HIPAA Statement

Our role under HIPAA

Global Well BHSC is a consulting firm. When engaged by a US Covered Entity (hospital, clinic, health plan, or provider organisation) in a role that involves Protected Health Information (PHI), we act as a Business Associate under the Health Insurance Portability and Accountability Act (HIPAA), 45 CFR Parts 160 and 164.

Business Associate Agreements (BAAs)

Before receiving or accessing PHI, we execute a signed Business Associate Agreement with the Covered Entity or upstream Business Associate. The BAA governs permitted uses, disclosures, safeguards, subcontractor obligations, breach notification, and return or destruction of PHI at termination.

Safeguards

Administrative

• Workforce security policies, training, and role-based access.
• Written incident response and breach-notification procedures.
• Sanction policy for non-compliant workforce members.

Physical

• Device and media controls for any hardware that stores or accesses PHI.
• Secure workspaces for any onsite engagement involving PHI.

Technical

• Encryption of PHI in transit (TLS 1.2+) and at rest where feasible.
• Unique user identifiers, least-privilege access, and audit logging.
• Vetted subprocessors with executed BAAs where PHI is involved.

De-identification

Wherever possible, we work with de-identified data under 45 CFR §164.514 (Safe Harbor or Expert Determination). Consulting deliverables, insights, and case studies are de-identified before publication.

Breach notification

In the event of a security incident involving PHI, we will notify the Covered Entity without unreasonable delay and no later than the timeline specified in the executed BAA, consistent with 45 CFR §164.410.

What we do NOT do

• We do not provide direct clinical care.
• We do not bill payers, submit claims, or process transactions containing PHI.
• We do not sell or share PHI for marketing purposes.

Contact

To request a BAA, our HIPAA policies summary, or to report a suspected incident, email hello@globalwellbhsc.com or call +1 (917) 747-8443. See our Privacy Policy and NDPR statement for related detail.