HIPAA compliance & security

PragmaHealth LLC, licensing and operating OmniH (“OmniH,” “we,” “us,” or “our”), supports HIPAA-aligned handling of Protected Health Information (“PHI”) for eligible United States practitioners, laboratory partners, and related workflows where OmniH acts as a Business Associate under the Health Insurance Portability and Accountability Act of 1996 and its implementing regulations (“HIPAA”).

We are committed to keeping PHI that we receive from or on behalf of our covered-entity customers private and secure. Workforce members who access OmniH systems that may contain PHI are required to follow confidentiality obligations and receive HIPAA-related training appropriate to their role.

For U.S. covered-entity customers that require it, OmniH enters into a Business Associate Agreement (BAA) describing permitted uses and disclosures of PHI, safeguard expectations, and breach-notification duties. When we process PHI on behalf of a covered entity, that customer’s notice of privacy practices may also apply to how your provider uses and discloses health information.

OmniH is a technology platform for diagnostic coordination and laboratory workflows. We do not practice medicine. Clinical judgment remains with ordering Practitioners; analytical validity and result release remain with Lab Facilities.

OmniH is committed to protecting PHI and other sensitive personal information, and to keeping systems and procedures current with applicable requirements. In particular, we work to:

• Maintain administrative, technical, and physical safeguards aimed at preventing unauthorized access to PHI.
• Encrypt PHI in transit (TLS) and at rest (industry-standard encryption such as AES-256) for Platform systems under our control.
• Operate a secure environment for PHI through access controls, authentication, logging, and least-privilege roles.
• Limit workforce access to PHI to what is needed for assigned duties.
• Require confidentiality commitments from personnel who may access PHI.
• Provide HIPAA-related training to relevant employees and contractors.
• Assess vendors that process PHI on our behalf under contractual security and privacy expectations.

Examples of controls we apply on OmniH systems include:

• Role-based access for Practitioners, Lab Facilities, patients, and staff.
• Encryption in transit and at rest for production data stores that hold PHI.
• Audit logging of sensitive administrative and clinical workflow actions where implemented.
• Secure development and change practices for Platform releases.
• Incident response processes for suspected unauthorized access or breach involving PHI.

Customers remain responsible for their own HIPAA obligations as covered entities or business associates, including workforce training at their sites, device security for endpoints they control, timely user deprovisioning, and clinical or laboratory policies. Facility partners also acknowledge shared safeguards in OmniH security acknowledgment documents where those apply.

Where OmniH holds PHI subject to HIPAA on behalf of a covered entity, individuals may have rights under HIPAA and their provider’s policies, including requests for access, certain restrictions, and breach notification. Many requests should start with your Practitioner or Lab Facility. You may also contact us as described below, and we will route or support the request as the BAA and Law require.

• Right to request an electronic copy of applicable health records held in OmniH for your care relationship.
• Right to request certain restrictions on uses and disclosures (subject to Law and your provider’s policies).
• Right to receive notice of a breach affecting your PHI when notification is required.

OmniH also serves diagnostic workflows in Ghana and Users in the United Kingdom and other countries. Those activities are governed by applicable local privacy and health-data Laws (and our Privacy Policy), which may differ from HIPAA. HIPAA commitments in this page apply to eligible U.S. PHI workflows described above.

Questions about this HIPAA compliance and security policy may be sent to legal@omnih.health. Security concerns can also be reported through omnih.health/security. General support: careteam@omnih.health or omnih.health/contact.