Privacy Policy

At Alita Systems, we are committed to safeguarding the privacy and security of our Client’s Personal Information and any Protected Health Information (PHI) as required by the Health Insurance Portability and Accountability Act (HIPAA). This Privacy Policy explains how we collect, use, store, and protect Personal Information. At the end of the Privacy Policy, we also share information related to PHI and rights related to PHI. Any Business Associate Agreement we have with a Client will outline the requirements related to how we handle PHI.

We do not control and are not responsible for the privacy practices of the websites of other entities and we urge you to review any applicable third-party privacy policies for yourself.

Our processing of data on behalf of our healthcare provider clients is governed by the agreements we enter into with our clients, which may include Business Associate Agreements as applicable and required under the Health Insurance Portability and Accountability Act (“HIPAA”). Your healthcare provider may also have its own privacy practices and/or policies that govern its collection and use of your data. We are not responsible for how your healthcare provider treats your information, and we recommend you review their privacy policies.

We use cookies and other data collection tools to operate and improve the Website and our Services, for technical troubleshooting, to better understand how the Website and our Services are used, to personalize your visit to the Website and use of our Services, and to display advertisements to you. For more information on the types of cookies we use and to manage your cookie preferences, please visit our cookie preference tool here.

We may disclose information we obtain to our third-party vendors who provide us with services to assist us in providing, developing, promoting, marketing and supporting our Services and information resources and in running our day to day business activities. For example, we use third-party vendors to provide infrastructure hosting, software, and payment processing services. We enter into contracts with our third-party vendors that limit how they may use and disclose the information for the purposes for which we disclosed it to them.

We may also disclose information as we believe necessary to:

• Comply with applicable law and regulations, which may include disclosures made in response to any subpoena, document request, or other legal request seeking the disclosure of information that appears to have been lawfully issued;
• Perform under and enforce the terms and conditions under which our services are provided;
• Protect our rights, reputation, and property, or that of our users, affiliates, or the public or to pursue available remedies or limit damages we may sustain;
• Support our auditing, compliance and corporate governance functions; and
• Transfer or assign the information that we have collected from users in connection with a corporate transaction, such as a divestiture, merger, consolidation, or asset sale, or in the unlikely event of bankruptcy, including in any diligence process related to such a transaction.

The Website may contain links to third-party sites to provide additional, value-added services. Except as set forth herein, we do not share your personal information with those third parties, and are not responsible for their privacy practices. We therefore have no responsibility or liability for the content and activities of these linked sites. We suggest you read the privacy policies on all such third-party sites.

We use industry-standard security measures designed to protect the personal information we obtain from unauthorized alteration, loss, disclosure, or use, including technological, physical and administrative controls over access to the systems we use to provide the Website and our Services.

However, please note that the security of information transmitted through the Internet can never be guaranteed. We are not responsible for any interception or interruption of any communications through the Internet or for changes to or losses of data. Users of our Services and the Website are responsible for maintaining the security of any username, password or other form of authentication involved in obtaining access to password protected or secure areas of any of the Website. In order to protect us, you and your information, we may suspend your use of the Website or Services, without notice if any breach of security is suspected.

We will retain the personal information we obtain for a period sufficient to provide the Services that our Clients request or as otherwise necessary to fulfill the purpose for which such information was collected and as necessary to comply with our legal obligations.

What is Protected Health Information (PHI)?

Protected Health Information (PHI) is any individually identifiable health information that relates to:

• Past, present, or future physical or mental health condition
• The provision of healthcare services
• Payment for healthcare services provided

This information can include things like name, address, phone number, date of birth, social security number, and health information. (45 C.F.R. § 160.103)

How We Collect and Use Your PHI

You may use our Services to collect PHI in a variety of ways, including through direct interactions (e.g., in-person, via phone, or electronically), third-party service providers, and healthcare providers. You may use our Services to use and disclose PHI for the following purposes:

• Treatment: To provide, coordinate, or manage healthcare (45 C.F.R. § 164.506).
• Payment: To obtain payment for the healthcare services you provide to individuals (45 C.F.R. § 164.506).
• Healthcare Operations: To manage our operations, such as conducting quality assessments, audits, or training programs (45 C.F.R. § 164.506).

Disclosure of Your PHI

We will not share PHI except as outlined below:

• With your consent: We may share PHI if you provide written consent from the individual (45 C.F.R. § 164.508).
• As required by law: We may disclose PHI to comply with federal, state, or local law, such as reporting health-related statistics or responding to a court order (45 C.F.R. § 164.512).
• For healthcare operations: We may share PHI with business associates, such as those who help us manage appointments, billing, or data analytics, provided they are also HIPAA-compliant (45 C.F.R. § 164.502(e)).
• Public Health and Safety: We may disclose PHI for public health activities, including preventing or controlling disease, reporting adverse events, or complying with FDA regulations (45 C.F.R. § 164.512(b)).

How We Protect PHI

We implement a variety of physical, administrative, and technical safeguards to protect PHI from unauthorized access, use, or disclosure. These include:

• Data encryption (45 C.F.R. § 164.312).
• Access controls and authentication procedures (45 C.F.R. § 164.312).
• Security policies and regular staff training (45 C.F.R. § 164.530).
• Secure storage and disposal practices for paper and electronic records (45 C.F.R. § 164.310(d)).

Rights Regarding PHI

Individuals have the following rights regarding their PHI:

• Right to Access: An individual can request a copy of their PHI, either in paper or electronic form, subject to certain limitations (45 C.F.R. § 164.524).
• Right to Correct: If an individual believes that their PHI is inaccurate or incomplete, they may request corrections or amendments to it (45 C.F.R. § 164.526).
• Right to Request Restrictions: Individuals can request restrictions on the way their PHI is used or shared, although a covered entity is not required to agree to all such requests (45 C.F.R. § 164.522).
• Right to Confidential Communications: An individual may request that a covered entity communicate with them in a specific way or at a certain location (45 C.F.R. § 164.522).
• Right to Receive an Accounting of Disclosures: An individual can request an accounting of certain disclosures of their PHI made by a covered entity over the last six years (45 C.F.R. § 164.528).
• Right to File a Complaint: If an individual believes that their privacy rights have been violated, they may file a complaint with a covered entity or with the U.S. Department of Health and Human Services (45 C.F.R. § 164.530).

How We Handle PHI After You End the Relationship with Us

If you no longer have an active relationship with Alita Systems, we will continue to protect PHI as required by HIPAA and any Business Associate Agreement. We will retain the PHI for the minimum necessary time, as mandated by law, before safely and securely disposing of it (45 C.F.R. § 164.530).

If you have any questions or concerns about this Privacy Policy, or if you would like to exercise any of your rights outlined above, please contact us at: