Infiniwell.ai Privacy Policy
Privacy 1.0 — HIPAA Privacy Program
Organization’s Privacy Officer oversees Organization’s compliance with the HIPAA Privacy Rule. The Privacy Officer oversees Organization’s efforts to protect and maintain the confidentiality of protected health information (PHI), safeguard sensitive Organization information, and prevent and detect inappropriate or unlawful uses and disclosures of PHI.
Workforce members must be familiar with the Privacy Officer’s responsibilities and must contact the Privacy Officer when required by this Policy.
Applicable Regulation:
45 CFR § 164.530 — HIPAA Privacy Program
Privacy 2.0 — Accounting of Disclosures
Individuals have the right to receive an accounting of certain disclosures of their protected health information (PHI) made by Organization, including applicable disclosures made by business associates.
Individuals may exercise this right by submitting a written request to Organization for an accounting. Organization will respond to the request in accordance with applicable law and provide an accounting when required.
Applicable Regulation:
45 CFR § 164.528(a) — Accounting of Disclosures
Privacy 3.0 — Business Associates
Organization relies on business associates, including vendors and other entities that perform functions or services on behalf of Organization that may require access to PHI.
This policy addresses how Organization determines whether an individual or entity is a business associate and establishes requirements for agreements between Organization and its business associates, including applicable Business Associate Agreements.
Applicable Regulations:
45 CFR § 164.502(e)(1) — Disclosures to Business Associates
45 CFR § 164.504 — Uses and Disclosures: Organizational Requirements
Privacy 4.0 — Judicial and Administrative Proceedings
Organization may disclose a patient’s PHI in connection with a judicial or administrative proceeding when the disclosure is permitted or required by applicable law.
Such proceedings may include court proceedings and proceedings before government agencies, including the U.S. Department of Health and Human Services (HHS) and the Centers for Medicare & Medicaid Services (CMS).
Workforce members will be trained on how to respond appropriately to requests for PHI made in connection with such proceedings.
Applicable Regulations:
45 CFR § 164.512(e) — Uses and Disclosures for Judicial and Administrative Proceedings
Privacy 5.0 — Uses and Disclosures for Marketing
Organization may use or disclose PHI for marketing purposes when permitted by applicable law. When an authorization is required for a marketing use or disclosure, Organization will obtain a valid authorization before making the use or disclosure.
Workforce members will be trained regarding when PHI may be used or disclosed for marketing purposes and when patient authorization is required.
Applicable Regulations:
45 CFR § 164.508(a)(3) — Uses and Disclosures for Which an Authorization Is Required: Marketing
Privacy 6.0 — Minimum Necessary
When the HIPAA minimum necessary standard applies, Organization will make reasonable efforts to limit the PHI it uses, requests, or discloses to the minimum necessary to accomplish the intended purpose.
Workforce members will be trained regarding the minimum necessary standard and its application to their job responsibilities.
Applicable Regulations:
45 CFR § 164.502(b) — Minimum Necessary
45 CFR § 164.514(d) — Minimum Necessary Requirements
45 CFR § 164.524 — Access of Individuals to Protected Health Information
Privacy 7.0 — Uses and Disclosures for Which an Authorization Is Required
Under certain circumstances, a valid written authorization from an individual is required before Organization may use or disclose that individual’s PHI.
When authorization is required, Organization will obtain an authorization that satisfies applicable legal requirements before using or disclosing the PHI.
This policy describes circumstances in which written authorization is required and the requirements for a valid authorization.
Applicable Regulations:
45 CFR § 164.508 — Uses and Disclosures for Which an Authorization Is Required
Privacy 8.0 — Uses and Disclosures for Which No Authorization Is Required
Under certain circumstances, Organization may use or disclose PHI without obtaining an individual’s authorization or providing the individual an opportunity to agree or object, as permitted or required by applicable law.
This policy informs workforce members of circumstances in which such uses and disclosures are permitted and the procedures that must be followed when responding to requests for PHI.
Applicable Regulations:
45 CFR § 164.501 — Definitions, including Health Care Operations
45 CFR § 164.512 — Uses and Disclosures for Which an Authorization or Opportunity to Agree or Object Is Not Required
Privacy 9.0 — Uses and Disclosures Requiring an Opportunity to Agree or Object
Under certain circumstances, Organization must provide an individual with an opportunity to agree or object to a use or disclosure of PHI.
This policy describes the circumstances in which this requirement applies and how Organization will respond to such requests.
Applicable Regulations:
45 CFR § 164.510 — Uses and Disclosures Requiring an Opportunity for the Individual to Agree or Object
Privacy 10.0 — Complaints About Organization
Organization maintains a process through which individuals may submit complaints concerning Organization’s compliance with the HIPAA Privacy Rule, the HIPAA Breach Notification Rule, and Organization’s related privacy policies and procedures.
Organization will receive, document, and address such complaints in accordance with applicable law and its policies and procedures.
Applicable Regulations:
45 CFR § 164.530(d) — Complaints
Privacy 11.0 — Sanctions
Workforce members who violate Organization’s privacy policies and procedures may be subject to appropriate sanctions.
