HIPAA_VERSION in lib/legal/agreements.js so existing users are re-prompted.1. Purpose
This HIPAA Agreement ("Agreement") describes the responsibilities of every user of the Clinlytics platform ("you") with respect to Protected Health Information ("PHI") as defined under the Health Insurance Portability and Accountability Act of 1996 and its implementing regulations (collectively, "HIPAA"). By accepting this Agreement you acknowledge your obligations before accessing any PHI.
2. Your responsibilities
- Access, use, and disclose PHI only as permitted by HIPAA and only as necessary to perform your role.
- Apply the Minimum Necessary Standard — enter and view only the PHI required for the task at hand.
- Keep your login credentials confidential and never share your account.
- Report any suspected unauthorized access, use, or disclosure of PHI to your clinic administrator and to Clinlytics without delay.
- Comply with your clinic's own privacy and security policies and with all applicable federal and state law.
3. Safeguards provided by Clinlytics
Clinlytics operates as a Business Associate and maintains administrative, physical, and technical safeguards consistent with the HIPAA Security Rule, including encryption of PHI in transit and at rest, role-based access controls, and audit logging. These safeguards support, but do not replace, your own compliance obligations.
4. Breach notification
In the event of a breach of unsecured PHI, Clinlytics will notify the affected covered entity in accordance with the HIPAA Breach Notification Rule (45 CFR §§ 164.400–414).
5. Acknowledgement
By checking the acceptance box during sign-up or sign-in, you confirm that you have read, understood, and agree to abide by this Agreement. Questions may be directed to legal@clinlytics.com.