Under HIPAA privacy rules, Advanta Health Solutions, Inc., is considered a Business Associate, and we are compliant with all applicable rules and regulations of the Health Insurance Portability and Accountability Act (HIPAA) of 1996. We are committed to keeping all PHI (Protected Health Information) that our clients and members entrust to us private and secure. Advanta has adopted policies and procedures including, but not limited to, the following:

All employees have been trained on HIPAA rules and procedures and are required to undergo this training every 2 years. All employees are required to sign a confidentiality agreement as a condition of employment. All policies and procedures related to information and physical security are frequently reviewed to ensure they are up to date and follow any new or revised regulations.

We have implemented Information Security procedures such as:

• Multi-Factor Authentication
• Automatic expiration of passwords
• Account lockouts upon numerous failed log-in attempts
• Transcripts and exhibits sent and received through secure file transfer (Citrix’s ShareFile & SFTP)
• Data-at-rest encryption
• Secure data backups
• All subcontractors are required to sign a Business Associate
• Agreement agreeing to uphold our information security standards
• All visitors to our office are required to sign in in order to be granted access
• Automatic virus scans
• Any potential or actual breaches are logged, investigated and reported