Sanctions are disciplinary measures intended to address violations and deter future violations. In determining the appropriate sanction, Organization may consider factors including the nature and severity of the violation, the impact of the violation, whether the conduct was intentional or repeated, and the workforce member’s relevant work history.
Sanctions should be applied consistently and be proportionate to the nature and severity of the violation.
Organization will also mitigate, to the extent practicable, any harmful effects resulting from a use or disclosure of PHI in violation of its policies or applicable HIPAA requirements.
Applicable Regulations:
45 CFR § 164.530(e) — Sanctions
45 CFR § 164.530(f) — Mitigation
Privacy 12.0 — No Retaliation; No Waiver of Rights
Organization will not intimidate, threaten, coerce, discriminate against, or take other retaliatory action against an individual or other person for exercising rights provided under the HIPAA Privacy Rule or for participating in activities protected by applicable HIPAA regulations.
Organization will not require an individual to waive rights provided under the HIPAA Privacy Rule as a condition of the provision of treatment, payment, enrollment in a health plan, or eligibility for benefits, except as permitted by law.
Applicable Regulations:
45 CFR § 164.530(g) — Refraining from Intimidating or Retaliatory Acts
45 CFR § 164.530(h) — Waiver of Rights
Privacy 13.0 — Uses and Disclosures for Treatment, Payment, and Health Care Operations
Organization generally may use or disclose PHI for treatment, payment, and health care operations without obtaining the individual’s written authorization, subject to applicable HIPAA requirements, limitations, and other applicable federal or state laws.
Where authorization or another form of permission is required by applicable law, Organization will obtain such authorization or permission before using or disclosing the PHI.
Applicable Regulations:
45 CFR § 164.506 — Uses and Disclosures to Carry Out Treatment, Payment, or Health Care Operations
Privacy 14.0 — Sale of PHI
Organization will not sell PHI except as permitted by applicable law and, when required, after obtaining a valid written authorization from the individual.
For purposes of this policy, a sale of PHI generally involves the direct or indirect receipt of remuneration by a covered entity or business associate in exchange for PHI, subject to the exceptions established by applicable law.
Applicable Regulations:
45 CFR § 164.508(a)(4) — Sale of Protected Health Information
Privacy 15.0 — Disclosures by Whistleblowers and Workforce Member Crime Victims
Under circumstances permitted by HIPAA, workforce members and business associates may disclose PHI when they believe in good faith that Organization has engaged in unlawful conduct, violated professional or clinical standards, or potentially endangered patients, workers, or the public, provided that the disclosure is made to a person or entity authorized by law to investigate or otherwise address the conduct or to an attorney retained for purposes of determining legal options.
In addition, a workforce member who is the victim of a criminal act may disclose limited PHI about the suspected perpetrator to a law enforcement official when permitted by applicable law.
Applicable Regulations:
45 CFR § 164.502(j) — Disclosures by Whistleblowers and Workforce Member Crime Victims
Privacy 16.0 — Uses or Disclosures of PHI for Specialized Government Functions
Organization may use or disclose PHI without written patient authorization for certain specialized government functions when permitted by applicable law, including:
-
Military and veterans’ activities;
-
National security and intelligence activities;
-
Protective services for the President and others;
-
Medical suitability determinations; and
-
Correctional institutions and other law enforcement custodial situations.
Applicable Regulations:
45 CFR § 164.512(k) — Uses and Disclosures for Specialized Government Functions
Privacy 17.0 — Limited Data Sets and Data Use Agreements
Organization may create and disclose a limited data set, consisting of PHI from which specified direct identifiers have been removed, for purposes permitted by HIPAA, including research, public health, and health care operations.
Before disclosing a limited data set, Organization will obtain a Data Use Agreement from the recipient that satisfies applicable HIPAA requirements.
Applicable Regulations:
45 CFR § 164.514(e) — Limited Data Set and Data Use Agreement
Privacy 18.0 — Mobile Application Privacy and Permissions
Location Services and Permissions
SentioWeb RPM
The SentioWeb RPM mobile application may request access to the device’s location services for the following purposes:
-
Bluetooth device setup and connectivity: Location permission may be required by certain versions of the Android operating system to discover, pair with, or communicate with nearby Bluetooth devices.
-
Local air quality information: The app may use the device’s current location to retrieve air quality and other environmental information relevant to the user’s current area.
Location information is accessed only when necessary to provide these features and is not used for advertising or marketing purposes.
SentioWeb Schiller Bridge and Sentio SideKick (EMS)
The SentioWeb Schiller-Bridge mobile application may collect the geographic location of the mobile device while providing its intended monitoring and connectivity functions.
Location information collected by the app is transmitted securely to the SentioWeb backend, where it is temporarily stored and used to display the device’s location through the SentioWeb web interface. By default, location information is retained for 48 hours, after which it is automatically deleted.
Location information collected through SentioWeb Schiller-Bridge is used only to provide this functionality and is not used for advertising or marketing purposes.
Device data transmitted through SentioWeb Schiller-Bridge is used to provide the application's intended functionality and is not permanently stored by SentioWeb Schiller-Bridge.