HIPAA Compliance Notice

Our commitment

MedCare Agency works with OB/GYN, fertility and endometriosis practices, so we build every website and workflow on the assumption that sensitive health information may be involved. Our goal is simple: help clinics grow without putting patient privacy, or your license, at risk.

When HIPAA applies to our work

Under HIPAA, healthcare providers are "covered entities". When a vendor creates, receives, maintains or transmits protected health information (PHI) on a covered entity's behalf, that vendor is a "business associate". Some of our services, such as hosting websites with patient intake forms or managing booking and reminder workflows, can put us in that role. When they do, we sign a Business Associate Agreement before any PHI is involved.

How we protect patient information

• Encrypted connections (HTTPS) on every website we build or manage.
• Encrypted, access-controlled handling of form submissions that may contain PHI.
• HIPAA-eligible hosting and service providers that will sign BAAs with us.
• Privacy-first analytics configured so tracking tools do not receive PHI from symptom, condition or booking pages.
• Role-based access, strong authentication and the minimum access needed for each team member.
• Regular security updates, backups and monitoring.

Tracking pixels and marketing tools

Standard advertising and analytics pixels can send information about a patient's visit to third parties. U.S. regulators have warned that this can be an impermissible disclosure of PHI. We audit and configure tracking on the sites we manage so that marketing data stays useful without exposing patient information.

Shared responsibility

HIPAA compliance is a shared effort. As the covered entity, your practice remains responsible for your own policies, your Notice of Privacy Practices, staff training and how your team uses the tools we provide. We are happy to point out risks we see on your website, but our services do not replace advice from your own compliance officer or attorney.

If something goes wrong

If we discover a security incident or breach involving PHI we handle for you, we will notify you without unreasonable delay and as required by our Business Associate Agreement and HIPAA, and we will work with you on the response.

Questions and requests

For HIPAA questions, BAA requests or to report a concern, email info@medcareagency.net with "HIPAA" in the subject line. You can also request a free website audit that includes a basic HIPAA risk check.