Healthcare Security Agreement

HEALTHCARE SECURITY AGREEMENT

Patient Information

Insurance Information

Medical History (for contact and identity verification)

Recitals and Purpose

This Healthcare Security Agreement (the Agreement) documents the security obligations and authorizations applicable to the patient named above (Patient) in connection with Patient's access to protected health information and electronic services provided by the healthcare provider identified below. Provider Name: . Facility Address:

Definitions

"Protected Health Information" (PHI) means individually identifiable health information held or transmitted by the Provider in any form. "Account Credentials" means any username, password, multi-factor tokens, or other authentication data issued to Patient for access to electronic services, patient portals, or telehealth systems.

Patient Responsibilities

The Patient agrees to the following security responsibilities, which are material terms of this Agreement.

Provider Obligations

The Provider represents that it maintains administrative, physical, and technical safeguards designed to protect PHI in accordance with applicable law. Provider will: (i) reasonably secure electronic systems used for patient access; (ii) notify Patient of confirmed unauthorized access to Patient's PHI without unreasonable delay and in accordance with applicable law; and (iii) limit internal access to PHI to authorized personnel based on need-to-know.

Authorized Individuals and Proxy Access

Patient may designate individuals authorized to receive PHI or to access Patient's electronic account. Patient must list authorized individuals below and provide verification documentation if requested by Provider. Provider will rely on these designations until Provider receives written revocation.

Electronic Communication and Consent

Provider uses secure and, where applicable, standard electronic messaging to communicate. Patient acknowledges that electronic communications carry inherent security risks. Patient indicates consent below for the forms of non-encrypted communication authorized.

Security Incident Reporting

Security incidents should be reported to Provider's security contact. Provide best contact information for breach reporting and verification.

Authorization Term and Expiration

This Authorization remains in effect until revoked in writing by Patient or until the expiration date specified below, whichever occurs first. Revocation shall not affect disclosures made prior to Provider's receipt of revocation.

Authorization Expiration Date:

Limitation of Liability and Indemnity

Provider will use commercially reasonable measures to protect PHI, but Patient understands that no electronic system is completely secure. Except as otherwise required by law, Provider is not liable for unauthorized access resulting from Patient's failure to safeguard Account Credentials or from communications that Patient has affirmatively authorized. Patient agrees to indemnify Provider for claims arising from Patient's negligent disclosure of credentials or PHI to unauthorized third parties.

Governing Law

This Agreement is governed by the laws of the state in which Provider's principal facility is located, without regard to conflicts of law principles. Venue for any dispute arising under this Agreement will be in the appropriate state or federal court located therein.

HIPAA Acknowledgment

By signing below, Patient acknowledges receipt of Provider's Notice of Privacy Practices and understands Patient's rights with respect to PHI, including the right to request restrictions and request confidential communications. Patient further acknowledges that Patient has been given the opportunity to ask questions regarding these policies.

Certification

I certify that the information I have provided on this form is true and correct to the best of my knowledge. I understand that knowingly providing false information may expose me to civil or criminal liability under applicable law.

Sign Now