1. Who we are
ComplyWell ("we," "us") is a compliance-monitoring service for hospice, home health, skilled nursing, dialysis and opioid treatment agencies. You can reach us at our contact page.
2. The two kinds of information we handle
a. Business information
When you contact us, request a demonstration, or become a client, we collect your name, work email address, telephone number, agency name, role, and whatever you choose to write in a message. We use this to reply to you, to run the service, and to send you service-related notices. That is all.
b. Protected health information
If your agency becomes a client and signs a Business Associate Agreement with us, we receive patient information from your electronic medical record system in order to monitor compliance requirements. This typically includes a patient identifier, admission and visit dates, ordered disciplines, assigned clinicians, and the status of documentation. Under the Health Insurance Portability and Accountability Act (HIPAA), we are a Business Associate and your agency is the Covered Entity. Your patients' information belongs to your agency, not to us.
3. What we do not do
- We do not sell, rent, or trade any information, ever, to anyone.
- We do not use patient information for advertising, marketing, or product development.
- We do not use patient information to train artificial-intelligence models.
- We do not share patient information with anyone outside the vendors listed below, except where the law requires it.
- We do not run advertising trackers on this website.
4. The companies that help us run the service
We use a small number of established vendors. Any vendor that could come into contact with patient information operates under a Business Associate Agreement with us. Where a required agreement is not in place, patient information does not flow through that vendor.
- Website hosting and security — serves this website. No patient information is ever stored on or served from this website.
- Workflow automation — runs the compliance rules and produces the daily briefs.
- Email delivery — sends notifications to the clinicians and administrators your agency designates.
- Text-message delivery — where your agency has chosen text notifications.
- Document analysis — where your agency has enabled review of documentation text.
5. How long we keep things
- The export your agency sends: not kept. Each file is read, fingerprinted and discarded. The fingerprint proves what the file contained and holds no patient information.
- The findings ledger and the record of briefs sent: the patient identifier, the dates, the rule, the citation, the sentence we sent and the fields from your own export that produced it, kept for as long as your agency is a client.
- Workflow run history: not retained where it contains patient information.
- When your agency leaves: all patient information is deleted within thirty days of the contract ending, and we confirm the deletion to you in writing.
- Deletion on request: your agency may ask us to delete its data at any time. We do it within thirty days.
- Business contact information: kept while we have a relationship with you and for three years afterwards, unless you ask us to remove it sooner.
6. How we protect it
- Encrypted in transit and at rest.
- Accounts are created by ComplyWell for one named person and revoked by us. There is no self-registration and no shared logins.
- Access limited to those who need it to run the service.
- An audit record of every action taken on agency data.
- A documented security risk assessment, reviewed at least annually.
No system is perfectly secure, and we will not claim otherwise. If a breach affecting protected health information occurs, we will notify your agency without unreasonable delay and no later than sixty days after discovering it, as HIPAA requires.
7. Your rights
If you are a patient: your rights under HIPAA — to see your record, to request a correction, to know who it has been shared with — are exercised through the agency that treats you, not through us. We hold your information on their behalf. Please contact your agency directly.
If you are a business contact: you may ask us what we hold about you, ask us to correct it, or ask us to delete it. Write to us through the contact page and we will respond within thirty days.
If you are in California: the California Consumer Privacy Act gives you the right to know, delete, and correct personal information, and the right not to be discriminated against for exercising those rights. We do not sell or share personal information, so there is nothing to opt out of. California's Confidentiality of Medical Information Act also applies to medical information we handle on behalf of California agencies.
8. Cookies
This website uses only what is necessary to serve the pages and keep them secure. We do not use advertising cookies or third-party tracking pixels.
9. Children
This website is intended for health care professionals. We do not knowingly collect information from anyone under eighteen through this website. Patient information we process on behalf of an agency may relate to people of any age and is governed by the agreement with that agency.
10. Changes
If we change this policy we will update the date at the top. If a change materially affects how we handle protected health information, we will notify client agencies directly rather than relying on you noticing.
11. Contact
Questions about this policy, or about how we handle information, go through our contact page.