PRIVACY POLICY
About This Policy

This policy describes the personal information MTBC-PHR collects about you, why MTBC-PHR collects it and how MTBC-PHR uses it. MTBC’s policy also describes the choices you can make about how MTBC-PHR collects and uses your information.

About Medical Transcription Billing Corp. (MTBC^®)

MTBC is a healthcare services company that specializes in medical billing, transcription, and electronic medical record (“EMR”) solutions for physicians of all specialties. Physicians and medical practices that use our service have online access to a wide-array of reports and features, including practice management reporting, online scheduling, as well as secure access to patient’s protected healthcare information “PHI”. MTBC have also made available the patient information on the individual websites created for these physicians and specialties.

What Information Does MTBC Collect?

In some areas of this website, we ask for personal information. For instance, user name (email address) & password must be disclosed in order to login into MTBC-PHR. A patient can request or create user name by physician. In such situations, a user may be required to provide certain information, including his/her name, address, email address, phone number. This list may be expanded without prior notice.

Patient’s can access their PHI through MTBC-PHR. PHI is information that identifies patients and relates patients’ past, present, or future physical or mental health or condition, the provision of healthcare to patients, or past, present, or future payment for the provision of healthcare to patients managed for patient’s physician/medical providers. This information is only posted in the Verisign secured Member’s Area, which is 128-bit encrypted and requires a username and password.

What does MTBC do with the information it collects?

This information is collected to help MTBC further develop its services, to provide access to valuable MTBC Internet-based information and services, and to bill as appropriate.

MTBC employs all reasonable and customary measures to protect PHI sent to MTBC through the Internet. Once MTBC receives PHI, it is posted in a secure password-protected database.

MTBC-PHR users are responsible for keeping passwords confidential and will be solely responsible for all uses of their password. If a user becomes aware of any unauthorized use of his or her password, he or she is responsible for contacting MTBC to request deactivation of the password. Most web browsers (Internet Explorer, Netscape, Mozilla, etc.) offer the opportunity to select a “remember password” function on the website. If a user selects this option, the password will thereafter be automatically identified when the user accesses the website. As a result, anyone with access to the specific computer may have access to patients’ PHI. Users alone are responsible for controlling access to their computers and for preventing unauthorized access to PHI.

How we may use and disclose medical information about you.

The following describes different ways that we are permitted to use and disclose medical information. For each category of uses or disclosures we will explain what we mean and try to give some examples. Not every use or disclosure in a category will be listed. However, all of the ways we are permitted to use and disclose information will fall within one of the categories.

For Treatment:

We may disclose medical information about you to your healthcare physicians who are involved in caring for you at the clinic. Different departments of the clinic also may share medical information about you in order to coordinate the different services/treatments you need, such as prescriptions, laboratory work, and x-rays. We may also disclose medical information about you to people who may be involved in your healthcare & any other authorized individuals.

For Payment:

We may use and disclose your medical information so that the treatment and services you receive may be billed and payment may be collected from you, an insurance company, or a third party. We may tell your health plan about a treatment you are going to receive in order to obtain prior approval or to determine whether your plan will cover the treatment. We may also give information to someone who helps pay for your care.

For Health Care Operations

We may use and disclose your medical information for Health Care Operations. Healthcare operations are activities that are necessary to make sure that all of our patients receive quality care. We may also disclose information to doctors for review and learning purposes. When we do this, information that identifies you may be removed from this set of medical information so others may use it to study health care and health care delivery without learning who the specific patients are. If ownership of the MTBC-PHR changes as a result of sale, transfer, merger or consolidation, your medical information would be disclosed to the new entity, if that entity was to follow the same privacy policies.

Appointment Reminders:

We may use and disclose medical information to contact you as a reminder that you have an appointment for treatment or medical care.

Treatment Alternatives:

We may use and disclose medical information to tell you about or recommend possible treatment options or health related benefits that may be of interest to you.

As Required By Law:

We will disclose your medical information when required to do so by federal, state or local law.

To Avert a Serious Threat to Health or Safety:

We may use and disclose your medical information when necessary to prevent a serious threat to your health and safety or the health and safety of the public or another person. Any disclosure, however, would be only to someone able to help prevent the threatened harm.

Special Situations:

We may disclose medical information about you to an entity assisting in a disaster relief effort so that your family can be notified about your condition, status and location.

Military and Veterans:

If you are a member of the armed forces, we may release your medical information as required by law. We may also release medical information about foreign military personnel to the appropriate foreign military authority as required by law.

Workers' Compensation:

We may release your medical information for workers' compensation or similar programs. These programs provide benefits for work-related injuries or illness.

