At Tynet EHR, we are committed to protecting the privacy and security of Protected Health Information (PHI) and personal data. This policy outlines how we collect, use, disclose, and safeguard information in compliance with HIPAA and other regulations.
This Privacy Policy applies to all information collected through our services.
Tynet EHR ("we," "our," or "us") provides electronic health record (EHR) software and services to home health, hospice, and healthcare providers. This Privacy Policy describes how we collect, use, disclose, and protect Protected Health Information (PHI) and other personal information in compliance with the Health Insurance Portability and Accountability Act (HIPAA), Health Information Technology for Economic and Clinical Health (HITECH) Act, and other applicable laws.
This policy applies to:
As a Business Associate under HIPAA, we are contractually obligated to protect PHI and comply with all applicable privacy and security regulations. We do not use or disclose PHI except as permitted or required by our Business Associate Agreement or as required by law.
Types of information collected through our services.
When healthcare providers use our services to manage patient care, we process PHI on their behalf. This includes:
| Category | Examples | Purpose |
|---|---|---|
| Demographic Information | Name, address, date of birth, SSN, insurance information | Patient identification and billing |
| Clinical Information | Medical history, diagnoses, treatment plans, medications | Clinical care and documentation |
| Assessment Data | OASIS-E, HOPE assessments, functional status | Care planning and regulatory compliance |
| Billing Information | CMS-1500 forms, claims data, payment information | Reimbursement processing |
| Visit Information | EVV data, visit notes, clinician documentation | Care delivery verification |
We collect information from healthcare organizations and their staff, including:
We follow the principle of data minimization, collecting only the information necessary to provide our services and fulfill our contractual obligations. We do not collect PHI directly from patients unless specifically authorized by the healthcare provider.
Our commitment to healthcare privacy regulations.
As a Business Associate under HIPAA, we enter into BAAs with all covered entities (healthcare providers) who use our services. Our BAA:
We implement administrative, physical, and technical safeguards required by the HIPAA Security Rule:
Security policies, training, risk assessments
Data center security, access controls
Encryption, authentication, audit controls
In the event of a breach of unsecured PHI, we comply with HIPAA Breach Notification Rule requirements:
Purposes for processing information.
We use information to provide and maintain our services, including:
We use information for legal and operational purposes:
We may create and use de-identified data for:
We use de-identified, aggregated data to analyze usage patterns, improve our services, and develop new features. This data does not contain any identifiable PHI and cannot be linked back to individual patients or providers.
When and how we share information.
We may disclose PHI as permitted by our Business Associate Agreement and applicable law:
We engage third-party service providers who may process information on our behalf:
| Service Provider | Purpose | Data Protection |
|---|---|---|
| Cloud Hosting Providers | Data storage and infrastructure | SOC 2 Type II, HIPAA compliant |
| Payment Processors | Billing and payment processing | PCI DSS compliant |
| Analytics Providers | Service improvement and analytics | De-identified data only |
| Support Services | Customer support and maintenance | Strict access controls |
We do not sell, rent, or trade PHI to third parties for marketing or any other purposes. We do not use PHI for marketing without explicit authorization from the individual.
How we protect information.
We implement comprehensive security measures to protect information:
AES-256 encryption at rest and in transit
MFA, strong password policies
Complete audit trails, regular reviews
Firewalls, intrusion detection, DDoS protection
We implement strict access controls:
Our security program includes regular assessments and certifications:
How long we retain information.
We retain information in accordance with legal requirements and business needs:
| Data Type | Retention Period | Legal Basis |
|---|---|---|
| Clinical Records (PHI) | 6 years from last activity or as required by state law | HIPAA, state medical record laws |
| Billing Records | 7 years from service date | IRS requirements, CMS regulations |
| OASIS-E Assessments | 5 years from assessment date | CMS requirements |
| EVV Visit Data | 6 years from visit date | State Medicaid requirements |
| Audit Logs | 7 years from creation | HIPAA Security Rule |
When retention periods expire, we securely dispose of information using methods that prevent reconstruction:
Upon termination of service, we provide options for data return or destruction as specified in our Business Associate Agreement.
Rights regarding your information.
As a Business Associate, we support covered entities in fulfilling patient rights under HIPAA:
Patients should contact their healthcare provider (the covered entity) to exercise their HIPAA rights. As a Business Associate, we will assist covered entities in fulfilling these requests as required by our Business Associate Agreement.
Healthcare organizations using our services have the right to:
Our role under HIPAA.
Our BAA includes the following key provisions:
We ensure that all subcontractors who handle PHI:
We continuously monitor and improve our compliance program through:
For privacy-related questions, concerns, or to exercise your rights.
privacy@tynetehr.com
For general privacy inquiries
1-800-PRIVACY
Mon-Fri 9am-5pm EST
requests@tynetehr.com
For data access or deletion requests
security@tynetehr.com
For security concerns
Access our complete privacy documentation and compliance certificates.