HIPAA / PHI Handling Notice

1. SMEG's role under HIPAA

When a Covered Entity signs a BAA and approved service scope with SMEG, SMEG may act as a Business Associate as defined at 45 CFR §160.103. Until those documents are executed, public demos and worksheets are non-PHI only.

Before any PHI is transmitted to SMEG, SMEG executes a Business Associate Agreement with the Covered Entity. SMEG's BAA template is available at /legal/baa and is materially modeled on the HHS Office for Civil Rights sample provisions.

2. Administrative safeguards (§164.308)

Before PHI is accepted, SMEG requires an administrative-safeguards plan covering:

• Security Management Process. Risk analysis and risk-management planning for the specific intake/storage/review workflow.
• Workforce Security & Training. Role-based access authorization and HIPAA training for any workforce member with PHI access.
• Access Authorization & Modification. Documented authorization workflow for granting, modifying, and terminating PHI access.
• Security Incident Procedures. Written incident-response workflow with notification timelines and evidence-preservation steps.
• Contingency Plan. Backup, disaster-recovery, and retention plan appropriate to the approved storage vendor and pilot scope.
• Business Associate Contracts. Downstream BAAs or equivalent required agreements for any vendor that creates, receives, maintains, or transmits PHI.

3. Physical safeguards

PHI-enabled processing must occur only through an approved cloud/storage workflow with appropriate contractual safeguards. Public website/demo infrastructure is not an approved PHI intake path.

4. Proposed technical safeguards (§164.312)

These are prerequisites to be implemented, tested, and approved for a future workflow, not a statement that production PHI controls are complete.

• Access Control (§164.312(a)). Unique user identification, automatic logoff, role-based access. No shared accounts.
• Audit Controls (§164.312(b)). Access-event logging, integrity protections, and retention periods must be specified and verified in security and counsel review.
• Integrity (§164.312(c)). Tamper-evident hashing on stored PHI; integrity validated on retrieval.
• Person or Entity Authentication (§164.312(d)). Multi-factor authentication required for all administrative and clinical-reviewer accounts.
• Transmission Security (§164.312(e)). TLS 1.2 minimum (TLS 1.3 preferred) for all PHI in transit. AES-256 encryption at rest.

5. Organizational requirements (§164.314)

Any subcontractor that creates, receives, maintains, or transmits PHI on SMEG's behalf must be approved in the pilot/service scope and bound by appropriate written terms before PHI is exchanged.

6. Breach notification

In the event of a Breach of Unsecured PHI, SMEG will notify the affected Covered Entity without unreasonable delay and in no case later than sixty (60) days after discovery, in accordance with 45 CFR §164.410. Notification will include a description of what happened, the types of PHI involved, the steps Individuals should take to protect themselves, what SMEG is doing to investigate and mitigate harm, and contact information for follow-up.

7. PHI in machine learning

Public demonstrations use synthetic information only. This page does not claim that model training or clinical validation has been completed. Demonstration and reference materials are limited to:

• Fabricated clinical scenarios, not patient-derived notes.
• Publicly available regulatory corpora — CMS Pub. 100-02, CMS Transmittals and therapy-services updates (e.g., CY2026 KX threshold guidance), OIG audit reports, MAC Local Coverage Determinations.

Any AI/vendor processing involving PHI must be approved in writing first. Public demos and sample reports use synthetic or fake data only.

8. PHI retention & deletion

No real-record intake is available today. Before any future intake, the facility and SMEG must approve a retention, return, deletion, backup, and verification plan. Counsel must determine applicable record and documentation-retention requirements; this notice does not establish a blanket access-log retention period.

9. Patient rights

Patients ("Individuals" in HIPAA terminology) exercise their HIPAA rights — access, amendment, accounting of disclosures, restriction requests — through their Covered Entity, not directly with SMEG. SMEG supports its Covered Entity customers in fulfilling these rights within the timelines set by the Privacy Rule and the executed BAA.

10. Reporting a concern

If you believe SMEG has used or disclosed PHI in violation of HIPAA or this Notice, contact us:

• Email: smeg@suprememedicalevaluationgroup.com (subject line: "HIPAA concern")
• Phone: (818) 468-4099

You may also file a complaint with the U.S. Department of Health & Human Services, Office for Civil Rights, at hhs.gov/hipaa/filing-a-complaint. SMEG will not retaliate against any person for filing a complaint.

Regulatory references

• 45 CFR §164.308 — Administrative safeguards.
• 45 CFR §164.310 — Physical safeguards.
• 45 CFR §164.312 — Technical safeguards.
• 45 CFR §164.314 — Organizational requirements (Business Associate contracts).
• 45 CFR §164.402, §164.404, §164.410 — Breach notification.
• 45 CFR §164.514(b) — De-identification standards.
• 45 CFR §164.530(j) — Documentation retention (six years).