Recorded template baseline: September 18, 2024. Historical bundle release: July 9, 2026. Actual agreement and notice dates depend on execution or adoption. This resource does not establish operational compliance.
Healthcare Privacy Policy
Template and counsel-review notice. This document is a website/app integration template, not a legal opinion. Before publication, replace bracketed placeholders, confirm actual data flows, obtain advice from qualified counsel for each jurisdiction and regulated workflow, and approve final wording through privacy, security, product, marketing, health/clinical, and executive stakeholders. Do not promise controls, certifications, response times, retention periods, or legal rights unless they are actually implemented and operationally supported.
Recorded template baseline: September 18, 2024
Last updated: September 30, 2026
Organization: NEXQ Inc.
Services covered: NEXQ websites, web applications,
protected workspace surfaces, mobile app surfaces, APIs, secure
healthcare and healthtech workflow demonstrations, security and
post-quantum readiness planning, diagnostics-workflow support concepts,
oncology workflow research, cardiovascular longevity research, research
collaboration, support, and related services
Privacy contact: hello@nexq.us
Security contact: hello@nexq.us
Mailing address: Irvine, CA, United States — contact hello@nexq.us for legal notices
1. Scope
This policy applies when the organization creates, receives, maintains, or transmits protected health information (PHI/ePHI) as a HIPAA covered entity, business associate, subcontractor, technology vendor, hospital service provider, telehealth vendor, patient portal operator, or healthcare integration provider. It also includes guardrails for non-HIPAA consumer health data.
2. HIPAA baseline
Where HIPAA applies, implement Privacy Rule, Security Rule, and Breach Notification Rule obligations through written policies, workforce training, access controls, audit logs, encryption, device/media controls, business associate agreements, minimum necessary practices, individual-rights workflows, sanctions, and incident response.
3. Business associate and subcontractor controls
Before receiving PHI/ePHI, document the parties’ roles and lawful basis for the data flow. Where HIPAA requires a business associate arrangement, execute a HIPAA-compliant written Business Associate Agreement or another arrangement expressly permitted by HIPAA. Customer approval alone cannot waive required terms. Business-associate subcontractors must accept the required written restrictions and safeguards. Contracts must address applicable permitted uses/disclosures, safeguards, breach reporting, access/amendment/accounting support, return/destruction, HHS access, and termination. A BAA alone does not authorize independent research. See HHS business associate contract guidance.
4. 42 CFR Part 2 and substance-use-disorder information
Determine whether records are protected by 42 CFR Part 2 based on their source and applicable rules; substance-use information is not automatically a Part 2 record. The applicable requirements of the 2024 Part 2 final rule had a compliance date of February 16, 2026. Document the applicable patient notice, consent, redisclosure, complaint and breach-reporting procedures before handling those records. Specific consent and legal-process restrictions require separate review, including for SUD counseling notes and proceedings against a patient. The new Part 2 accounting-of-disclosures requirement has a deferred compliance trigger and must not be described as already due solely because of that date. Treat SUD-related data as highly sensitive and route disclosures, subpoenas, and law-enforcement requests to legal. See HHS Part 2 guidance.
5. Reproductive health information
Requests for reproductive health information require special scrutiny. As of September 30, 2026, HHS reports that the June 18, 2025 order in Purl v. HHS vacated most of the 2024 reproductive-health rule, including its special attestation regime. Do not present those vacated provisions as current federal requirements. Apply remaining HIPAA duties and independently applicable state protections; document the current legal basis for any required attestation or disclosure restriction. Do not disclose information for an unlawful purpose or act on an ambiguous third-party request without legal review.
6. Online tracking technologies
Healthcare websites, portals, mobile apps, scheduling pages, symptom pages, condition pages, billing pages, and patient communications must not deploy advertising trackers, retargeting tags, unapproved analytics, or session replay unless privacy/security/legal review concludes the use is lawful and contractually permitted. HHS tracking-technology guidance and related litigation should be reviewed before deployment.
7. FTC Health Breach Notification Rule and consumer health data
Health apps, connected devices, wellness services, and other non-HIPAA health services may be regulated by the FTC Health Breach Notification Rule and state consumer-health-data laws. Maintain incident criteria for unauthorized acquisition, disclosure, or access involving identifiable health information.
8. Minimum necessary and access controls
PHI/ePHI access must be role-based, logged, and reviewed. Apply HIPAA’s minimum-necessary standard where it applies, recognizing its exceptions, including disclosures to or requests by a healthcare provider for treatment; stricter contractual safeguards may also apply. Use MFA for privileged and remote access, encrypt ePHI in transit and at rest where appropriate, segregate tenant/customer data, and conduct periodic access reviews.
9. Individual rights and patient requests
Support access, amendment, accounting, restriction, confidential communications, and privacy complaint workflows where applicable. Coordinate with the covered entity customer when operating as a business associate.
10. Breach and incident response
Escalate suspected incidents immediately. Determine whether HIPAA, Part 2, FTC Health Breach Notification Rule, state breach laws, state consumer-health-data laws, app-store notices, customer contracts, OCR/FTC/state AG notice, or media notice obligations apply.