Epic Mobile Application Privacy Policy for Patients

Account & Service Control · Context

The policy covers Epic's patient mobile apps, including MyChart for iOS and Android

The policy is about Epic's mobile applications for patients, with MyChart for iOS and Android given as examples. Those apps connect to servers and systems that healthcare organizations using Epic operate and maintain, so that patients can see health information held in those servers and systems on a mobile device. The policy calls these apps 'mobile apps'.

Supporting quotations

Mobile Apps for Patients

Our mobile applications for patients, including MyChart for iOS and Android, connect to servers and systems operated and maintained by healthcare organizations that use Epic – to provide patients with secure, mobile access to health information in those servers and systems.

We refer to our mobile applications for patients as “mobile apps” in this policy.

Qualifications & exceptions

• 'including' makes MyChart for iOS and Android examples, not necessarily the complete list.
• The health information being accessed is described as sitting in servers and systems operated by healthcare organizations, not by Epic.
• The apps connect to systems of healthcare organizations that use Epic; the passage does not say that every healthcare organization or feature is enabled for every patient.

Not stated here

• The passage does not list which other patient mobile apps, if any, are covered.

Account & Service Control · Company practice

If you have a MyChart Central account, Epic stores limited account information on its US servers

For patients who have a MyChart Central account, Epic stores limited personal information on Epic-owned servers in the United States. That information includes name, date of birth, and the contact information used to create the account and link it to the patient's MyChart accounts at their healthcare organizations. Epic uses it to provide MyChart Central services, including helping the patient log in to their MyChart accounts, password recovery and user support.

Supporting quotations

If you have a MyChart Central account, we store limited personal information on Epic-owned servers in the United States.

This information includes your name, date of birth, and the contact information you used to create your account and link it with your MyChart accounts at the healthcare organizations that care for you.

This information is used to provide services or functionality for MyChart Central, including: helping you log into your MyChart accounts at your healthcare organizations, MyChart Central password recovery, and MyChart Central user support.

Qualifications & exceptions

• Applies only to patients with a MyChart Central account.
• Storage is on Epic-owned servers in the United States.
• The information is described as limited, and as including name, date of birth and the contact information used to create and link the account.
• The listed uses are introduced by 'including', so they are examples.

Not stated here

• The passage does not say how long the information is kept while the account is active.
• The list of uses is not stated to be complete.

Cross-references

• qualifies (model-proposed): Epic says it does not receive or store copies of health or fitness data sent to healthcare organizations — The statement that Epic does not receive or store copies of transmitted health or fitness data is narrow. Epic does store limited MyChart Central account information on its own servers, which is a different category of information.

Account & Service Control · User right or choice

You can edit MyChart Central account information and share it with linked healthcare organizations

A patient with a MyChart Central account can edit their MyChart Central account information and share it with the healthcare organizations they have linked to that account.

Supporting quotations

You can edit and share MyChart Central account information with the healthcare organizations you have linked to your MyChart Central account.

Qualifications & exceptions

• Sharing is with healthcare organizations the patient has linked to their MyChart Central account.

Not stated here

• The passage does not say how editing or sharing is done.

Account & Service Control · Context

You need an account with a healthcare organization using Epic's software, and its privacy policy also applies

To use the mobile apps a patient must have an account with a healthcare organization that uses Epic's software. Because of that, the patient's use of the apps is also governed by each of their healthcare organizations' own privacy policies, which are separate from this Epic policy.

Supporting quotations

Your Healthcare Organizations

To use our mobile apps, you must have an account with a healthcare organization using Epic's software.

Because of this, your use of our mobile apps is also subject to each of your healthcare organizations' privacy policies.

Qualifications & exceptions

• Applies to every patient who uses the apps, since an account with a healthcare organization is required.
• The healthcare organizations' privacy policies apply in addition to this policy; they are not part of this document.

Not stated here

• The content of each healthcare organization's privacy policy is not supplied here.