Roles and scope
UHIQ may process patient demographics, clinical encounters, eligibility responses, coding, claims and payment information for healthcare organizations. Roles such as HIPAA business associate or privacy-law processor depend on the actual services and legal circumstances.
Business Associate Agreements
Where HIPAA requires it, a written BAA addresses permitted and required PHI uses/disclosures, safeguards, reporting of incidents/breaches, applicable subcontractor conditions, support for relevant rights and return/destruction obligations where feasible. This webpage is not an executed BAA.
Data Processing Agreements
A separate DPA may address processing instructions, personal information categories, confidentiality, technical and organizational measures, subprocessors, incident assistance, transfer safeguards, rights handling and end-of-service deletion.
Subprocessors and hosting
Cloud providers, clearinghouse connections, AI vendors and service providers must be evaluated according to functions performed and information processed. Applicable downstream HIPAA arrangements and security obligations must be implemented. Data residency and permitted offshore access must match actual deployment and contracts.
Incident response, requests and termination
Notification, cooperation, customer rights assistance, retention, return and deletion are governed by the relevant law and executed agreement. Covered healthcare organizations generally manage patient record requests with assistance from UHIQ as required.
Request documentation
Eligible customers and prospective customers may request available BAA/DPA materials, security documentation and subprocessor disclosures through legal/compliance contact pending verification, subject to applicable confidentiality procedures.