I. Purpose

As a business associate of covered entities, BEESY, LLC is legally required to comply with HIPAA regulations when handling Protected Health Information (PHI). As part of business practices related to market research, BEESY may receive Protected Health Information or collect, use, or maintain PHI on behalf of covered entities. PHI is confidential information specific to individual patients. BEESY is accountable and responsible for PHI under its control. As such, BEESY will comply with the requirements of the Health Insurance Portability and Accountability Act of 1996 and its implementing regulations (the “Privacy Rule”, 45 C.F.R. Parts 160-64), when handling PHI as required by law.

II. Definitions

A. Business Associate. “Business Associate” shall mean BEESY, LLC and shall also have the meaning given to such term under the Privacy Rule, including 45 C.F.R. § 160.103.
B. Covered Entity. “Covered Entity” shall mean any BEESY, LLC client(s) and shall also have the meaning given to such term under the Privacy Rule, including 45 C.F.R. § 160.103.
C. Third-Party. “Third-Party” shall mean any vendor or subcontractor to BEESY, LLC.
D. Privacy Rule. “Privacy Rule” shall mean the Standards for Privacy of Individually Identifiable Health Information at 45CFR Part 160 and Part 164, Subparts A and E.
E. Protected Health Information. “Protected Health Information “shall have the same meaning as the term “protected health information” in 45CFR160.103, limited to the information created or received by Business Associate from or on behalf of Covered Entity.
F. Required by Law. “Required by Law” shall have the same meaning as the term “required by law” in 45CFR164.103.

III. Use and Disclosure of Medical Information

Your health information may be used and disclosed by BEESY, LLC for market research needs.
BEESY and its representatives may collect and use your information for the following purposes:

• Determining your eligibility to participate
• Clarifying your responses in surveys or interviews
• Conducting research

Only information that you provide to BEESY, LLC may be used and disclosed. BEESY, LLC will have no other health information or means to access your health information.

How We Collect Information About You: When collecting personal information from you, BEESY will explain the purpose of collecting the information and will answer any questions you may have. BEESY, LLC and its employees collect data through a variety of means including but not necessarily limited to
surveys, phone and in person interviews. Some of your information may be collected from other sources such as third-party recruitment firms.

What We Do Not Do With Your Information: We disclose only aggregate survey responses to our customers. We may share de-identified information with our clients; however, patient confidentiality is protected. We do not disclose protected health information about you to our clients without your prior written consent.

A. Types of Protected Health Information Collected:
Survey and interview data of patients may include Protected Health Information (PHI). PHI is personally identifiable health information in any form, including orally, written and electronically. BEESY will obtain your consent to collect, use or disclose protected health information.

PHI includes the 18 unique identifiers:

• • Name;
  • Specific dates—birth, admission, discharge, death;
  • Telephone numbers;
  • Social security number(s);
  • Medical record number;
  • Photographs;
  • City, zip code, and other geographic identifiers;
  • Fax numbers;
  • Electronic mail addresses;
  • Health plan beneficiary numbers;
  • Account numbers;
  • Certificate/license numbers;
  • Vehicle identifiers and serial numbers, including license plate numbers;
  • Device identifiers and serial numbers;
  • Web Universal Resource Locators (URLs);
  • Internet Protocol (IP)address numbers;
  • Biometric identifiers, including finger, retinal and voiceprints; and
  • Any other unique identifying number, characteristic or code.

B. Sources of PHI Collected

a. Quantitative Market Research Studies

BEESY, LLC receives data files from programmers that may provide the following
information:

• • • Randomly generated IDs
    • Zip code, state, or another regional identifier
    • Dates of importance including hospitalization and treatment dates

The PHI would be subject to appropriate safeguards and proper retention and disposal procedures defined below.

b. Qualitative Market Research Studies

BEESY receives data drawn from questionnaires and interviews that may include the following information:

• • • Names, including abbreviations and initials
    • Dates of importance including hospitalization and treatment dates
    • Address or location by state
    • Photographs, or video on occasion

Information collected from patients through qualitative market research studies maybe considered PHI if included in categories as described in Section III A. Information provided by medical professionals and their associates are not subject to HIPAA regulations, unless the professional mentions a patient by a specific identifier listed in Section III A.

