HIPAA

The Health Insurance Portability and Accountability Act (HIPAA)

RecoveryTrek LLC uses many security features to ensure that only authorized users access “protected health information (PHI).” The following measures are set forth for compliance of HIPAA regulations for Privacy and Security.

The Privacy Rule protects all PHI, or “individually identifiable health information” held or transmitted by RecoveryTrek. Individually identifiable health information includes many common identifiers (e.g., name, address, birth date, Social Security Number, credit card data), as well as the provision of health care to an individual (physical or mental).

How We Collect Information About You

​

Only authorized RecoveryTrek employees may collect data (through a variety of means including but not necessarily limited to letters, phone calls, emails, voice mails, and from the submission of enrollment applications) that is either required by law, or necessary to serve participants and clients. The CEO is responsible for developing and implementing privacy compliance and is the person to receive complaints and provide additional information.

How We Handle Your Information

​

Information about your financial situation and medical conditions that we receive from other providers or that you provide to us in writing, via email, on the phone (including information left on voice mails), contained in or attached to correspondence, or directly or indirectly given to us, is held in strictest confidence.

We do not give out, exchange, barter, rent, sell, lend, or disseminate any information about participants or clients who receive our services that is considered patient confidential, is restricted by law, or has been specifically restricted by a patient/client.

Information is only used as is reasonably necessary to process your enrollment or to provide you or your case manager with health or counseling services. We use, disclose, and request only the minimum amount of protected health information needed to accomplish this. We do not use cookies on our website to collect unique, personal data.

RecoveryTrek uses administrative, technical, and physical safeguards to prevent intentional or unintentional use or disclosure of protected health information in violation of the Privacy Rule. For example, this includes shredding documents containing protected health information before discarding them, securing medical records with lock and key or pass code, and limiting access to keys or pass codes.



Workforce Training



RecoveryTrek provides regular, periodic training and ongoing supervision of those who work with PHI. Noncompliance is grounds for dismissal.



Limited Right to Use Non-Identifying Personal Information

​

Any pictures, correspondence, or thank you notes sent to us become the exclusive property of RecoveryTrek. We reserve the right to use non-identifying information for fundraising and promotional purposes. No identifying information (names or uniquely identifiable data) will be used without client’s express advance permission.

——————-

The Security Rule specifies our administrative, physical, and technical safeguards for the confidentiality, integrity, and availability of electronic protected health information (e-PHI).

HIPAA Security Risk Assessment regulations concerning Network Security Standards are effective April 21, 2005. Compliance ensures that only those who should have access to e-PHI actually have access.

RecoveryTrek:



1. Ensures the confidentiality, integrity, and availability of all e-PHI we create, receive, maintain or transmit;

2. Identifies and protects against reasonably anticipated threats to the security or integrity of the information;

3. Protects against reasonably anticipated, impermissible uses or disclosures; and

4. Ensures compliance by our workforce.

The Security Standards are divided into three Safeguard categories including Administrative, Physical, and Technical. Administrative Safeguards deal primarily with the personnel and planning functions necessary for a Covered HealthCare Provider to comply. The majority of the Physical and Technical Safeguards are a function of a system’s network infrastructure, hardware capability, and our Software Application. The following list of risk factors represent the primary Security Implementation Specifications:



• Does the RecoveryTrek system permit data encryption/decryption? Yes, any wide area network which is Internet based is fully encrypted with local connection optionally encrypted.

• Does each user have a unique user identification code? Yes.

• Does each user have a unique user password? Yes. The system requires the user to enter his/her password at login. Furthermore, the system can require users to change their passwords a set number of days.

• Do users use unique tokens to access the application? Yes. The unique token is the RecoveryTrek password. In addition to the system password, each user is assigned a RecoveryTrek identity and password that is used to track operator activity and responsibility.

• Are there integrity controls for transmission? Yes.

• Are users automatically logged off after a period of inactivity? Yes, In compliance with the client’s security policy, this will be set up to log Users off after a pre-determined time of inactivity.

• Is the data protected from unauthorized, unanticipated or unintentional alteration, including detection of such activities? Yes.

• Are there mechanisms to record and examine user activity?  Yes, RecoveryTrek tracks user activity in critical areas of software use. RecoveryTrek can also track a record of screens accessed without data change. This added functionality is available as an add-on module.

• Are there procedures for accessing the application during an emergency? Yes.

Server, Network, and Application level Security

​

The most basic type of security is physical security of the server and backup media. Access and times are restricted to only authorized users (role-based access). In addition, the server is accessed only from authorized locations, and the data is protected while it is in transit. Router configurations, access lists, and other similar tools are used to ensure that only users in authorized locations are able to gain access.

We also encrypt data in transit between the user session and the server. In such cases, RecoveryTrek uses Secure Socket Layer (SSL) encryption, a standard Internet encryption, or Virtual Private Networking (VPN).

Our cloud-based web site is hosted in Salesforce.com’s secure server environment that uses a firewall and other advanced technology to prevent interference or access from intruders. RecoveryTrek and Salesforce.com utilize the most advanced technology for Internet security. In a HIPAA compliant fashion, your information and data is safe, secure, and available only to registered and authorized users.

RecoveryTrek complies with all government regulations for data transmission and storage, including the HIPAA Electronic Transaction and Code Sets Rule. Our CEO is the Security Official responsible for developing and implementing security policies and procedures, to include annual assessment of how well these meet requirements of the Security Rule.

​