HIPAA Security and Privacy Policies

Purpose and scope

These policies set the patient privacy and security requirements for handling client or patient information across all CloudNook engagements. They apply to every contractor, team member, and partner who touches client systems or patient data in any form.

We adhere strictly to the Business Associate Agreement (BAA) signed with each client and to all applicable law, including HIPAA and HITECH. Where these policies and the BAA differ, the stricter requirement governs.

Privacy and permitted use

Patient information stays strictly inside the client's EHR and approved tools. It is never copied, printed, downloaded, photographed, or stored on personal devices or unapproved storage of any kind.

• No copying, printing, or exporting of patient information out of client systems.
• No patient information on personal devices, personal email, or unapproved cloud storage.
• Staff draft and route clinical communications for physician review. Staff never diagnose, prescribe, or provide clinical judgment.
• Patient information is accessed only as needed to perform assigned work, and only the minimum necessary.

Workspace, devices and access

Anyone handling patient information works from a dedicated private room with a closed door, so conversations and screens are not visible or audible to others.

• Computers are encrypted and protected with strong passwords.
• Screens lock automatically when unattended, and devices are never left unlocked.
• Operating systems and software are kept up to date with current security patches.
• Workspaces and device setups are verified before patient work begins.

HIPAA training

HIPAA certification is required before anyone handles patient data, no exceptions. Training is refreshed annually to keep knowledge current.

Training EHRs and practice environments used for learning are treated as confidential. Credentials and any example data inside them are never shared or reused outside the training context.

Incident reporting

Any suspected privacy or security issue must be reported the same day, and always within 24 hours of discovery. This includes lost devices, accidental disclosures, suspicious account activity, misdirected messages, or anything that simply feels wrong.

Report immediately to sheryl@processrun.com. No one is penalized for reporting a concern in good faith. A fast report protects patients, and it protects the practice.

Monitoring and verification

Routine time tracking follows strict rules: screenshots are blurred so no patient information is captured, and all screenshots are deleted within 90 days.

Every 90 days, each person working on a client engagement provides a written confirmation that no patient data is held locally on any device or personal account.

Ending engagement

When an engagement ends, all credentials, documents, and materials are returned immediately or destroyed with certification. Access is revoked the same day.

Privacy duties continue after the engagement ends. The obligation to protect any patient information encountered during the work has no expiration date.

Updates and inquiries

These policies are reviewed regularly and updated as requirements change. The current version is always published on this page.

Questions about privacy, security, or these policies can be sent any time to sheryl@processrun.com.