Health Connect Wounds Solutions
Version 1.0 | Proposed effective date: [INSERT DATE]
Legal entity: Health Connect Wounds Solutions
EIN: 39-3511785
Applies to: Patients, prospective patients, providers,
referral sources, facilities, business partners, prospective medical
partners, and users of our approved communication and connected-service
channels.
Important: This public-facing policy explains how information is handled across our clinical, connected-care, and communication systems. It supplements, but does not replace, our HIPAA Notice of Privacy Practices (NPP). The NPP governs uses and disclosures of protected health information (PHI) and explains patients' HIPAA rights. If this policy conflicts with the NPP or applicable law, the NPP and applicable law control.
Health Connect Wounds Solutions (“Health Connect,” “we,” “us,” or “our”) provides and coordinates medical services, including wound care, podiatry, primary and specialty care support, telehealth, remote patient monitoring (RPM), chronic care management (CCM), scheduling, eligibility verification, care coordination, billing support, and patient notifications.
We protect information according to the sensitivity of the information, the purpose for which it was collected, the channel through which it was received, and applicable federal and California law. We use administrative, physical, and technical safeguards intended to preserve confidentiality, integrity, and availability.
Depending on the relationship and service, we may collect:
We seek to collect only information reasonably necessary for care, payment, operations, legal compliance, security, or the purpose described at collection.
We may use information to:
We do not sell PHI. We do not use PHI for unrelated advertising or permit vendors to use PHI to train general-purpose artificial-intelligence models unless the use is legally permitted, contractually authorized, appropriately safeguarded, and approved through our privacy process.
Office Ally, including its applicable practice-management or EHR functions, is our primary approved repository for the medical and practice record. Information stored there may include patient demographics, appointments, encounters, progress notes, orders, eligibility, claims-related information, and clinically important communications.
Material information received through another channel is entered, attached, or summarized in the EHR when necessary for treatment, continuity of care, the designated record set, billing, or compliance. Communication tools are not substitutes for the official medical record.
Health Connect ONE supports approved connected-care services such as RPM, CCM, RTM, care coordination, device onboarding, monitoring, alerts, patient engagement, and reporting. We limit information exchanged between Health Connect ONE and other systems to information reasonably needed for the service.
Clinically significant readings, alerts, interventions, and care-plan communications are reviewed by authorized personnel and documented or summarized in Office Ally when required for continuity of care or the official record. Connections are expected to use authenticated and encrypted methods, logging, access controls, and monitoring for failed transmissions.
Approved customer-relationship-management (CRM), intake, scheduling, and operational tools may contain limited information needed to manage referrals, appointments, reminders, outreach, authorizations, partnership discussions, and service coordination. Detailed clinical records should remain in Office Ally or an approved clinical platform unless a documented workflow requires otherwise.
Access is based on job responsibilities. Free-text fields must not be used as an uncontrolled medical record, and exports or bulk downloads require a legitimate business purpose and authorization.
| Channel | How information is handled |
|---|---|
| Amazon Connect, telephone, and voicemail | We may use approved call-center functions for scheduling, notifications, intake, service coordination, and quality. We verify identity before discussing sensitive information. Calls may be recorded or transcribed only when configured and permitted, with legally required notice. Voicemail content is limited according to patient preferences and the minimum necessary principle. |
| Text messages and automated reminders | We may send appointment, care-coordination, device, or service messages through approved systems. Standard SMS may not be fully secure. We keep messages limited and neutral when feasible, avoid sensitive diagnoses or detailed results, and honor applicable opt-out choices. Patients should call 911 for emergencies and should not use automated channels for urgent symptoms. |
| We use managed business accounts and approved secure-message or encryption methods when appropriate. Sensitive information should not be sent to personal or unapproved accounts. We verify recipients and attachments before sending. | |
| Patient portal and secure chat | These are preferred for sensitive electronic communications when available. Access requires authentication, and clinically important content is maintained or summarized in the official record. |
| CRM systems | CRM data is limited to the operational purpose, protected with role-based access and audit capabilities, and linked to the authoritative record when feasible. CRM information is not used for unrelated marketing. |
| Social media and online reviews | We do not provide medical advice, confirm patient status, or discuss PHI in public posts, comments, reviews, groups, or direct messages. If someone contacts us through social media, we may provide a general response and direct the person to an approved private channel. For privacy reasons, our response to a review will not confirm that the reviewer is or was a patient. |
| Website forms and chat functions | We collect only information needed for the stated purpose and use secure transmission where appropriate. Medical emergencies and detailed clinical information should not be submitted through general contact forms. We evaluate analytics, pixels, and tracking technologies to prevent impermissible disclosure of PHI. |
| Fax | Approved fax services may be used for referrals, orders, records, and care coordination. We verify fax numbers, use appropriate confidentiality notices, and investigate misdirected transmissions. |
| Telehealth, photographs, and video | We use approved platforms and obtain required consent. Clinical images or recordings are created only when appropriate, protected as part of the medical record, and not stored on personal devices. Routine recording is disabled unless authorized and necessary. |
| Paper and in-person communication | We take reasonable steps to prevent public conversations and unauthorized viewing. Paper records, schedules, labels, and notes are secured, transported appropriately, and destroyed through approved methods. |
We do not authorize use of personal email, consumer file-sharing accounts, unapproved messaging applications, public AI tools, or unmanaged devices to handle PHI.
