HIPAA & Data Security

Public website boundary

The public consultation form and ordinary inquiry email are not approved channels for PHI. A linked login page or encrypted connection alone does not establish that a service is approved for healthcare data.

Determine HIPAA obligations first

HIPAA obligations depend on covered-entity and business-associate roles and the work performed. Before receiving PHI for a covered entity, determine whether a business associate agreement is required and execute the appropriate agreement. Vendors or subcontractors handling PHI may also need contractual safeguards.

A BAA must be accompanied by applicable privacy and security practices. This website does not claim a HIPAA certification, a completed security audit, or that every linked vendor is suitable for PHI.

Requirements for restricted-data work

Agree on authorized systems, minimum necessary access, identity and access controls, encryption appropriate to the environment, retention and disposal, training, and incident response before data exchange. Confirm safeguards and responsibilities rather than assuming a product’s marketing claim is sufficient.

De-identification must be assessed against applicable requirements; replacing names or removing obvious identifiers may leave re-identification risks. Do not upload identifiable records to consumer AI tools or unapproved connectors.

Report concerns

For a suspected disclosure or security incident, email privacy@melissafrierson.com with a brief non-sensitive description. Do not send the affected records in the report. This mailbox is not a monitored emergency response service.

Incident investigation and notification duties depend on applicable law and agreements, including HIPAA breach rules and relevant state laws such as South Carolina Code Section 39-1-90. This notice does not replace a required incident-response plan.