Privacy Rule
Establishes standards for protected health information, limits certain uses and disclosures, requires privacy safeguards, and gives individuals rights concerning their health information.
HHS Privacy Rule →Health information privacy
HIPAA Rules & Protected Health Information
General guidance for providers, clinics, employees, contractors, and website users about HIPAA, protected health information, and the appropriate use of ISO Metrik Therapy website and support channels.
Important:HIPAA applies based on an organization's legal role and activities. A health care organization, service provider, or website is not automatically a HIPAA covered entity or business associate merely because it handles health-related information.
Federal framework
The major HIPAA rules
The U.S. Department of Health and Human Services (HHS) administers federal standards that protect certain health information when the HIPAA Rules apply.
Security Rule
Requires covered entities and business associates to use appropriate administrative, physical, and technical safeguards for electronic protected health information (ePHI).
HHS Security Rule →Breach Notification Rule
Establishes notification requirements following certain breaches of unsecured PHI and defines responsibilities for covered entities and business associates.
HHS Breach Rule →Covered Entities & Business Associates
HIPAA applies to covered entities and to business associates when the applicable legal definitions and relationships are met. Business associate contracts may be required.
HHS Entity Guidance →What PHI means
Health information becomes PHI when HIPAA applies and it can identify an individual.
Protected health information generally includes individually identifiable health information maintained or transmitted by a HIPAA-regulated covered entity or business associate in a form or context covered by the Rules.
Examples of identifiers that can make health information identifiable
- Patient name or initials when linked to health information.
- Date of birth or other identifying dates.
- Medical record, patient, insurance, or account identifiers.
- Identifiable patient photographs, video, or facial images.
- Contact information linked to diagnosis, treatment, or health status.
ISO Metrik public channels
Do not send PHI through general website functions.
Public shopping, order tracking, contact forms, newsletter subscriptions, and general support channels are not designated for transmission of patient-identifying health information.
Do not submit
- Patient names or patient identifiers.
- Medical records, clinical notes, or treatment plans.
- Identifiable patient photographs or videos.
- Diagnoses linked to an identifiable patient.
- Other PHI or ePHI through ordinary email or general support forms.
Provider & clinic responsibilities
Use the minimum information necessary and the correct channel.
Each provider or clinic remains responsible for determining its own HIPAA status, policies, workforce requirements, and permitted uses and disclosures.
Verify the channel
Use only a workflow expressly approved by your organization for PHI. General web forms and public support channels should contain no PHI.
Limit access
Protect passwords, use authorized accounts, avoid shared credentials, and restrict access to people who need it for their assigned role.
Minimum necessary
When the minimum-necessary standard applies, limit PHI to what is reasonably needed for the permitted purpose.
De-identify when possible
Use non-identifying order, device, account, or technical information whenever patient identity is not required.
Business associate review
When a covered entity uses a business associate to perform functions involving PHI, determine whether a written business associate agreement or other HIPAA arrangement is required.
Report concerns promptly
Follow your organization's incident-response process and notify the appropriate privacy or security contact if PHI may have been sent to the wrong place.
If PHI is sent by mistake
Stop, contain, and report the incident.
01
Stop further transmissionDo not resend, forward, or copy the patient information into another general website or email channel.
02
Follow your organization's policyNotify the privacy, security, or compliance contact required by your employer or clinic.
03
Notify ISO Metrik without repeating the PHIContact info@isometrik.com with the subject “Privacy/Security Incident” and provide non-PHI details needed to identify the website event or message.
04
Preserve relevant non-PHI detailsKeep dates, times, account identifiers, order numbers, and other information needed for investigation without unnecessarily duplicating PHI.
HIPAA questions
Common questions for website users
Is every health-related company automatically covered by HIPAA?
No. HHS states that the HIPAA Rules apply to covered entities and business associates. Whether an organization qualifies depends on the applicable legal definitions, activities, and relationships.
Can I send a patient name with an ISO Metrik order question?
Not through general shopping, tracking, contact, or support channels. Use the order number or non-identifying account information instead.
Can I upload an identifiable patient photo to a general support form?
No. General support functions are not designated for identifiable patient images or other PHI.
Does this page replace my clinic's HIPAA policy?
No. This page provides general information only. Providers and clinics must follow their own HIPAA policies, legal obligations, workforce training, approved systems, and professional requirements.
Where can I review the federal HIPAA rules?
Use the official HHS links on this page for the Privacy Rule, Security Rule, Breach Notification Rule, and covered-entity/business-associate guidance.
Legal and compliance notice
This page is general educational information and does not constitute legal advice, a HIPAA compliance certification, or a representation that a particular ISO Metrik user, clinic, provider, product, portal, or workflow is a covered entity, business associate, or HIPAA-compliant. Organizations should consult qualified privacy, security, compliance, or legal professionals about their specific obligations.
ISO Metrik support
Have a privacy or security question?
For non-PHI privacy or security questions, contact ISO Metrik. Do not include patient-identifying information in an ordinary support message.