Health Insurance Portability and Accountability Act of 1996 is a law that is designed to safeguard sensitive consumer medical information. It allows patients the ability to maintain more control over their health information, set boundaries on how it's used, and holds those who have access to the information accountable for inappropriate use of the information.

What rights do patients get because of HIPAA?

Patients have several important rights under HIPAA, including having their medical information protected, the right to obtain and see their medical records (with certain exceptions), and the right to request corrections to any mistake information. They also have the right to know how their medical information is used and shared. A doctor may be permitted to share information without your permission in certain narrow circumstances. Patients have the right to request to see who has viewed their medical information and to instruct how they want to be contacted. They can also request that their medical information is not shared with certain parties and control how it's used. If a consumer suspects that their rights have been violated, they have the right to file a complaint. Patients also have the right to an electronic copy of information if the health care provider has that kind of database. If you pay out of pocket for a medical issue, you have the right to ask your doctor not to send that information to your health plan. Additional rights include the right to request not to be sent fundraising requests, the right to request that your doctor asks for your permission before sending you information on new medical products when the doctor is paid to advertise these products, and the right not to have their medical information sold (with a few exceptions).

Who must comply with HIPAA laws?

Covered Entities include: • Health Plans - Health insurance companies, HMOs, Company Health Plans, Medicare, Medicaid. • Most Health Care Providers - Those that conduct certain business electronically like doctors, clinics, hospitals, pharmacies, nursing homes, etc. • Health Care Clearinghouses - Entities that translate nonstandard health information they receive from another entity to a standard. Business Associates: Non-employees of a Covered Entity which has access to your health information when providing a service to the covered entity. Examples include: Billing companies, companies that administer health plans, lawyers, accountants, IT, companies that store and destroy medical records, etc.

Who does not need to follow HIPAA laws?

Life Insurers, Employers (in terms of employment records, not medical records), Workers compensation carriers, Most schools and school districts, Many state agencies like child protective services, Most law enforcement agencies, and Many municipal offices.

What kind of information is protected under HIPAA?

Information your doctors, nurses, and other health care providers put in your medical record, conversations your doctors have about your care or treatment, information your Health Insurer has about you, and billing information.

How does an organization get HIPAA certified?

In order for an organization to be HIPAA compliant, an organization must follow the rules outlined in 45 CFR 164.306, 308, 310, 312, 314. So long as these rules are followed, the organization is HIPAA compliant. While there are private companies that will provide HIPAA compliant certifications, these are not officially recognized by the department of Health and Human Services. Organizations will often perform a self evaluation to ensure they are compliant with HIPAA guidelines.

What has Metadot/Mojo Helpdesk done to be HIPAA compliant?

We have performed a self evaluation to ensure that we are compliant with HIPAA guidelines and we hold all of our business associates to the same standards.

HIPAA · Compliance

Health data handled with real safeguards, not just a promise.

How Mojo Helpdesk supports compliance with the Health Insurance Portability and Accountability Act, so teams handling protected health information can run support without putting patient privacy at risk.

Business Associate Agreement on requestSigned for eligible products that process PHI. Contact us to start.

Safeguards: Administrative, technical & physical
Agreement: BAA on request
Standard: 45 CFR 164.306–314

An honest note

There is no official HIPAA “certification.”

No government body hands out a HIPAA certificate. What matters is whether an organization actually follows the Security Rule and stands behind it. Metadot performs a documented self-evaluation, holds every business associate to the same standard, and signs a Business Associate Agreement for eligible services.

A “certified” badgeNot recognized

“We paid for a HIPAA certificate.”

HHS does not recognize private HIPAA certifications. A logo is not accountability.

Metadot · MojoWhat we actually do

“We self-evaluate against the Rule, and sign a BAA.”

Documented safeguards, business associates held to the same bar, and a signed agreement. Not a sticker.

Our HIPAA commitment

Four ways we safeguard PHI.

The safeguards that keep protected health information protected, and the standard behind each one.

How medical data is protected

Sensitive health information is safeguarded with the same encryption and security controls behind our SOC 2 Type II attestation, in transit and at rest.

STANDARD · Encryption in transit & at rest

Who can access it

Strict boundaries on who can view or use health information, enforced with authentication and role-based permissions rather than trust.

STANDARD · MFA & role-based access

The standard we follow

We hold ourselves to the administrative, technical, and physical safeguards set out in 45 CFR 164.306, 308, 310, 312, and 314.

STANDARD · HIPAA Security Rule

Who else is held to it

Every vendor that could touch protected health information is held to the same HIPAA standards we hold ourselves to.

STANDARD · Business associate flow-down

Business Associate Agreement

A BAA when your compliance needs one.

Metadot Corporation provides a Business Associate Agreement (BAA) upon request for eligible products and services that support the processing of protected health information (PHI). We work with customers to help meet their HIPAA compliance requirements while maintaining appropriate administrative, technical, and physical safeguards for PHI.

To request a copy of our standard BAA or to discuss HIPAA requirements, please contact us.

Frequently asked questions

Run support that respects patient privacy.

Get a HIPAA-ready ticket system production-ready in seconds, with a BAA when you need one.

Try for free Book a demo