We adhere by the rules set down by US Dept of Health and Human Services in relation to HIPAA

HIPAA regulations for holding and using patient information focus on protecting **Protected Health Information (PHI). Key rules include:

1. **Privacy Rule**:

   - Establishes standards to protect PHI, ensuring patient confidentiality and limiting unnecessary access.

   - Permits use/disclosure of PHI for treatment, payment, healthcare operations, or specific exceptions like public health activities.

2. **Security Rule**

   - Applies to electronic PHI (e-PHI), requiring safeguards to ensure confidentiality, integrity, and availability.

  - Includes physical controls (facility access restrictions), technical measures (encryption, access control), and administrative policies (workforce compliance).

3. **Breach Notification Rule**:

   - Requires entities to notify affected individuals and authorities in case of unauthorized PHI exposure.

Compliance involves implementing these safeguards and continuously monitoring systems to prevent breaches or misuse.

https://www.hhs.gov/hipaa/for-professionals/index.html