HIPAA Compliance

NursingReach maintains a compliance-oriented operating model designed to respect the requirements and policy objectives of the Health Insurance Portability and Accountability Act (HIPAA). Our services are structured around professional outreach data and are not intended to collect, process, or commercialize Protected Health Information (PHI).

This notice sets out our control framework, data boundary rules, security posture, and permitted-use expectations for customers interacting with our healthcare-focused datasets.

1. What is HIPAA Compliance?

HIPAA is a United States federal regulatory framework that establishes privacy, security, and breach-governance obligations for protected health information and regulated entities.

HIPAA applies to:

• Covered Entities - Healthcare providers, health plans, and healthcare clearinghouses.
• Business Associates - Service organizations that create, receive, maintain, or transmit PHI for covered entities.
• Subcontractors with PHI Access - Downstream vendors with delegated operational exposure to regulated information.

2. What Data Do We Provide?

We provide business-oriented professional contact intelligence, including records related to:

• Licensed clinicians and allied healthcare professionals
• Clinical administrators and authorized decision-makers
• Hospitals, practices, and healthcare delivery organizations
• Operationally relevant professional affiliations

Our data includes:

• Professional name, role, and credential descriptors
• Business communication attributes and work-location metadata
• Institutional and specialty classification details
• Publicly referenced licensing identifiers where applicable

3. How We Ensure HIPAA Compliance

We implement multi-layer safeguards intended to prevent regulated data misuse and preserve controlled operational behavior:

• PHI Exclusion by Design - Product scope is limited to professional outreach data and excludes patient-level records.
• Controlled Source Intake - Records are obtained from lawful professional sources and vetted for relevance and scope.
• Security Controls - Encryption, access governance, and monitoring procedures are applied to operational systems.
• Periodic Compliance Review - Internal checks are conducted to confirm policy conformance and control effectiveness.
• Least-Privilege Access - Sensitive datasets are restricted to authorized personnel with defined operational need.

4. What We DO NOT Provide Under HIPAA

To preserve strict boundary control, NursingReach does not:

• Sell or disseminate patient records, claims narratives, or treatment documentation.
• Host datasets designed to identify an individual's medical condition or care episode.
• Distribute confidential provider-patient communications.
• Publish high-risk identifiers unrelated to lawful professional outreach purposes.
• Permit unauthorized third-party access to controlled repositories.

5. How You Can Use Our HIPAA-Compliant Data

Permissible use cases include:

• B2B Healthcare Outreach - Promotion of lawful products, services, and professional solutions.
• Recruitment and Staffing - Professional hiring and workforce engagement communications.
• Research and Insight Programs - Professional surveys, market research, and non-patient intelligence collection.
• Clinical Education Outreach - Communications regarding accredited training and professional development.
• Healthcare Technology Engagement - Lawful promotion of software, infrastructure, and operational platforms.

6. Data Security & Protection Measures

Security safeguards include:

• Encryption Controls - Protected transport channels and safeguarded storage architecture for sensitive operational assets.
• Access Governance - Role-based permissions and authorization boundaries across systems.
• Security Review Cycles - Recurring assessments to identify and remediate control weaknesses.
• Payment Safeguards - Secure transactional handling through compliant payment infrastructure partners.
• Threat Monitoring - Defensive monitoring to detect anomalous activity and intrusion indicators.

7. HIPAA Compliance & Third-Party Vendors

We engage third-party vendors under controlled contractual and security obligations, including categories such as:

8. Your Responsibilities as a User

As a customer, you are responsible for lawful and compliant downstream use. You must:

• Use the data only for legitimate professional outreach and business communication.
• Refrain from transmitting PHI, patient treatment details, or confidential care correspondence.
• Follow applicable legal obligations, including communications and privacy requirements.
• Maintain appropriate suppression, opt-out, and consent controls where required by law.

Non-compliant conduct may expose you to regulatory, contractual, and reputational consequences. You should maintain internal governance controls before initiating campaigns.