HIPAA notice

This website is not a patient portal

Nothing on this site is intended to collect protected health information. Please do not send patient names, medical details, appointment reasons tied to a named patient, or any other PHI through the contact form, the newsletter form, or ordinary email.

If you are a client and need to send us PHI, use the secure channel agreed in your services agreement. If you reach us another way with PHI, we will handle it under the safeguards described below, but the channel itself is not one we can guarantee.

Our role

Tristate Health MSO, LLC is a management services organization. When we perform billing, coding, credentialing, care management or similar work for a medical practice, we act as that practice's business associate under HIPAA.

We handle protected health information only on behalf of a client practice, only for the services that practice has engaged us to perform, and only as permitted by our business associate agreement with them and by law. We do not sell protected health information, and we do not use it for marketing.

Business associate agreements

We enter into a business associate agreement with every client practice before handling protected health information on their behalf.

Where we use a subcontractor that may encounter protected health information in the course of our work, we require that subcontractor to agree to the same restrictions and conditions that apply to us.

Safeguards

We maintain administrative, physical and technical safeguards designed to protect the confidentiality, integrity and availability of protected health information. These include:

• Access limited to the workforce members who need it to do their job, reviewed periodically.
• Encryption of data in transit, and of devices and storage holding protected health information.
• Unique accounts, multi-factor authentication, and prompt removal of access when someone leaves.
• Workforce training on HIPAA and security at onboarding and at least annually.
• Written policies and procedures, and a documented security risk analysis kept current.

If something goes wrong

If we discover a breach of unsecured protected health information, we notify the affected client practice without unreasonable delay and within the timeframe required by HIPAA, and we support that practice in meeting its own notification obligations.

If you are a patient

If you are a patient of a practice we support, your rights over your health information, including access, amendment, restriction and an accounting of disclosures, are described in that practice's own notice of privacy practices.

Please contact your practice directly with any request about your records. As a business associate we act on the practice's instructions, so we will refer your request to them rather than act on it ourselves.

Questions or concerns

Questions about this notice can be sent to info@tristatemso.com or (718) 689-3087, or by post to 155 Willowbrook Blvd, Ste 110 #3408, Wayne, NJ 07470.

You may also file a complaint with the U.S. Department of Health and Human Services, Office for Civil Rights. We will not retaliate against anyone for filing a complaint.