PRIVACY · SECURITY · PATIENT RIGHTS
A useful privacy program is more than a badge. It defines why information is collected, who needs it, how access is limited, and what you can ask us to do.
THE STANDARD
The HIPAA Privacy Rule addresses uses and disclosures of protected health information. The Security Rule addresses safeguards for electronic PHI. The Breach Notification Rule addresses required notice after certain breaches of unsecured PHI.
WHITEGLOVEMD uses a defined consent, record, review, and delivery workflow to support those responsibilities. Security is an ongoing operating discipline; no website can honestly promise that all risk has been eliminated.
HOW THE PROGRAM IS ORGANIZED
HIPAA is technology-neutral. Useful safeguards combine people, process, and technical controls appropriate to the information and risk.
Privacy responsibilities, workforce expectations, access review, incident handling, and vendor oversight support the way protected health information is handled.
Secure sign-in, role-limited access, encrypted transmission and storage, and activity records help protect electronic information across the platform.
The case workflow separates intake, record collection, physician review, and report delivery so access can follow a defined purpose rather than broad availability.
THE RECORD JOURNEY
The purpose changes at each stage. The workflow should make that purpose visible and keep the record from becoming broadly available.
Before records are requested or reviewed, the patient or authorized representative completes the applicable consent and medical-record authorization steps.
Records may be uploaded through the secure portal or obtained through an authorized release. The records team works from the facilities and sources identified for the case.
Assigned clinical reviewers access the information needed for the review. The case is organized around the question presented, the available record, and the selected service.
The report and any consultation materials are delivered through the approved workflow. Requests involving access, correction, restrictions, or confidential communication go to the privacy team.
YOUR RIGHTS
Some rights and response duties depend on the information and WHITEGLOVEMD’s role. The privacy team will route each request through the applicable process.
Request access to or a copy of protected health information maintained by WHITEGLOVEMD, subject to applicable limits.
Ask that information be amended if you believe it is inaccurate or incomplete.
Request an accounting of certain disclosures of protected health information.
Request limits on certain uses or disclosures; not every requested restriction must be accepted.
Ask to receive communications through a particular method or at a particular address.
Raise a concern with the Privacy Officer or file a complaint with the HHS Office for Civil Rights without retaliation.
MAKE A PRIVACY REQUEST
To protect the record, we may need to verify identity or authority before releasing information or acting on a request.
No retaliation for a good-faith privacy complaint.
OFFICIAL CONTEXT
These HHS resources explain the federal framework. They are not a substitute for legal advice or for the Notice that applies to your information.
Administrative, physical, and technical safeguards for electronic protected health information.
How covered entities limit uses, disclosures, and requests to the information reasonably needed.
How an individual can submit a HIPAA privacy, security, or breach-notification complaint to OCR.
FAQ
For the broader handling of personal information, read the Privacy Policy.
Read the privacy policy ↗Protected health information, often called PHI, is individually identifiable health information maintained or transmitted by a HIPAA covered entity or its business associate in a form covered by the HIPAA Rules. The exact legal analysis depends on the entity, information, and context.
No. HIPAA is a set of federal privacy, security, and breach-notification requirements, not a one-time product badge. HHS describes compliance as an ongoing process involving risk analysis, reasonable and appropriate safeguards, documentation, and periodic evaluation.
Access is intended to be limited to authorized people and service providers with a role in the case or the operation of the service. The specific participants can include assigned physicians, records or support personnel, and contracted technology providers operating under applicable privacy obligations.
Email privacy@whiteglovemd.com or call (855) 688-3160. Identify the request and the best secure way to follow up. Additional identity verification may be required before protected information is released or changed.
Contact the WHITEGLOVEMD Privacy Officer at privacy@whiteglovemd.com or (855) 688-3160. You may also file a complaint with the U.S. Department of Health and Human Services Office for Civil Rights. You will not be retaliated against for making a good-faith complaint.
A DIRECT LINE TO PRIVACY
Contact the Privacy Officer for access, amendment, confidential-communication, restriction, accounting, or complaint questions.