Compris, Inc. (“us”, “we”, or “our”) operates the ComprisCare.com website, and is the author of the Behavioral Health and Substance Use Disorder (SUD) risk assessment tool on the website (website and tool hereinafter referred to as the “Service”).This page informs you of our policies regarding the collection, use, and disclosure of personal data when you use the Service and the choices you have associated with that data. We use your data to provide and improve the Service. By using the Service, you are being made aware of and agree that no collection and use of Protected Health Information (“PHI”) will be utilized in accordance with this policy.

​

HIPAA and Hitech Security:

Before using the Service, a Disclaimer has been made available to you. By using the Service, you indicate your consent to participate in the healthcare assessment the Service provides. By consenting to do this assessment, you are acknowledging that the Service has not obtained any PHI from you. Although Compris, Inc. is not obtaining any PHI, the Service is a Health Insurance Portability and Accountability (“HIPAA”)-compliant website, and is fully encrypted. We will never intentionally make your medical information available to third parties without your express consent. HIPAA and Health Information Technology for Economic and Clinical Health (“HITECH”) provide national minimum standards to protect an individual’s PHI. The U.S. Department of Health and Human Services (“HHS”) manages and enforces these standards. The HIPAA Security Rule requires covered organizations to implement technical safeguards to protect all Electronic Personal Healthcare Information (“ePHI”), making specific reference to encryption, access controls, encryption key management, risk management, auditing and monitoring of ePHI information. The HIPAA Security Rule then goes on to set out numerous examples of HIPAA encryption methods which can be employed and the factors to consider when implementing and ensuring the success of a HIPAA encryption strategy. The HITECH Act then expands the compliance requirement set, requiring the disclosure of data breaches of “unprotected” (unencrypted) personal health records (“PHR”), including those by business associates, vendors and related entities. And finally, the “HIPAA Omnibus Rule” of 2013 formally holds business associates liable for compliance with the HIPAA Security Rule. HIPAA was originally created to streamline healthcare processes and reduce costs by standardizing certain common health care transactions, while protecting the security and privacy of individuals’ PHI. HITECH expanded on the privacy and security requirements of HIPAA. HIPAA and HITECH focus on PHI, which generally includes any personally identifiable information regarding an individual’s physical or mental health, the provision of health care to him or her, or payment for related services. PHI also includes any personally identifiable demographic information, including, for example, name, address, phone numbers, and Social Security numbers. These standards affect the use and disclosure of PHI by covered entities (such as health care providers engaged in certain electronic transactions, health plans, and health care clearinghouses) and their business associates.

​

The 4 HIPAA Rules:

1. HIPAA Privacy Rule: HIPAA’s Privacy Rule restricts intentional and unintentional use or disclosure of PHI that is in violation of the requirements of HIPAA.

 

A. Do not allow impermissible use or disclosure of PHI;

B. Provide breach notification to covered entity;

C. Provide individual or the covered entity access to the PHI;

D. Disclose PHI to the Secretary of the HHS if compelled to do so;

E. Provide an accounting of disclosures;

F. Comply with the requirements of HIPAA Security Rule.

 

2. HIPAA Security Rule: HIPAA’s Security Rule requires covered entities to put in place detailed administrative, physical, and technical safeguards to protect electronic PHI.

 

3. HIPAA Enforcement Rule: It spells out penalties and procedures for hearing.

 

4. HIPAA Breach Notification Rule: It requires healthcare providers to notify patients in the case of breach of unsecured ePHI & PHI. The Service is delivered via serves hosted in data centers that are HIPAA compliant.

​

Security Policy: 

Our internal Security Policy mandates all of the following:

• Physical Safeguards – Only authorized Compris, Inc. employees and contractors can access the servers.

• Administrative Safeguards – Access to the data within the application is controlled by the covered entity, while Access to the server is controlled by the Compris, Inc. team. Compris, Inc. provides role-based access control to restrict access to certain users.

• Technical Safeguards – Compris, Inc. maintains an active monitoring system to find and fix any vulnerabilities in Operating System, Web Server, and Database.

 

Compris, Inc. has employed an SSL, database encryption, and data obfuscation where possible, and will capture as little data as necessary in an attempt to and safeguard the data and privacy of its participants. Compris, Inc. cannot guarantee the safety of Compris, Inc.’s assessment participants data from those who attempt to steal, intercept, or misuse it, however since no PHI is being requested, data is not connected to any one particular identity.If a breach has occurred at the service level, Compris, Inc. will alert you.

 

• Physical Safeguards – Only authorized Compris, Inc. employees and contractors can access the servers.

• Administrative Safeguards – Access to the data within the application is controlled by the covered entity, while Access to the server is controlled by the Compris, Inc. team. Compris, Inc. provides role-based access control to restrict access to certain users.

• Technical Safeguards – Compris, Inc. maintains an active monitoring system to find and fix any vulnerabilities in Operating System, Web Server, and Database.

​

Breach Notification: 

If a breach has occurred at the service level, since no PHI is being requested, there will be no identifying information obtainable.