Epic says it does not receive or store copies of health or fitness data sent to healthcare organizations
Epic states that it does not receive or store copies of health or fitness data that a patient transmits to their healthcare organizations using the mobile apps. This is a narrow statement about that transmitted health and fitness data. It is not a statement that Epic holds no information at all: the policy elsewhere says Epic stores limited MyChart Central account information on its own servers, collects limited technical and security information, and may keep a record if you contact Epic.
Supporting quotations
We do not receive or store copies of any health or fitness data that you transmit to your healthcare organizations using our mobile apps.
we store limited personal information on Epic-owned servers in the United States
Qualifications & exceptions
Limited to health or fitness data the patient transmits to their healthcare organizations using the mobile apps.
For patients with a MyChart Central account, the policy says Epic stores limited personal information on Epic-owned servers in the United States; that is a different category of information from the transmitted health and fitness data.
Not stated here
The sentence does not say how it applies to health information other than data the patient transmits to a healthcare organization.
Retention & Deletion · Company practice
Viewing documents stores temporary copies on your device until you close your session
When a patient views documents from their healthcare organization in the apps, such as letters or images, temporary copies are stored on the device in app-private storage so the files can be viewed. The copies are deleted when the patient closes their session in the apps.
Supporting quotations
When you view documents from your healthcare organization (such as letters or images) using our mobile apps, to make the files viewable for you temporary copies are stored on your device in app-private storage.
The temporary copies are deleted when you close your session on our mobile apps.
Qualifications & exceptions
Applies to documents the patient views from their healthcare organization.
Storage is on the patient's device, in app-private storage.
Deletion is tied to closing the session, a more specific trigger than the general 'regularly deleted' wording elsewhere in the list.
Not stated here
The passage does not say what happens if a session ends without being closed.
Temporary files from the interactions above are regularly deleted and removed on uninstall
Epic says any temporary files created during the interactions listed above are regularly deleted and are also deleted if the apps are uninstalled. This general rule sits alongside more specific triggers in individual items, such as deletion when a session is closed.
Supporting quotations
Any temporary files created during the interactions described above are regularly deleted, and are also deleted if you uninstall our mobile apps.
Qualifications & exceptions
Covers temporary files from the interactions described above it in the list.
The MyChart Central account information in the following item is stored on Epic-owned servers and is described separately; it is not a temporary file on the device.
Not stated here
'Regularly' is not tied to a stated interval.
Retention & Deletion · User right or choice
Deactivating your MyChart Central account deletes the information used to create it, on a periodic schedule
A patient who wants Epic to delete the information used to create their MyChart Central account can do so through the Account Deactivation page within MyChart Central. After the request is submitted, an automatic deletion process that runs periodically, typically once per day, deletes the account information. This deletion applies only to the information used to create the MyChart Central account. For guidance on deleting health data viewable within MyChart, the policy points to its section titled 'Your Healthcare Organizations'.
Supporting quotations
If you need to delete the information used by Epic to create your MyChart Central account, you can do so via the “Account Deactivation” page within MyChart Central.
Once you submit an account deactivation request, your account information will be deleted via an automatic deletion process that runs periodically (typically once per day).
The deletion only applies to the information used to create your MyChart Central account; for guidance on deleting health data viewable within MyChart, see "Your Healthcare Organizations" below.
Your Healthcare Organizations
Qualifications & exceptions
Deletion is requested through the Account Deactivation page within MyChart Central.
The deletion process runs periodically and 'typically' once per day, so it is not described as immediate.
The deletion applies only to the information used to create the MyChart Central account, not to health data viewable within MyChart.
Not stated here
The passage does not say whether the technical and security data described in later sections is affected by an account deactivation request.
The passage does not say whether copies in backups or logs are removed.
Epic says it has a legitimate interest in collecting and retaining the server data for security
Epic states that it has a legitimate interest in collecting, processing and retaining this server-collected data to support its information security operations, to prevent unauthorized access to or misuse of its systems and to prevent cybersecurity incidents. The sentence names security as the reason and also says the data is retained.
Supporting quotations
Epic has a legitimate interest in collecting, processing, and retaining this data in support of its information security operations to prevent unauthorized access to or misuse of our systems and to prevent cybersecurity incidents.
Qualifications & exceptions
'This data' refers to the list of automatically collected server information immediately above it.
The stated reasons are security operations and preventing unauthorized access, misuse and cybersecurity incidents.
Not stated here
No retention period is given.
Retention & Deletion · Company commitment
Epic has internal retention and deletion policies meant to keep only the information described in the policy
Epic says it maintains internal data retention and deletion policies to help it store only the information about use of the mobile apps that this policy describes. The sentence is a general commitment; it does not give retention periods, and the specific deletion timings in the policy are the ones described for individual items, such as MyChart Central account deletion.
Supporting quotations
Additional Steps We Take At Epic
At Epic, we maintain internal data retention and deletion policies to help us ensure we only store information about your use of our mobile apps as described above in this policy.
we store limited personal information on Epic-owned servers in the United States
Qualifications & exceptions
The wording is 'to help us ensure', not an absolute guarantee.
'As described above' ties the commitment to the information described in earlier sections, including the limited MyChart Central account information stored on Epic-owned servers.
Not stated here
No retention periods are given in this sentence; the internal policies themselves are not supplied.