Purpose and scope
Prospex-AI, Inc., operating under the ProspexCare brand, is a Business Associate under 45 C.F.R. § 160.103. This policy summary describes how we safeguard protected health information and support our obligations under HIPAA, HITECH, and applicable Washington requirements.
Security officer
Nehmiah Gezahegn is ProspexCare's designated HIPAA Security and Privacy Officer. The Security Officer owns the risk assessment, vendor Business Associate Agreements, workforce training, incident response, sanctions, and access approvals.
Access control and safeguards
Access is granted per person and limited to the minimum necessary for each role. Shared accounts are not permitted. MFA is required wherever available, access is reviewed quarterly, and access is disabled when a workforce member leaves. Devices used to access production systems must be locked, encrypted, automatically secured, and kept current.
PHI handling
PHI is used only to provide, support, or secure the service. It is never placed in chat tools, personal email, screenshots, public forums, or unapproved AI tools. Production data is not copied into development or staging environments, and logs must not contain PHI.
Vendors and BAAs
No vendor may create, receive, maintain, or transmit PHI for ProspexCare without Security Officer review and a written BAA where required. Approved PHI-touching infrastructure vendors are maintained in the Security Risk Assessment and reviewed annually.
Incident response
Suspected incidents, exposed credentials, unauthorized access, misdirected PHI, lost devices, and unusual activity must be reported to the Security Officer immediately. ProspexCare contains the issue, assesses scope, provides required notifications, documents the incident, and implements preventive improvements.
Training and maintenance
Workforce members complete HIPAA security training before production access and annually thereafter. This policy is reviewed annually and after material changes or incidents. Questions about these policies may be sent to privacy@prospexcare.com.
Note: This page is a plain-language summary. The governing HIPAA Compliance Manual and signed Business Associate Agreements control where documents differ.