Privacy
Policy

Scope

state that this policy covers the public website only, and that PHI handled under business associate agreements is governed separately

Information collected

what the contact form collects, what server logs retain, what analytics if any are used

How information is used

purposes, and confirmation that website submissions are not used for marketing without consent

Sharing and service providers

hosting provider, email provider, any form processor, and whether a business associate agreement is in place with each

Retention

how long website inquiries are retained

Your choices and rights

how to request deletion of an inquiry, and any state privacy law rights that apply

Protected health information

explicit statement that this site is not a channel for PHI, and what happens if PHI is submitted through it anyway

Contact

privacy contact name or role, address and email

Last updated: date on counsel approval