HIPAA Notice of Privacy Practices

1. FinVerified's Role Under HIPAA

FinVerified, Inc. operates as a Business Associate under HIPAA and HITECH. We are not a Covered Entity. We process limited PHI only when contracted by a HIPAA-covered healthcare provider under a signed Business Associate Agreement (BAA).

2. PHI We May Process

Limited PHI including: patient name and contact information; limited treatment context necessary for compliance workflows; financial information related to financing options. We do not access clinical records, diagnoses, or treatment plans beyond what is minimally necessary.

3. How We Use and Disclose PHI

Only as permitted by our BAA and applicable law: to perform contracted compliance services; as required by law; for our own BA operations including security and legal defense. We do not sell PHI, use PHI to train AI models, or disclose PHI for marketing.

4. Safeguards

• TLS 1.2+ encryption in transit, AES-256 at rest
• Role-based access controls with MFA
• Regular risk assessments and security monitoring
• Workforce training and access management
• Incident response and breach notification procedures

5. Breach Notification

We notify the applicable Covered Entity within 60 days of breach discovery. The Covered Entity notifies affected individuals and HHS per HIPAA requirements.

6. Your Rights

Your HIPAA rights are managed by your healthcare provider, not FinVerified. Contact your provider to exercise rights. To report concerns about FinVerified's PHI handling, contact us at privacy@finverified.ai or file a complaint with HHS OCR at hhs.gov/ocr/privacy.

7. Subcontractors

All subcontractors with PHI access have executed BAAs. See our Subprocessor List.

8. Contact