HIPAA & Business Associate Notice

Practices, emergency departments and health systems that use RetinaDirect are generally covered entities under HIPAA. When they submit protected health information (PHI) through the Service, we create, receive, maintain and transmit that PHI on their behalf as a business associate.

We enter into Business Associate Agreements with customers who use the Service to process PHI. To request a BAA, contact privacy@retinadirect.com. Customers should not submit PHI until a BAA is in place.

• Consultation intake asks only for the information a specialist needs, and extra fields are optional.
• Email and other notifications identify consultations by a reference number, not by patient details.
• Patient information is not placed in web addresses, page titles or analytics events.
• Retina specialists see only consultations they are eligible for and have accepted. Queue previews exclude patient identifiers.
• Our operations staff see operational details by default. Access to clinical content requires a documented, time-limited reason and is logged.

• Encryption of data in transit and at rest.
• Role-based access with organization isolation, multi-factor authentication and session timeouts.
• Short-lived signed links for images and reports. Files are never publicly accessible.
• Tamper-evident audit logs of access to clinical content and key actions.
• Agreements with subprocessors that handle PHI, and a workforce trained on privacy and security.

If we discover a breach of unsecured PHI, we will notify the affected customer as required by our Business Associate Agreement and HIPAA so the customer can meet its own notification obligations.

We do not provide care to patients and patients do not have RetinaDirect accounts. To access, correct or ask questions about your health information, contact the healthcare provider who treated you. They control your records and can work with us if needed.

See our Privacy Policy and Terms of Service, or contact privacy@retinadirect.com.