Confidentiality and Security Agreement (“Agreement”)
I understand that the business entity (“RSMD”) in which or for whom I work, volunteer, receive training, provide services, or with whom I have an active Service Agreement; or with whom the entity (e.g.,
physician practice) for which I work has a relationship (contractual or otherwise) involving the exchange of health information, has a legal and ethical responsibility to safeguard the privacy of all patients and to protect the confidentiality of their patients’ health information. Additionally, RSMD must assure the
confidentiality of its human resources, proprietary information, patient files, medical records,
patient lists, payroll, fiscal, accounting, research, internal reporting, strategic planning, trade
secrets, communications, computer systems and management information (collectively, with
patient health information referred to as “Confidential Information”).
In the course of my employment / work with RSMD, I understand that I may come into the possession of this type of Confidential Information. I will access and use this information only when it is necessary to perform my job related duties in accordance with RSMD’s privacy and security policies. I further understand that I must sign and comply with this Agreement in order to obtain authorization for
access to Confidential Information.
I will not disclose or discuss any Confidential Information with others, including friends or family, who do not have a need to know it.
I will not in any way divulge, copy, release, sell, loan, alter, or destroy any Confidential Information except as properly authorized by RSMD.
I will not discuss Confidential Information where others can overhear the conversation. It is not acceptable to discuss Confidential Information even if the patient’s name is not used.
I will not make any unauthorized transmissions, inquiries, modifications, or purgings of Confidential Information.
I will only access or use systems or devices I am officially authorized to access, and will not demonstrate the operation or function of systems or devices to unauthorized individuals.
During the term of this Agreement or after my relationship ceases with RSMD, I will not solicit, urge or encourage patients of RSMD to seek care elsewhere. I will not disclose or use in any way adverse to RSMD any Confidential Information.
I understand that I have no right to any ownership interest in any Confidential Information accessed, created or added to by me during my relationship with RSMD or to the accounts received/receivable from RSMD patients.
Upon termination, I will immediately return any documents or media containing Confidential Information to RSMD.
I agree that my obligations under this Agreement will continue after termination of my employment, expiration of my contract, or my relationship ceases with RSMD.
I will not solicit or contact any employees or personnel employed by RSMD for the purpose of urging or encouraging them to seek employment elsewhere or employ any such person.
I understand that violation of this Agreement may result in disciplinary or legal action, including but not limited to: termination of employment, suspension and loss of privileges, termination of authorization to work within RSMD.
I understand that I should have no expectation of privacy when using RSMD’s information systems. RSMD may log, access, review, and otherwise utilize information stored on or passing through its systems, including but not limited to e-mail, in order to manage systems and enforce security.
I will practice good workstation security measures such as locking up diskettes when not in use, using screen savers with activated passwords appropriately, and position screens away from public view.
I will practice secure electronic communications by transmitting Confidential Information only to authorized entities, in accordance with approved security standards.
I will:
a. Use only my officially assigned User-ID and password and/or token (e.g. Digital Personna).
b. Use only approved licensed software.
c. Use a device with virus protection software.
16. I will never:
a. Share/disclose user-IDs, passwords or tokens.
b. Use tools or techniques to break/exploit security measures.
c. Connect to unauthorized networks through the systems or devices.
17. I will notify the RSMD FISO (Facility Information Security Officer), Rebecca Small M.D. (telephone 831-345-9595) or her designee, if my password has been seen, disclosed, or otherwise compromised, and will report activity that violates this agreement, privacy and security policies, or any other incident that could have any adverse impact on Confidential Information.
The following statements apply to physicians using RSMD systems containing patient
identifiable health information: I will only access software systems to review patient records that are necessary for me to perform my duties.
18. I will insure that only appropriate personnel in my office will access RSMD’s software systems and Confidential Information and I will annually train such personnel on issues related to patient confidentiality and access.
19. I will accept full responsibility for the actions of my employees who may access the RSMD’s software systems and Confidential Information.
The following statements apply to Facility Owners working with patient identifiable health information and/or using RSMD software systems containing patient identifiable health information: I will only add, modify and review patient scheduling information that is necessary to perform my assigned duties with RSMD. I will only access RSMD’s software systems as necessary for the above patient scheduling duties. I will obtain permission from each patient to use their contact phone number listed on the schedule. I will not use any of RSMD’s Confidential Information to market to or solicit RSMD patients or staff during the term of the Service Agreement or after termination of the Service Agreement. The Confidential Information on the schedule will include only the patient name (first and last), desired contact telephone number, appointment type, treatment areas and treatment number (eg. Botox frown line #1, Laser Hair Removal bikini #2, Consult Intense Pulsed Light chest).
20. I will ensure that only appropriate people/personnel in my Facility will access RSMD’s software systems and Confidential Information.
21. I understand that it is solely my responsibility, and not RSMD’s responsibility, to train people/personnel in my Facility on issues related to patient confidentiality and ensure compliance with RSMD’s confidentiality policies [including, but not limited to those in this Agreement, the Business Associate Agreement, and HIPAA (Health Insurance Portability and Accountability Act) regulations]. I will perform annual training for the people/personnel in my Facility.
22. I have read and understand the information contained in the HIPAA Training Presentation provided by RSMD and RSMD’s Notice of Privacy Practices brochure and full document.
23. I will accept full responsibility for the actions of my employees, managers and any persons working in or using my Facility who access RSMD’s Confidential Information and/or use RSMD’s software systems.