Public Health Risks:

We may disclose, when requested, your medical information for public health activities. These activities generally include the following:

• to prevent or control disease, injury or disability;
• to report births and deaths;
• to report abuse and/or neglect of a child, elder or disabled person;
• to report reactions to medications or problems with products;
• to notify people of recalls of products they may be using;
• to notify a person who may have been exposed to a disease or may be at risk for contracting or spreading a disease or condition;

Health Oversight Activities:

We may, when requested, disclose your medical information to a health oversight agency for activities authorized by law. These oversight activities include, audits, certifications, investigations, inspections, and licensure. These activities are necessary for the government to monitor the health care system, government programs, and compliance with civil rights laws.

Lawsuits and Disputes:

If you are involved in a lawsuit or a dispute, we may disclose your medical information in response to a court order. Under certain circumstances, we may also disclose your medical information in response to a subpoena or other lawful process, but we will do so only if efforts have been made to tell you about the request or to obtain an order protecting the information requested or if you or a court have provided written authorization.

Law Enforcement:

We may release your medical information if asked to do so by a law enforcement official, if permitted by law:

• In response to a court order, subpoena, warrant, summons or similar process;
• To identify or locate a suspect, fugitive, material witness, or missing person;
• About the victim of a crime if, under certain limited circumstances, we are unable to obtain the person's agreement;
• About a death we believe may be the result of criminal conduct;
• About criminal conduct; and
• In emergency circumstances: to report a crime; the location of the crime or victims; or the identity, description or location of the person who committed the crime.

National Security and Intelligence Activities:

If permitted by law, we may release your medical information to authorized federal officials for intelligence, counterintelligence, and other national security activities, authorized by law.

Inmates:

If you are an inmate of a correctional institution or under the custody of a law enforcement official, we may release medical information about you to the correctional institution or law enforcement official, under certain circumstances if permitted by law. This release would be necessary (1) for the institution to provide you with health care; (2) to protect your health and safety or the health and safety of others; or (3) for the safety and security of the correctional institution.

Your rights regarding medical information about you:

You have the following rights regarding medical information we maintain about you: Right to Inspect and Obtain a Copy. You have the right to inspect and obtain a copy of your medical information that may be used to make decisions about your care. This request usually includes medical and billing records but does not include psychotherapy notes. To inspect and obtain a copy of your medical information that may be used to make decisions about you, you must submit your request in writing for our address. For copies of your physician's office records, please contact your physician's office directly. If you request a copy of the information, we may charge a fee for the costs of copying, mailing or other supplies associated with your request. We may deny your request to inspect and obtain a copy in certain very limited circumstances.

Right to Amend:

If you think that the medical information we have about you is incorrect or incomplete, you may ask us to amend the information. You have the right to request an amendment as long as the information is kept by or for the Clinic. Your request for an amendment will become a legal part of your medical record, to be sent out along with the rest of the record whenever a request for copies is received. No part of the original documentation in the medical record can be destroyed.

To request an amendment of your medical record, your request must be made in writing and submitted to our address. To request an amendment of your physician office record, contact your physician's office directly. In addition, you must provide a reason that supports your request.

We may deny your request for an amendment if it is not in writing or does not include a reason to support the request. We may also deny your request if you ask us to amend information that:

• Was not created by us, or the person or entity that created the information is no longer available to make the amendment;
• Is not part of the medical information kept;
• Is not part of the information which you would be permitted to inspect and copy; or
• Is accurate and complete.

Right to Request an Accounting of Disclosures:

You have the right to request an “accounting of disclosures.” This is a list of the disclosures we made of your medical information for which an authorization was not obtained, or which were not made for purposes of treatment, payment, or healthcare operations.

To request this list or accounting of disclosures, you must submit your request in writing to our practice, Health Information Management, address. Your request must state a time period, which may not be longer than six years and may not include dates before April 14, 2003. Your request should indicate in what form you want the list (for example, on paper, electronically). The first list you request within a 12-month period will be free. For additional lists, we may charge you for the costs of providing the list. We will notify you of the cost involved and you may choose to withdraw or modify your request at that time before any costs are incurred.

Right to Request Restrictions:

You have the right to request a restriction or limitation on the medical information we use or disclose about you for treatment, payment or health care operations. You also have the right to request a limit on the medical information we disclose about you to someone who is involved in your care or the payment for your care, such as a family member or friend.

We are not required to agree to your request for restrictions. If we do agree, we will comply with your request unless the information is needed to provide emergency treatment to you.

To request restrictions on your medical records, you must make your request in writing to our practice, Health Information Management, Restriction Request, address. To request restrictions on your physician office records, contact your physician's office directly. In your request, you must tell us (1) what information you want to limit; (2) whether you want to limit our use, disclosure or both; and (3) to whom you want the limits to apply, for example, disclosures to your spouse.

Right to Request Confidential Communications:

You have the right to request that we communicate with you about medical matters in a certain way or at a certain location. For example, you can ask that we contact you only at work or by mail.

To request confidential communications, you must make your request in writing the practice Privacy Officer. We will not ask you the reason for your request. At our discretion, we will accommodate all reasonable requests. Your request must specify how or where you wish to be contacted.

