Loading
Loading
Loading
Legal
Last updated May 18, 2026
THIS PRIVACY POLICY APPLIES TO THE PHI THAT WE PROCESS ON BEHALF OF HEALTHCARE FACILITIES (COVERED ENTITIES) THROUGH OUR WEB-BASED SOFTWARE, WHICH INCLUDES SCANNING, PROCESSING AND TRANSCRIBING OF MEDICAL RECORDS AND OTHER MEDICAL DATA UPLOADED BY THESE FACILITIES. OUR SERVICES ARE PROVIDED AS A BUSINESS ASSOCIATE TO COVERED ENTITIES, AND WE HANDLE PHI SOLELY TO PROVIDE SCANNING, PROCESSING AND TRANSCRIBING SERVICES, WITHOUT STORING, RETAINING, OR DISCLOSING IT BEYOND THE SCOPE OF OUR AGREEMENT.
Conduit collects and processes PHI as necessary to provide our services. PHI is provided solely from health care providers using Conduit services. Conduit does not collect any PHI for any purposes other than providing our services, and Conduit does not store this information once processing is complete. The PHI we may process includes, but is not limited to:
Conduit processes PHI on behalf of post-acute and other healthcare providers solely to provide the services described in our Business Associate Agreements (BAAs). PHI is processed under strict confidentiality and security protocols, as required by HIPAA.
Conduit uses the collected data for various purposes, including but not limited to:
Conduit may process PHI based on:
Conduit may retain PHI only as necessary to perform the services agreed upon under the Subscription Agreement. We implement appropriate safeguards to ensure that PHI is protected both at rest and in transit. Additionally, PHI provided to third parties will only be shared with those adhering to zero-data retention policies, strictly for the purpose of fulfilling services for the Covered Entity.
As a Business Associate, we have entered into BAAs with all healthcare providers that use our services. These agreements govern the use, protection, and disclosure of PHI in accordance with HIPAA. Our obligations include:
We take the security of PHI seriously. To protect PHI, we use:
In the unlikely event of a breach involving PHI, we will notify the healthcare provider (Covered Entity) without unreasonable delay, but no later than 60 days after the discovery of the breach, in accordance with the HIPAA Breach Notification Rule. The healthcare provider is then responsible for notifying affected individuals.
Because we act solely as a Business Associate, we do not manage patient rights under HIPAA. If you are a patient and wish to exercise your HIPAA rights, such as accessing your medical records or requesting amendments, you should contact your healthcare provider directly.
We do not share PHI with any third parties except as necessary to perform our services or as required by law. Any third parties with whom we may share PHI for service purposes are required to protect the information with the same level of security and confidentiality.
Conduit does not de-identify PHI as part of our standard services. If requested by a Covered Entity, we will comply with HIPAA's de-identification standards and ensure that all personally identifiable information is removed from the records before use or disclosure.
Our service does not address anyone under the age of 13. We do not knowingly collect personally identifiable information from anyone under the age of 13. If you are a parent or guardian and you are aware that your child has provided us with personal information, please contact us so that we will be able to take the necessary actions.
Conduit is committed to complying with applicable data privacy laws, including state-level regulations such as the California Consumer Privacy Act (CCPA), in addition to federal laws such as HIPAA and HITECH. If you are a resident of California or another jurisdiction with specific data protection laws, you may have additional rights regarding your personal information.
Conduit offers an optional SMS (text message) notification program that alerts facility staff when a new patient referral arrives. Participation is voluntary and limited to authenticated Conduit users who choose to enable it. When you opt in by providing your mobile phone number and enabling text notifications, Conduit uses your number solely to deliver these transactional alerts. Conduit does not share, sell, rent, or disclose your mobile phone number, SMS opt-in, or consent data to any third party, and this information is never used or shared for promotional purposes. Messages are transactional only and contain no patient health information. You may opt out at any time by replying STOP to any message or by disabling text notifications in your Conduit settings. Message and data rates may apply. For full details, see our SMS Terms.
Conduit may update our Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page and updating the "Last Updated" date at the top. You are advised to review this Privacy Policy periodically for any changes.
If you have any questions about this Privacy Policy, please contact us:
Book a 15-minute demo. We'll show you the full suite live.
No commitment. No deck. Just the product.