HIPAA Compliance

At EzCure Solutions, we take the security and privacy of patient health information seriously. We are fully committed to complying with the Health Insurance Portability and Accountability Act (HIPAA) and its Privacy, Security, and Breach Notification Rules. This page outlines our HIPAA compliance framework and how we protect the Protected Health Information (PHI) entrusted to us by our clients.

1. What Is HIPAA and Why It Matters

The Health Insurance Portability and Accountability Act (HIPAA) was enacted in 1996 to establish national standards for the protection of sensitive patient health information. HIPAA consists of several key rules:

• Privacy Rule: Sets standards for the use and disclosure of Protected Health Information (PHI) by covered entities and their business associates.
• Security Rule: Establishes administrative, physical, and technical safeguards to ensure the confidentiality, integrity, and availability of electronic PHI (ePHI).
• Breach Notification Rule: Requires covered entities and business associates to notify affected individuals, the Department of Health and Human Services (HHS), and in some cases, the media, of breaches of unsecured PHI.
• Enforcement Rule: Provides for investigations, penalties, and procedures for violations of HIPAA rules.

Compliance with HIPAA is not just a legal obligation; it is a fundamental part of our commitment to protecting patient privacy and earning the trust of our healthcare partners.

2. Protected Health Information (PHI) – Definition and Handling

Protected Health Information (PHI) is any information in a patient's medical record that can be used to identify an individual and that relates to their past, present, or future physical or mental health condition, treatment, or payment. This includes:

• Names, addresses, dates of birth, and Social Security numbers.
• Medical records, lab results, and test reports.
• Treatment plans, diagnoses, and prognosis.
• Billing and payment information.
• Any other information that could identify a patient, including photos and biometric data.

When we receive PHI from our clients, we treat it with the highest level of confidentiality. We limit its use to the specific purposes outlined in our Business Associate Agreement (BAA) – namely, to provide billing, credentialing, and denial management services. We never use PHI for marketing or any other non‑contractual purposes.

3. Our HIPAA Compliance Framework

EzCure Solutions has implemented a comprehensive compliance program that encompasses the following elements:

• Designated Privacy and Security Officers: Our Privacy Officer is Ahsan Kazmi, who oversees all HIPAA‑related matters. All staff are trained on their roles and responsibilities.
• Written Policies and Procedures: We have documented policies for the use, disclosure, and protection of PHI, covering all aspects of HIPAA compliance, including incident response and breach reporting.
• Risk Management: We conduct regular risk assessments to identify vulnerabilities in our systems and processes, and we implement corrective measures.
• Vendor Management: Any third‑party vendors who handle PHI on our behalf are required to sign BAAs and demonstrate their own compliance with HIPAA.

4. Business Associate Agreement (BAA)

Under HIPAA, a Business Associate (BA) is any person or entity that performs functions or activities involving the use or disclosure of PHI on behalf of a covered entity. EzCure Solutions is a Business Associate to our healthcare practice clients, and we sign a Business Associate Agreement (BAA) with every client.

Our BAA includes the following key provisions:

• Permitted uses and disclosures of PHI (limited to the contracted services).
• Obligations to safeguard PHI with appropriate administrative, physical, and technical safeguards.
• Reporting of any security incidents or breaches to the client within the required timeframe.
• Compliance with the HIPAA Security Rule for ePHI.
• Right of the client to request and receive an accounting of disclosures.
• Obligation to return or destroy PHI upon termination of the agreement.

We are fully committed to upholding the terms of our BAA with every client, and we regularly review our processes to ensure compliance.

5. Security Measures – Technical, Physical, and Administrative Safeguards

We implement a multi‑layered security strategy to protect ePHI against unauthorized access, alteration, destruction, or disclosure:

6. Breach Notification and Incident Response

Despite our rigorous safeguards, we recognize that no system is completely immune from potential breaches. We have established a robust incident response plan:

• Detection: We use continuous monitoring and alerting systems to detect potential security incidents involving PHI.
• Investigation: Our security team immediately investigates any suspected breach or unauthorized access.
• Containment: We take steps to contain the incident and prevent further exposure of PHI.
• Notification: If a breach of unsecured PHI is confirmed, we notify affected individuals, the client, and the Office for Civil Rights (OCR) within the timeframes required by HIPAA (generally within 60 days).
• Remediation: We implement corrective actions to prevent recurrence of the incident.

We maintain a written breach notification policy that outlines these procedures in detail, and we test our incident response plan regularly.

7. Employee Training and Awareness

Our employees are our first line of defense in protecting PHI. We provide comprehensive training on HIPAA compliance, including:

• Understanding what constitutes PHI and the importance of its protection.
• Proper handling of PHI in both paper and electronic formats.
• Recognizing and reporting potential security risks or violations.
• Password security, email encryption, and safe browsing practices.
• Procedures for verifying identity before disclosing PHI over the phone or in person.

Training is provided to all new hires and updated annually. We also conduct regular phishing simulations and security awareness campaigns to keep our staff vigilant.

8. Patient Rights Under HIPAA

HIPAA grants patients important rights regarding their health information. While we are a Business Associate and not a Covered Entity, we support our clients in honoring these rights, which include:

• Right to Access: Patients have the right to request copies of their PHI held by the practice.
• Right to Amend: Patients can request corrections to inaccurate or incomplete information in their records.
• Right to Accounting of Disclosures: Patients can request a list of entities to whom their PHI has been disclosed.
• Right to Request Restrictions: Patients can request limitations on how their PHI is used or disclosed.
• Right to Confidential Communications: Patients can request that communications be sent to an alternate address or via alternate means.

We assist our clients in fulfilling these requests as needed and ensure that our systems accommodate the necessary restrictions.

9. Compliance Audits and Monitoring

We believe in continuous improvement and proactive compliance. We conduct regular internal and external audits of our systems and processes, including:

• Internal Audits: We review access logs, security configurations, and policy adherence on a quarterly basis.
• Penetration Testing: We engage independent third‑party security firms to conduct penetration tests and vulnerability assessments at least annually.
• Risk Assessments: We perform comprehensive risk assessments to identify potential threats and vulnerabilities.
• Remediation Tracking: Any findings are tracked to resolution, with regular updates to senior management.

We maintain detailed records of all audits and risk assessments in accordance with HIPAA documentation requirements.

10. Contact for Privacy Concerns

If you have any questions, concerns, or complaints about our HIPAA compliance or how we handle PHI, please contact our Privacy Officer:

You also have the right to file a complaint with the Office for Civil Rights (OCR) if you believe your privacy rights have been violated. For more information, visit the HHS OCR website.

This HIPAA Compliance statement is effective as of January 1, 2026 and supersedes all prior versions. We review and update our compliance practices regularly to reflect changes in regulations and industry best practices.