FabrixMed HIPAA Notice and PHI Safeguards Policy

Effective Date: October 22, 2026

This file name is retained for compatibility with existing links. This policy concerns HIPAA and protected health information ("PHI").

FabrixMed Systems LLC ("FabrixMed", "we", "us", or "our") provides healthcare technology infrastructure for ConsultBridge, CareScreen, ClinixBox, HCN, and related services. This policy explains how we handle PHI and how responsibilities are shared among FabrixMed, healthcare organizations, providers, and users.

FabrixMed may use Vertex Management Services LLC ("Vertex") as a designated non-clinical administrative service provider or HIPAA subcontractor for a defined program. Vertex's role, permitted access, safeguards, and incident responsibilities must be established in the applicable BAA, data-processing terms, or signed program agreement. Vertex does not provide medical care or direct independent clinical judgment.

1. HIPAA Roles

FabrixMed is generally a business associate when it creates, receives, maintains, or transmits PHI for a HIPAA covered entity or another business associate. Healthcare providers, health systems, health plans, clinics, and similar organizations usually remain the covered entity or upstream business associate responsible for the patient relationship and medical record.

A signed business associate agreement ("BAA") must be in place before production PHI is submitted to FabrixMed unless another legally valid arrangement applies.

2. Permitted Uses and Disclosures

FabrixMed may use and disclose PHI only as allowed by HIPAA, the applicable BAA, customer instructions, and law. Permitted purposes may include:

  • treatment, payment, and healthcare operations supported by the customer;
  • routing consults, screening records, diagnostic inputs, images, labs, device data, notes, authorizations, referrals, and care coordination tasks;
  • operating, securing, supporting, and maintaining the services;
  • assisting with access, amendment, accounting, restriction, and breach obligations;
  • de-identifying information as permitted by HIPAA and the BAA;
  • complying with legal obligations.

FabrixMed does not sell PHI and does not use PHI for targeted advertising.

3. Safeguards

FabrixMed maintains administrative, technical, and physical safeguards designed to protect PHI. These may include workforce training, access controls, role-based permissions, encryption where appropriate, audit logs, vendor review, incident response procedures, secure backups, and policies for handling sensitive data.

Customers remain responsible for their own safeguards, including user access decisions, device security, EHR configuration, local downloads, printed records, patient communications, and workforce compliance.

4. Customer and User Responsibilities

Customers and users must:

  • use FabrixMed only for authorized healthcare workflows;
  • submit only the minimum necessary PHI;
  • obtain required patient consents, telehealth consents, authorizations, and notices;
  • maintain appropriate medical records outside FabrixMed when required;
  • promptly remove users who should no longer have access;
  • avoid sending PHI through public forms, ordinary email, or support channels not intended for PHI;
  • report suspected privacy or security incidents promptly.

5. Subcontractors and Vendors

FabrixMed may use subcontractors and vendors to provide hosting, video, communications, support, payment, analytics, security, and operational services. When a vendor handles PHI for FabrixMed, FabrixMed requires appropriate contractual protections, including a BAA when required.

This may include Vertex when Vertex performs an authorized workflow involving PHI on FabrixMed's behalf. Vertex is not authorized to access PHI merely because it is a related company. Access must be tied to an assigned workflow, documented role, and minimum-necessary purpose.

6. Patient Rights

Patients should normally exercise HIPAA rights through the healthcare provider, clinic, health plan, or organization responsible for their care. FabrixMed assists covered entities with access, amendment, accounting of disclosures, restriction, confidential communication, and related requests as required by the applicable BAA and law.

7. Breach Notification

FabrixMed investigates suspected privacy or security incidents involving PHI. If an incident is a reportable breach under HIPAA or another applicable law, FabrixMed will notify the affected covered entity or business associate as required by the BAA and law. Covered entities are usually responsible for patient and regulator notifications unless the BAA says otherwise.

8. De-Identified and Aggregated Data

FabrixMed may use de-identified or aggregated information to maintain, analyze, benchmark, secure, and improve the services, only as permitted by HIPAA, the BAA, and applicable law.

9. Contact

HIPAA and compliance questions can be sent to [email protected].