We may share information as permitted or required by law, including with:
When a vendor or partner is a HIPAA business associate, we require an appropriate Business Associate Agreement (BAA). Contracts are expected to restrict use, require safeguards, address subcontractors and incidents, and govern return or destruction of information. We apply the minimum necessary standard when it is required.
Information subject to heightened protection—including certain behavioral-health, psychotherapy, substance-use-disorder, HIV, genetic, reproductive-health, or minor records—is handled according to the additional requirements that apply.
Patients may tell us their preferred telephone number, email, language, communication method, whether a detailed voicemail may be left, and who may receive information on their behalf. We may ask for written authorization or identity documentation before acting on certain requests.
Opting out of promotional messages does not prevent treatment, payment, safety, or other service communications that the law permits us to send. Message and data rates may apply to text messages. Because ordinary email and SMS can carry privacy risk, patients may request a more confidential method when reasonably available.
Subject to applicable law and the procedures in our Notice of Privacy Practices, patients may have the right to:
We verify identity and authority before fulfilling a request. Requests may be subject to legal limitations, required forms, and permitted fees. Please use the contact information in Section 15 to obtain the current NPP or submit a request.
Providers, referral sources, facilities, and prospective medical partners may give us professional contact details, credentials, licensure and enrollment information, tax and payment details, contracts, referral information, and operational communications. We use this information to evaluate and manage relationships, verify qualifications, coordinate patient services, establish system access, administer agreements, and meet legal or payer requirements.
Access to PHI is not granted merely because an organization is considering a partnership. Before PHI is shared, Health Connect confirms the purpose and legal basis, establishes required agreements (including a BAA when applicable), approves system access, and applies role-based and minimum-necessary controls.
Our safeguards are designed around the HIPAA principles of confidentiality, integrity, and availability and may include:
No system is completely secure. We continuously evaluate risk and improve safeguards based on law, technology, operations, and identified threats.
We maintain procedures to identify, report, contain, investigate, mitigate, and document suspected privacy or security incidents. This includes lost devices, misdirected messages, wrong-patient information, unauthorized access, malware, credential compromise, improper social-media contact, and failed system interfaces.
When an event involves PHI, we perform the assessment required by applicable law, coordinate with relevant vendors or partners, take corrective action, and provide legally required notice to affected individuals, government agencies, or others. Patients and partners should immediately report suspected incidents through the contact in Section 15.
We take reasonable steps to keep information accurate and complete. When information arrives through multiple channels, authorized staff reconcile duplicates or conflicts and route clinically important information to the appropriate provider. We do not silently overwrite material clinical history. Corrections, amendments, late entries, and interface errors are handled through controlled procedures that preserve required audit history.
We retain medical, billing, operational, communication, call-recording, consent, audit, and partnership records according to applicable law, payer and contractual duties, approved retention schedules, and any legal hold. Different record types may have different retention periods.
At the end of the applicable period, paper and electronic information is securely destroyed or rendered unreadable and unrecoverable using approved methods. Backup copies remain protected and age out according to validated backup schedules. A relationship ending does not automatically require deletion when retention is required for medical, legal, billing, audit, or security purposes.
We handle information about minors and individuals with personal representatives according to applicable consent, custody, authority, confidentiality, and access rules. We may request documentation establishing a representative's authority. In some circumstances, the law may limit a representative's access or give a minor specific privacy rights.
Health Connect Wounds Solutions
EIN: 39-3511785
Privacy Officer: David Cepeda
Mailing address: 1660 W Shaw Ave. Suite 256, Fresno, CA
Telephone: (833) 516-9993
Secure email or request portal: admin@healthconnectmso.com
Please do not send urgent medical information or detailed PHI through a public social-media page or a general website contact form. For a medical emergency, call 911.
Patients may also submit a complaint to the U.S. Department of Health and Human Services Office for Civil Rights. We will not retaliate for a good-faith privacy complaint.
We may update this policy to reflect changes in law, technology, services, vendors, or information practices. The current version will identify its effective date. Material changes will be communicated through an appropriate channel. Changes do not reduce rights already provided by applicable law.
Before publication, Health Connect should complete the following:
Document owner: Health Connect Wounds Solutions
Version: 1.0
Approved: May 31, 2026
Next review: May 31, 2027