Legal
HIPAA Notice
Last updated: [DATE TO BE FILLED IN]
Holistic Pathways Legal Advisors provides independent legal nurse consulting services and regularly reviews medical records containing protected health information (PHI) as part of that work. This notice explains, at a high level, how PHI is handled and what visitors to this website should know.
Do not submit medical records, patient names, or other PHI through this website's contact form. The form is for initial case inquiries only — a brief description of the matter and record volume. Once an engagement begins, records are exchanged only through a secure, encrypted channel established for that specific matter.
When HIPAA Applies to This Engagement
Whether a formal HIPAA Business Associate Agreement is required depends on who retains us:
- Plaintiff-side engagements (where an individual is disclosing their own records through their own attorney) typically do not require a Business Associate Agreement.
- Defense-side engagements, where the retaining firm is itself a HIPAA "business associate" of a covered entity (for example, defense counsel for a hospital, physician group, or insurer), generally do require one. We maintain a standard Business Associate / Subcontractor Agreement template for these situations and will execute it prior to receiving PHI when applicable.
Safeguards We Maintain
- PHI is encrypted in transit and at rest.
- Access to PHI is limited to the reviewing clinician and any staff bound by a signed confidentiality agreement.
- Multi-factor authentication is used on all devices and accounts with access to case materials.
- PHI is never transmitted through personal email or unsecured file-sharing services.
- Records are retained only as long as necessary for the engagement (or as required by law or litigation hold), then securely destroyed.
Security Incidents
Any suspected unauthorized use or disclosure of PHI will be reported to the retaining firm without unreasonable delay, consistent with our internal Data Security & Records Retention Policy and any applicable Business Associate Agreement.
Questions
Questions about how a specific engagement will handle PHI can be discussed and documented in writing before any records are exchanged. Contact: intake@holisticpathwaylegal.com