Medico Care Support ("Medico Care Support," "we," "us," "our") is committed to
safeguarding your personal and health information. This
Privacy Policy details how we collect, use, store,
protect, and share your data in compliance with HIPAA,
HITECH, and applicable U.S. federal and state privacy
laws.
We collect
information you directly provide: full legal
name, date of birth, SSN (for insurance),
address, email, phone, emergency contacts,
employment details, insurance policy numbers,
and health information including medical
history, medications, allergies, lab results,
diagnostic images, treatment plans, and clinical
notes generated during your care.
When
you visit our website or app, we automatically
collect IP address, browser type, operating
system, device identifiers, pages visited, time
on pages, referring URLs, click patterns, and
location data (when enabled). We use cookies,
web beacons, pixel tags, and similar tracking
technologies for analytics and service
improvement.
Your
information is used to provide and manage
healthcare services, schedule appointments,
facilitate telehealth, process insurance claims,
prescribe medications, communicate results,
verify identity, maintain records, comply with
legal obligations, conduct quality assurance,
send reminders, process payments, and respond to
inquiries.
We share PHI for treatment with
physicians, specialists, labs, and pharmacies
involved in your care. For payment, we share
with insurers and billing services. For
healthcare operations, we use data for quality
improvement, peer review, training, compliance,
and business planning.
Beyond TPO, we share
only with your written authorization or as
legally permitted: business associates (IT,
billing, analytics), public health authorities,
law enforcement (court orders), organ
procurement organizations, and workers'
compensation carriers. We never sell your
PHI.
We implement AES-256
encryption (at rest), TLS 1.3 (in transit),
multi-factor authentication, role-based access,
intrusion detection, regular vulnerability
assessments, and annual penetration testing.
Infrastructure is SOC 2 Type II certified. All
employees complete HIPAA training and sign
confidentiality agreements.
In case of a PHI
breach, we notify affected individuals within 60
days of discovery per HIPAA. Notifications
include breach description, data types involved,
protective steps, and our mitigation actions. We
also notify HHS and, when applicable, media
outlets.
You have the right to:
access/copy your PHI, request amendments,
receive an accounting of disclosures, request
restrictions, request confidential
communications, obtain a paper copy of this
Notice, and file a complaint without
retaliation.
Uses and
disclosures not covered by this policy require
your written authorization. You may revoke
authorization anytime in writing, except where
action was already taken. Revocation doesn't
affect prior lawful uses.
We may send
marketing about services and offers. Where
required, we obtain prior authorization. You can
opt out anytime via unsubscribe links,
contacting us, or our Unsubscribe page.
Transactional messages (reminders, results,
billing) cannot be opted out of.
For patients under 18,
we require parental/guardian consent except
where state law grants minors rights to consent
to certain services (reproductive, mental
health). We maintain confidentiality per the
minor's legal rights.
Some service
providers may process data internationally. We
ensure appropriate safeguards: Standard
Contractual Clauses, Binding Corporate Rules, or
equivalent mechanisms maintaining U.S.-level
data protection.
We retain data as long as
necessary for its purpose, legal compliance
(typically 7–10 years for medical records,
longer for minors), dispute resolution, and
agreement enforcement. Data is destroyed using
NIST 800-88 compliant methods when no longer
needed.
We use
ONC-certified EHR systems with audit logging,
access monitoring, and automatic session
timeouts. You may request electronic copies in
machine-readable format.
Telehealth uses
HIPAA-compliant platforms with end-to-end
encryption. Sessions aren't recorded without
consent. We recommend private settings and
aren't responsible for your personal
internet/device security.
Analytics tools collect
aggregated, anonymized data to improve user
experience. We don't use analytics for
individual patient care or coverage
decisions.
Portal access
requires unique credentials; we recommend MFA.
You're responsible for credential
confidentiality. We never ask for passwords via
email or phone. Report suspected unauthorized
access immediately.
We may use
de-identified data (per HIPAA Safe Harbor,
removing all 18 identifiers) for research and
healthcare improvement. De-identified data isn't
subject to this policy.
We comply with GINA.
Genetic data is treated as particularly
sensitive PHI with additional protections and
not used for insurance underwriting or
eligibility.
Subject to 42 CFR Part 2 and
state laws with additional protections. Not
disclosed without specific written consent
except in emergencies, court orders, or
qualified service organization
agreements.
HR data is
collected for recruitment, background checks,
payroll, benefits, and compliance. Employee
health data is maintained separately with
restricted access.
All
third-party vendors accessing PHI must execute
BAAs mandating HIPAA compliance, appropriate
security, breach notification, and
use/disclosure restrictions.
We comply with
CCPA/CPRA, Texas Data Privacy Act, Virginia
CDPA, Colorado Privacy Act, and other state laws
providing additional rights or obligations
regarding personal information.
We don't respond to DNT
signals but honor the spirit: we don't track
individuals across third-party sites for
advertising. Cookie consent tools let you
control tracking preferences.
If enabled, we collect
location for clinic finder, telehealth
verification, and state licensing compliance.
Data is encrypted and retained only as
needed.
Processed through PCI
DSS Level 1 providers. We don't store full card
numbers, CVVs, or magnetic stripe data.
Transactions are tokenized and
encrypted.
AI tools assist
with scheduling, claims, and clinical decision
support — never replacing professionals. No
coverage, treatment, or eligibility decisions
are made solely by automated processing. You may
request human review.
File complaints
with our Privacy Officer, HHS Office for Civil
Rights, or your state attorney general. We don't
retaliate. All complaints are investigated
promptly with corrective actions.
We may update this policy.
Material changes are communicated via email,
website banner, or other prominent notice 30
days before effect. Continued use constitutes
acceptance.
Privacy Officer: Medico Care Support,
Attn: Privacy, 861 Green Gate Lane
Baltimore, MD 21201. Email:
privacy@medicocaresupport.com. Phone: +1 928-202-6765, ext. 500. Requests can also be
submitted via the patient portal.
