HIPAA Compliance

Your business's privacy & security is our top priority. And, that's exactly why we treat the safe custodianship of your data as our core function. Collectively referred to as HIPAA, the Health Insurance Portability and Accountability Act of 1996 along with a series of supplemental regulations, sets national standards to protect sensitive patient health information from being disclosed without the patient's consent or knowledge.

In terms of Experience Management Software, the solution security architecture must comply with all the applicable standards & implementation specifications that protect the confidentiality of Protected Health Information (PHI) stored, handled or processed by the covered entities or business associates.

HIPAA security standards state that the covered entity must:

• Secure the integrity, confidentiality & availability of all electronic PHI
• Detect and safeguard against any foreseeable threats or risks to the security of the information
• Protect against any reasonably anticipated impermissible uses or disclosures of such information
• Certify compliance by their entire workforce

We are committed to comply with all applicable data protection laws. We are a defined Business Associate and as part of our HIPAA compliance, SurveySparrow enforces and maintains the appropriate administrative, technical and physical safeguards for ensuring the confidentiality, security, integrity and privacy of the PHI. And in the capacity of a Business Associate throughout the duration of providing services to our healthcare customers, SurveySparrow platform enables HIPAA compliance to covered entities.

Signing the Business Associate Agreement with SurveySparrow is a mandatory requirement to enable HIPAA Account, please contact your account manager for more details.

Additionally, we have executed agreements with our subcontractors that create, receive, maintain, or transmit PHI on our behalf which contains the same restrictions, conditions, reasonable and appropriate safeguards that apply to SurveySparrow with respect to such PHI under HIPAA.

Please note that HIPAA enabled accounts cannot be reverted back into a regular account.

The following table demonstrates the HIPAA standards, and SurveySparrow's approach to comply with it.

The agencies responsible to certify health technology – the Office of the National Coordinator for Health Information Technology and the National Institute of Standards and Technology – do "not assume the task of certifying software and off-the-shelf products" (p. 8352 of the Security Rule), nor accredit any other independent agencies to do HIPAA certifications.

It should also be noted that the HITECH Act only supports testing and certification of Electronic Health Records (EHR) programs and modules. As SurveySparrow is not an EHR software or module, our area of technology cannot be certified by these unregulated agencies.

SurveySparrow's HIPAA Attestation was performed by a third party that reviewed and affirmed that our environment & services has implemented the appropriate controls needed to secure PHI in accordance with the requirements of the Health Insurance Portability and Accountability Act (HIPAA) Security Rule, Breach Notification Rule, and the applicable parts of the Privacy Rule. Additionally, the Attestation was conducted in compliance with the American Institute of Certified Public Accountants (AICPA) Statement on Standards for Attestation Engagements (SSAE) 18, AT-C divs 105 and 205.