Obligations of BEESY, LLC Use of PHI

A. BEESY, LLC will not use or disclose PHI other than as permitted or required by the Privacy Policy or as required by law.

B. BEESY will use appropriate safeguards to prevent use or disclosure of the PHI other than as provided for by this Policy.

C. BEESY, LLC will report to Covered Entity any use or disclosure of the PHI not provided for by this Policy of which it becomes aware.

D. BEESY, LLC will ensure that any agent, including a subcontractor, that receives PHI on behalf of, or created or received by BEESY, LLC, on behalf of Covered Entity, agrees to the same restrictions and conditions that apply through this Privacy Policy to BEESY, LLC with respect to such information.

E. BEESY, LLC will establish internal practices, books, and records, including policies and procedures, relating to the use and disclosure of PHI created or received by BEESY, LLC on behalf of the Covered Entity and will make them available to the Covered Entity or to the Department of Health and Human Services, in a timely manner or as designated by the Department of Health and Human Services, for purposes of the Department determining Covered Entity’s compliance with the Privacy Rule.

F. BEESY, LLC agrees to document any disclosures of PHI and information related to these disclosures as would be required for Covered Entity to respond to a request by an Individual for an accounting of disclosures of PHI in accordance with guidance provided in 45 C.F.R. § 164.528.

G. BEESY, LLC agrees to provide to Covered Entity or an Individual, in a timely manner information collected to permit Covered Entity to respond to a request by an Individual for an accounting of disclosures of PHI in accordance with guidance provided in 45 C.F.R. § 164.528.

V. Compliance Activities for Securing PHI

BEESY, LLC will use appropriate safeguards to prevent use or disclosure or the PHI other than as defined in this Privacy Policy. These safeguards are described below:

A. Privacy

a. BEESY, LLC will remove all identifiers classified as PHI as described in Section III. A from items sent to clients such as transcripts, audio files, surveys, and email.

b. BEESY, LLC employees will remove all identifiers classified as PHI as described in Section III. A from written and electronic records whenever possible.

c. All employees of BEESY, LLC have received Notice of this Privacy Policy and agreed to comply with all applicable measures described in this Privacy Policy.

d. This Privacy Policy is publicly available in BEESY, LLC office.

B. Security

a. Administrative Safeguards

1. 1. 1. BEESY, LLC has designated a privacy officer who is responsible for developing, implementing and enforcing all required policies and procedures.
      2. Access to electronic PHI (EPHI) is restricted to only those employees who require PHI to complete their job function.
      3. BEESY, LLC provides appropriate ongoing training regarding the handling of PHI to employees who require PHI to complete their job function.
      4. Any Third Party utilized by BEESY, LLC must consent to a Non-Disclosure Agreement (NDA) that complies with HIPAA regulations as defined in this Privacy Policy.
      5. Contracted employees receive confidentiality and privacy policy training and agree to comply with the BEESY, LLC Privacy Policy.

b. Physical Safeguards

1. 1. 1. Electronic hardware and software are introduced to and removed from BEESY, LLC networks under controls that ensure that PHI is not compromised.
      2. Secure access to equipment, hardware and software containing PHI is controlled and monitored with access restricted to employees who require PHI to complete their job function.
      3. Workstations and monitors are secure and removed from high traffic areas and direct view of the public.

c. Technical Safeguards

1. 1. 1. Information systems housing PHI are protected from intrusion. BEESY, LLC secures all physical and digital information to prevent unauthorized alterations or destruction of data.
      2. BEESY, LLC employees use a secured network connection. Encryption is used when information is transmitted over open networks. Information-storing systems are secured.

