HIPAA & Information Security
Effective Date: September 8, 2026
Cozad Medical Ops recognizes that privacy and information security are fundamental to healthcare operations. Our services are designed to support healthcare organizations in environments where Protected Health Information (“PHI”) may be used as part of the prior authorization process.
Cozad Medical Ops is committed to maintaining privacy and security practices appropriate to the information entrusted to us and to meeting applicable requirements of the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”) when our services involve PHI.
Our Role
When Cozad Medical Ops provides services to a healthcare organization that involve creating, receiving, maintaining, or transmitting PHI on behalf of that organization, Cozad Medical Ops operates in accordance with the HIPAA requirements applicable to its role, including Business Associate requirements where applicable.
Appropriate written agreements, including Business Associate Agreements (“BAAs”) when required, govern the permitted use and disclosure of PHI in connection with those services.
Privacy and Security Safeguards
Cozad Medical Ops maintains administrative, technical, and physical safeguards designed to protect PHI and other sensitive information and to support the confidentiality, integrity, and availability of information entrusted to us.
Our privacy and security framework includes, as applicable:
- Access controls designed to limit information access to authorized individuals
- Authentication and account security measures
- Secure methods for transmitting and accessing sensitive information
- Workforce privacy and security requirements
- HIPAA privacy and security training for personnel whose responsibilities involve PHI
- Confidentiality requirements for personnel and applicable service providers
- Procedures for managing access when roles or working relationships change or end
- Security incident identification, response, and escalation procedures
- Risk assessment and risk management practices
- Appropriate oversight of vendors and subcontractors that may handle PHI
- Business Associate Agreements and other contractual protections where required
Safeguards may evolve as technology, regulatory requirements, security risks, and Cozad Medical Ops services develop.
Separation of the Public Website and PHI Workflows
The public Cozad Medical Ops website is intended for general business information, prospective-client inquiries, recruiting information, and other non-patient communications.
The public website and its business inquiry forms are not authorized channels for transmitting PHI.
Visitors should not submit patient names, medical records, insurance information, clinical documentation, authorization information, or other PHI through the public website or general business inquiry forms.
When PHI is required for services provided by Cozad Medical Ops, it is handled through separately authorized workflows established for those services and subject to applicable privacy, security, contractual, and HIPAA requirements.
Minimum Necessary and Authorized Access
Access to PHI is limited according to job responsibilities, authorized purposes, contractual requirements, and applicable privacy and security requirements.
Cozad Medical Ops supports the principle of limiting the use, disclosure, and access of PHI to what is appropriate for authorized business functions and applicable legal requirements.
Workforce and Contractors
Personnel authorized to perform services involving PHI are subject to appropriate privacy, confidentiality, information-security, and access requirements.
Where applicable, personnel receive training appropriate to their responsibilities before being granted access to PHI or systems containing PHI.
Contractors, vendors, and subcontractors that require access to PHI are subject to applicable contractual and HIPAA requirements based upon their role and relationship to Cozad Medical Ops.
Technology and Third-Party Service Providers
Cozad Medical Ops evaluates technology and service providers used in workflows involving sensitive healthcare information based on the nature of the service, information involved, security considerations, and applicable contractual and regulatory requirements.
Where a third-party service provider creates, receives, maintains, or transmits PHI on behalf of Cozad Medical Ops and a Business Associate Agreement or other contractual protection is required, appropriate agreements are established before PHI is provided or access is authorized.
Security Incidents
Cozad Medical Ops maintains processes for identifying, evaluating, responding to, documenting, and escalating suspected privacy or security incidents involving information within our responsibility.
Where notification or other action is required by applicable law or contractual obligations, Cozad Medical Ops follows the requirements applicable to the circumstances.
Shared Responsibility
Protecting healthcare information requires cooperation among Cozad Medical Ops, our healthcare-organization clients, authorized personnel, and applicable technology or service providers.
Clients and authorized users are expected to follow established procedures for transmitting information and should not send PHI through unauthorized channels, including the public Cozad Medical Ops website.
Questions About Privacy and Security
Cozad Medical Ops
Email: info@cozadmedicalops.com
Website: cozadmedicalops.com