HIPAA and patient information

What this covers

Protected health information ("PHI") is anything that identifies a person and relates to their health, their care, or paying for their care. It is not only diagnoses and notes. A name beside an appointment time is PHI. So is the fact that somebody is a patient here at all.

The rules, in the order they get broken

1. Look only at what you need

Open a record because your work requires it, not because you recognise the name. Looking up a friend, a relative, a colleague, or yourself out of curiosity is a violation even though nothing leaves the building. Every chart opening is logged against your account.

2. Log out when you step away

This is the one people get wrong most, and it is the reason most small practices have a breach. An unlocked screen is an open record. Lock your device or sign out whenever you leave it, even briefly, even at home. Exetazo signs you out after an hour of inactivity, but an hour is a long time and that timer is a backstop, not a substitute for you.

3. Your account is yours alone

Never share a password or let someone work under your sign-in, including family and including other team members. Everything done under your account is attributed to you.

4. Keep it on the platform

Do not put patient information in ordinary email, personal messaging apps, social media, or an AI tool that is not part of Exetazo's approved systems. Do not photograph a screen. Do not copy records to a personal device or drive.

5. Take care where you work

Telehealth means you may be working somewhere that is not a clinic. Position your screen so it cannot be overlooked, use headphones, and do not conduct visits or discuss patients where you can be overheard — including by household members.

6. Say something the same day

If you send something to the wrong person, lose a device, suspect an account has been used by someone else, or simply are not sure whether something was a problem — report it to the practice owner the same day. The law gives a practice a limited window to assess and notify, and that clock starts when the incident happens, not when it is reported. You will not be penalised for reporting promptly and honestly. You may be penalised for concealing.

Patients' rights you may be asked about

Patients can ask for a copy of their record, ask for corrections, ask who their information has been disclosed to, and ask to be contacted a particular way. You do not have to answer these yourself — pass the request to the practice owner promptly, because most carry legal deadlines.

When you leave

Your access is withdrawn. Confidentiality does not end with it: the obligation to keep patient information private continues indefinitely. Return or destroy anything you still hold.

If this is broken

Depending on what happened, consequences may include retraining, loss of access, termination of your engagement, and — for deliberate misuse — civil and criminal penalties under federal law that attach to you personally, not only to the practice.

Asking is always allowed

If you are unsure whether something is permitted, ask before you do it. A question costs nothing. Nobody here will think less of you for checking.

Related: Device and Account Security, Notice of Privacy Practices.