C. Retention and Disposal of Data Containing PHI upon Termination of Contract

a. Upon termination of the contract with the Covered Entity for any reason, BEESY, LLC will comply with any and all disclosed Covered Entity (client) policies and procedures concerning retention and disposal of data that contains PHI (if PHI obtained from Covered entity).

b. If no such policies and procedures exist or are not disclosed to BEESY, LLC prior to termination of the contract, BEESY, LLC will defer to the Marketing Research Association Best Practice Guidelines on HIPAA.

c. Where feasible, upon termination of the contract between BEESY, LLC and the Covered Entity, BEESY, LLC will destroy all PHI received on behalf of the Covered Entity.

d. If it is infeasible to return or destroy PHI, protections are extended to such information, in accordance with the following termination provisions.

e. If BEESY, LLC determines that returning or destroying the PHI is not feasible, BEESY, LLC shall provide to Covered Entity notification of the conditions that make return or destruction not feasible. Upon agreement that return or destruction of PHI is infeasible, BEESY shall extend the protections of this Privacy Policy to such PHI and limit further uses and disclosures of such PHI to those purposes that make the return or destruction infeasible, for so long as BEESY, LLC maintains such PHI.

VI. Obligations of Covered Entity or Third-Party Receiving from and Providing PHI to BEESY, LLC

a. Covered Entity or Third-Party shall notify BEESY, LLC of any limitation(s) in its notice of privacy practices of Covered Entity in accordance with 45CFR164.520, to the extent that such limitation may affect BEESY, LLC’s use or disclosure of PHI.

b. Covered Entity or Third-Party shall notify BEESY, LLC of any changes in, or revocation of, permission by Individual to use or disclose PHI, to the extent that such changes may affect BEESY, LLC’s use or disclosure of PHI.

c. Covered Entity or Third-Party shall notify BEESY, LLC of any restriction to the use or disclosure of PHI that Covered Entity has agreed to in accordance with 45CFR164.522, to the extent that such restriction may affect BEESY’s use or disclosure of PHI.

VII. Permissible Uses and Disclosures of Information

a. Any information designated as Confidential Information as defined in Section 1 in the “Agreement on Confidential Information, Ownership of Work, Possession of BEESY Property, Conflicts of Interest, and Non Solicitation with BEESY, LLC” is considered secret or confidential until BEESY, LLC discloses it or it comes in to the public domain in some other lawful manner.

b. The same restrictions described in the “Agreement on Confidential Information, Ownership of Work, Possession of BEESY Property, Conflicts of Interest, and Non- Solicitation with BEESY, LLC” apply to Confidential Information belonging to Covered Entity.

c. The restrictions contained in the “Agreement on Confidential Information, Ownership of Work, Possession of BEESY Property, Conflicts of Interest, and Non Solicitation with BEESY, LLC” pertain to all BEESY, LLC Confidential Information, regardless of whether such Confidential Information was developed before or after the effective date of this Privacy Policy and whether or not the same was conceived, originated, discovered, or developed, in whole or in part, by the Individual.

d. Any Covered Entity or any Third-Party contracted by BEESY, LLC shall not request BEESY, LLC to use or disclose PHI in any manner that would not be permissible under the Privacy Rule if used or disclosed in the same manner by Covered Entity or Third-Party.

e. Except as limited in the preceding provisions in this section, BEESY, LLC may use or disclose PHI to perform functions, activities, or services for, or on behalf of, Covered Entity as specified in the contract between BEESY, LLC and the Covered Entity, provided that such use or disclosure of PHI would not violate the Privacy Rule if done by Covered Entity or the minimum necessary policies and procedures of the Covered Entity.

VIII. Health Information Rights

Right to Inspect and Copy: You have the right to see and have a copy of the health information that BEESY, LLC has about you.

Right to Request an Amendment: If you feel the health information we have about you is wrong or incomplete, you may ask us in writing to fix the information. We may say no to your request if it is not in writing and it does not include a reason, or the information was not created by us, or the information is determined to be correct and complete.

Right to Request Restrictions: You have the right to ask us to either not disclose or partially disclose your health care information.

Right to Request Confidential Communication: You have the right to ask that we talk with you about health care matters in a certain way or at a certain place. For example, you can ask that we only contact you at work or by email. BEESY, LLC will work to meet all reasonable requests.

Right to a Paper Copy of this Notice: You have the right to ask for a paper copy of this notice. If you have any questions or would like to use these rights, a request for inspecting, copying, amending, making restrictions, or obtaining an accounting of your health information must be made in writing to:

Vanja Dragutinovic
[email protected]
BEESY, LLC
68 Beekman Road
Summit, NJ 07901