HIPAA practices.

Our role under HIPAA

KLM Management Inc is a business associate, not a covered entity. We handle protected health information on behalf of the provider offices we serve, each of which is the covered entity for its own patients. Every engagement operates under a signed business associate agreement as required by 45 CFR 164.502(e) and 164.504(e).

This distinction matters for patients. Under 45 CFR 164.520, the Notice of Privacy Practices is issued by the covered entity. Business associates do not issue one. If you are a patient looking for the notice describing how your records are used, request it from your provider's office.

How we use protected health information

We use and disclose protected health information only as permitted by our agreement with the provider office and only as necessary to perform the services that office has engaged us for. We do not use it for our own purposes, we do not sell it, and we do not use it for marketing.

We apply the minimum necessary standard. When a request asks for a defined scope, we release what the request covers and nothing beyond it.

Safeguards

• Administrative, physical, and technical safeguards consistent with the HIPAA Security Rule at 45 CFR Part 164 Subpart C
• HIPAA training and certification for every workforce member who handles records, completed before they handle a chart
• Access limited to the workforce members assigned to that office's work
• Encrypted transmission and storage for records in our systems, rather than consumer file sharing
• Validation of authorizations and request scope before any release
• A documented record of each request received, worked, and closed

Subcontractors

Where a subcontractor creates, receives, maintains, or transmits protected health information on our behalf, that subcontractor is bound by a written agreement imposing the same obligations that apply to us.

Breach notification

If we discover a breach of unsecured protected health information, we notify the affected covered entity without unreasonable delay and in accordance with 45 CFR 164.410, providing the information needed for that office to meet its own notification obligations.

Patient requests

Patients exercise their HIPAA rights, including access to records, amendment, restriction, and an accounting of disclosures, through their provider. We support offices in meeting those obligations, but we act at the direction of the covered entity and cannot fulfill a patient request independently. If you contact us directly, we will point you to the right office rather than act on the request ourselves.

Questions

Questions about how KLM handles protected health information can go to concierge@klmrecords.us or (619) 720-1774. If your question concerns your own records, your provider's office is the right place to start.

Changes to this statement

We may update this statement as our practices or the applicable rules change. The effective date above will change when we do.