care, such as viewing medical history, recording diagnoses, and documenting encounter notes.
- Payment. The platform generates claims, invoices, and billing documents so that practices can receive payment for services provided.
- Healthcare operations. Practices may use the platform for quality improvement, staff training, auditing, and administrative functions.
- Required by law. We may disclose health information when required to do so by federal, state, or local law.
- With your written permission. For any use or sharing not described above, your medical practice must obtain your written authorization first. You may revoke that authorization at any time in writing.
5. Your Rights
You have the following rights regarding health information that your medical practice maintains through the Telemedcore platform:
- Right to access. You may request copies of your health information. Your practice must respond within 30 days.
- Right to request corrections. If you believe your health information contains an error, you may ask your practice to correct it. The practice must respond within 60 days.
- Right to an accounting of disclosures. You may request a list of times your health information was shared for purposes other than treatment, payment, or healthcare operations.
- Right to request restrictions. You may ask your practice to limit how your information is used or shared. The practice is not required to agree, except in certain cases involving payments you have made in full out of pocket.
- Right to confidential communications. You may ask your practice to contact you in a specific way (for example, by mail instead of phone) or at a specific address.
- Right to be notified of a breach. If your health information is involved in a security breach, you have the right to be notified.
To exercise any of these rights, contact your medical practice directly. Your practice is the Covered Entity responsible for your health information.
6. Our Responsibilities
As the Business Associate operating the Telemedcore platform, we are required to:
- Maintain the privacy and security of all health information stored on the platform
- Provide this notice explaining our privacy practices
- Follow the terms of this notice as currently in effect
- Notify your medical practice (and through them, you) if a breach occurs that may have compromised your health information
- Not use or share your health information other than as described in this notice or as permitted by our Business Associate Agreement with your practice
7. Changes to This Notice
We may update this notice from time to time. When we do, we will post the revised notice on this page and update the effective date at the top. We encourage you to review this notice periodically. Changes apply to all health information we hold, including information collected before the change.
8. Filing a Complaint
If you believe your privacy rights have been violated, you may:
- Contact us directly at contact@telemedcore.com
- File a complaint with the U.S. Department of Health and Human Services, Office for Civil Rights, at www.hhs.gov/ocr/privacy/hipaa/complaints
You will not be penalized or retaliated against for filing a complaint.
If you have questions about this notice or our privacy practices, please contact us at:
Telemedcore
Email: contact@telemedcore.com
Website: telemedcore.com