Right to a Paper Copy of This Notice:

You have the right to a paper copy of this notice. You may ask us at any time to give you a copy of this notice. Even if you have agreed to receive this notice electronically, you are still entitled to a paper copy of this notice.

You may obtain a copy of this notice at our website to obtain a paper copy of this notice, please contact the Reception Desk or: our Office of Business Conduct.

Third Party Information Gathering

Our website may contain links to, and contain content and advertisements hosted on, third party websites. If you click on such links, content or advertisement, you may be directed to these third party websites. When accessed, such third-party websites may place their own cookies on your computer, collect data, solicit personal information or perform user activity tracking other than that described herein. For more information about each third party content provider, cookies, and how to "opt-out," please refer to such third party privacy policy. Please be aware that we are not responsible for the privacy practices of such other websites. We encourage our users to be aware when they leave our site and to read the privacy statements of each and every third-party website that they visit. This Privacy Policy applies solely to information collected by this Website.

Sharing your information with people and services you trust

• If you share your information with others, you can view a list of who has access to your information and you can revoke sharing privileges at any time. When you revoke someone’s ability to read your health information, that party will no longer be able to read your information, but may have already seen or may retain a copy of the information.
• MTBC-PHR contains links to third-party service providers that are capable of securely integrating information to MTBC-PHR. These service providers (which may include your medical providers) may provide information about certain medical conditions or extend the functionality of MTBC-PHR in other ways. By creating a link to these service providers, you give them permission to integrate you information such as medical records, prescription histories, or test reports to your MTBC-PHR account.
• You can approve access for some of these service providers to view and copy your health information. If a service provider accesses your health information and stores a copy of your information, that copy will be governed by that service provider's privacy policy. MTBC-PHR is not responsible for the content, performance, or privacy policies of third-party service providers.
• Some of these third-party service providers will be covered by federal and state health privacy laws (such as the Health Insurance Portability and Accountability Act, or “HIPAA”), and those laws will govern how they may use and share your information. HIPAA requires (as does MTBC-PHR) that you must authorize these providers to send information to your MTBC-PHR account. With that authorization, you also give them permission to integrate certain especially sensitive types of health information (such as mental health or substance abuse records) that are protected by federal and state laws and require special authorization. When you ask MTBC-PHR to send your health information to others, you will also be giving MTBC permission to send those sensitive types of health information.
• All entities or business associates covered by HIPAA are contractually required to comply with HIPAA's rules related to collection, use, and sharing of your information. All other third-party service providers are contractually required to abide by the privacy & security policies, which require that they comply with strict privacy standards for how they collect, use, or share your information.

Passive Information Collection/Use of Cookies

A cookie is a small text file that is stored on a user’s computer for record-keeping purposes. Cookies are used on this site. We do not link the information we store in cookies to any personally identifiable information you submit while on our site. We use session ID cookies to make it easier for you to navigate our site. A session ID cookie expires when you close your browser. A persistent cookie remains on your hard drive for an extended period of time. You can remove cookies by following directions in your Internet browser’s “help” file. To learn more about cookies, please visit this link: http://www.microsoft.com/info/cookies.mspx

As users navigate through a website, certain information can be passively collected (that is, gathered without the user actively providing the information), using various technologies and means, such as Internet Protocol addresses, cookies, Internet tags, and navigational data collection. MTBC uses Internet Protocol (IP) addresses on this site. An IP address is a number assigned to a computer by the Internet service provider so that it may access the internet. It is generally considered to be non-personally identifiable information because, in most cases, an IP address is dynamic (changing each time you connect to the Internet), rather than static (unique to a particular user's computer). MTBC uses an IP address to diagnose problems with its server, report aggregate information and determine the fastest route for your computer to use in connecting to our site in order to administer and improve the website functionality.

MTBC logs IP addresses, or the location of your computer on the Internet, for systems administration and troubleshooting purposes. Log data is used in the aggregate to analyze usage of the website and may be used to contact you for purposes of promoting MTBC products or services. Your data will not be sold to, shared with, or otherwise made available to any third parties. If you reject cookies, you may still use our site, but your ability to use some areas of our site, will be limited.

Security

MTBC servers are housed in a well-monitored and secure data center. Moreover, data protection mechanisms, security layers and data encryption measures have been implemented to prevent unauthorized access.

All PHI, as well as demographic information, is password protected and encrypted within the relevant databases. It is important for users to protect their password and computer from unauthorized access. When users submit personal information to the secure areas of MTBC’s website, MTBC encrypts it using Secure Sockets Layer (“SSL”), a software encryption technology. Encryption protects information against unauthorized access and modification once it is stored in the database.

Privacy Policy Updates

If we decide to change our privacy policy, we will post those changes to this privacy statement and other places we deem appropriate so that you are aware of what information we collect, how we use it, and under what circumstances, if any, we disclose it. We reserve the right to modify this privacy statement at any time, so please review it frequently. If we make material changes to this policy, we will notify you here.

Furthermore, you are welcome to email us with questions or concerns at support@mtbc.com.