eClinicalWorks Terms of Use Agreement

Use & Processing · Company commitment

eCW complies with business-associate privacy laws for PHI in the Services

Certain Services eCW provides to Provider customers, or makes available to their patients, involve access to and processing of PHI provided under the Customer Documents eCW has with those Provider customers. For its operation of the Services, and to the extent required by HIPAA and its implementing regulations, HITECH and its regulations, and any applicable laws governing collection, use, storage and disclosure of identifiable information including biometric data such as fingerprints or facial geometry scans (together the Privacy Laws), eCW will, subject to the Customer Documents, comply with the Privacy Laws applicable to business associates and maintain the confidentiality of PHI transmitted or made available through the Services or Affiliated Services. The commitment is framed by three limits: it applies to Services involving PHI, it runs to the extent the Privacy Laws require, and it is subject to the Customer Documents with each Provider.

Supporting quotations

7. Compliance with Laws; Transmission of Data

Certain Services that eCW provides to our Provider customers or make available to their patients involve access to, and the processing of, PHI (defined below) that is provided to us pursuant to the Customer Documents that we have entered with our Provider customers.

With respect to its operation of the Services, and to the extent required by (A) the Health Insurance Portability and Accountability Act of 1996, as amended, and its implementing regulations ("HIPAA"), (B) the Health Information Technology for Economic and Clinical Health Act ("HITECH") and any regulations promulgated thereunder, and (C) any applicable laws governing the collection, use, storage, and disclosure of information that can reasonably be used to identify an individual, including without limitation biometric data such as fingerprints or facial geometry scans (collectively, the "Privacy Laws"), eCW will, subject to the Customer Documents, comply with the Privacy Laws applicable to business associates and maintain the confidentiality of any Protected Health Information which is individually identifiable health information that is protected by HIPAA ("PHI") transmitted or made available through the functionality of the Services or the Affiliated Services.

Qualifications & exceptions

• Applies to Services that involve access to and processing of PHI for Provider customers or their patients
• Runs to the extent required by HIPAA, HITECH and other applicable Privacy Laws
• Subject to the Customer Documents eCW has entered with Provider customers
• The Privacy Laws definition includes laws governing biometric data such as fingerprints and facial geometry scans

Not stated here

• The source does not describe breach notification, retention periods or subcontractor terms, which the Customer Documents may contain

Use & Processing · Context

A patient's PHI is governed by HIPAA and the documents with their Provider

For a user who is a patient of a Provider, eCW states that its use of PHI is governed by HIPAA and other Applicable Laws and by the Customer Documents with that Provider. The sentence directs the patient to the Provider relationship rather than to these Terms for the handling of their health information, and it does not itself grant the patient rights or describe how to exercise them.

Supporting quotations

If you are a patient of a Provider, our use of PHI is governed by HIPAA and other Applicable Laws and the Customer Documents with your Provider.

Qualifications & exceptions

• Applies where the user is a patient of a Provider
• Governed by HIPAA, other Applicable Laws and the Customer Documents with that Provider

Not stated here

• The source does not describe how a patient obtains or reviews the Customer Documents or exercises rights under them

Use & Processing · Restriction or exception

Providers, not eCW, must obtain biometric-data consents

Providers who collect, store, use, disclose or retain biometric data in connection with their use of the Services are responsible for obtaining the required consents and for satisfying any other requirements of Applicable Laws for that collection, storage, usage, disclosure and retention. The duty is assigned to Providers for biometric data specifically, which pairs with the Privacy Laws definition in the same section that names fingerprints and facial geometry scans.

Supporting quotations

Providers who collect, store, use, disclose, or retain biometric data in connection with their use of the Services shall be responsible for obtaining required consents and satisfying any other requirements of Applicable Laws with respect to collection, storage, usage, disclosure, and retention of such information.

Qualifications & exceptions

• The duty applies to Providers using the Services, not to eCW
• It covers consents and other Applicable Laws requirements
• It reaches collection, storage, usage, disclosure and retention of biometric data

Not stated here

• The source does not describe how eCW verifies that a Provider obtained those consents