How we handle protected health information.

Many of Symmetry's clients are healthcare practices. When Symmetry VA ("Symmetry," "we," "us") creates, receives, maintains, or transmits protected health information (PHI) on a practice's behalf, the practice is a Covered Entity under the Health Insurance Portability and Accountability Act (HIPAA) and Symmetry is its Business Associate. This page explains what that means in practice. The binding terms are in our Business Associate Agreement, which every healthcare client signs as part of its engagement agreement.

1. What a Business Associate is

Under HIPAA, a Business Associate is a person or organization that performs functions or provides services on behalf of a Covered Entity and, in doing so, uses or discloses PHI. Practice-management support, scheduling, billing follow-up, records handling, and patient communications all fall in that category. Symmetry's staff work inside a practice's own systems to do that work, which is why the BAA and the safeguards below apply to everything we touch.

2. What we commit to

• Permitted use only. We use and disclose PHI only to perform the services the practice engaged us for, as the practice directs, and as HIPAA permits. Never for our own purposes, and never sold.
• Minimum necessary. We access, use, and share only the PHI needed for the task at hand, and only the staff assigned to a practice see that practice's PHI.
• Safeguards. Administrative, physical, and technical safeguards for the PHI we handle: named user accounts, multifactor sign-in, encryption in transit, access limited by role, audit logging, and secure disposal.
• Workforce training. Everyone at Symmetry who may touch PHI is trained on HIPAA and on the practice's own policies before they start, and periodically after.
• Incident reporting. We report any use or disclosure not permitted by the BAA, any security incident, and any breach of unsecured PHI to the practice without unreasonable delay, so the practice can meet its own notification duties.
• Subcontractors. Any subcontractor that handles PHI for us signs a written agreement holding it to the same restrictions and conditions we hold ourselves to.
• Patient rights. We help the practice respond to a patient's request for access, amendment, or an accounting of disclosures, within the time HIPAA allows.
• Return or destruction. When an engagement ends, we return or destroy the PHI we hold, keep no copies, and, where return or destruction is not feasible, extend the BAA's protections for as long as we retain it.
• Accountability. We make our internal practices, books, and records relating to PHI available to the Secretary of Health and Human Services for determining the practice's compliance with HIPAA.

3. What the practice remains responsible for

Symmetry supports a practice's compliance program; it does not replace it. The practice remains the Covered Entity: it owns its patients' records, sets the policies we follow, maintains its Notice of Privacy Practices, grants and revokes our access to its systems, tells us of any restriction a patient has requested that affects our work, and makes the final decisions on breach notification. We ask every healthcare client to give us only the access needed for the work, and to tell us promptly when that access should change.

4. Where PHI lives

Wherever possible, PHI stays in the practice's own systems, such as its EHR, practice-management software, phone, and fax platforms, and we work inside them under the practice's accounts. The Symmetry client portal holds work records, activity, and the contact details needed to run the engagement, hosted on Microsoft Azure in the United States. Our own systems are covered by Business Associate Agreements with the providers that run them.

5. Questions and requests

Questions about this statement, requests for a copy of our Business Associate Agreement, or a report of a concern about PHI may be directed to katlyn@symmetryva.com, or to Symmetry VA, Phoenix, Arizona. Patients with questions about their own records should contact their practice, which we assist as its Business Associate.