Privacy Policy

PATIENTLINK -- PRIVACY POLICY – OCTOBER 2020

PatientLink is committed to maintaining the highest level of privacy for its clients. Toward that end, PatientLink has established policies and procedures to ensure that all client data is handled with the utmost discretion at all times in a secure online environment. All privacy policies and procedures have been set up to comply with The Health Insurance Portability and Accountability Act (HIPAA).

Nature of Private Client Information

The PatientLink platform is designed to perform two basic functions:

  • -To serve as a third-party online platform that facilitates the bidding process related to international patient transfers.
  • -To serve as a third-party online platform to post the availability of empty international return air ambulance flights

In order to perform these two specific functions, PatientLink’s online bidding service limits private client information to the following:

  • -Name and contact information for the posting company
  • -Information related to the basic parameters of the posted medical repatriation mission, including: Departure point, termination point, time frame, specific patient requirements
  • -Name and contact information for the bidding service provider
  • -Information related to each individual bid-Name and contact information for the provider posting the empty leg
  • -Departure point and termination point of empty return air ambulance leg
  • -Aircraft specifications for empty return leg

All private client data collected by PatientLink is used solely to facilitate the bid-tendering process through its online platform. All data submitted remains the property of PatientLink while in use and will not be sold, published, transferred, disclosed, shared or otherwise utilized for any other purpose.

Limitations of Private Client Information

PatientLink only requires rudimentary private information to facilitate the bid-tendering process. Once the bidding process is complete and a service provider has been selected for a given patient transfer, the two companies involved complete the planning, execution and compensation phases of the mission privately and not on the PatientLink platform.

Due to the limited information required to utilize the PatientLink bid-tendering platform, the following private information is NOT required or solicited:

  • -Contact and demographic information for the patient and any family members
  • -Detailed medical information related to the patient including medical history, vaccinations, medications, etc.
  • -Information related to the departing or receiving hospital or attending medical personnel
  • -Logistical information related to a specific mission: flight plan, departure and arrival times, passenger manifests, hotel and other crew management arrangements, passport and visa details
  • -Contracts or service agreements between the posting company and the winning service provider
  • -Banking information required to conduct business transactions, verify credit and transfer funds

Protecting/Storing Private Client Information

  • -All private client information submitted to PatientLink resides exclusively on our secure online platform.
  • -Any information submitted to PatientLink only resides on the platform for the duration of the bid-tendering process. Once the bid-tendering process is complete and a winning bid has been selected by the posting company, all private client information related to that specific posting is deleted from the site.
  • -Private client information submitted to PatientLink is not recorded in any other form, either electronic or hard copy, or retained on a separate platform, server or database or in a storage facility.

Accessing Private Client Information

  • -Access to private client information on the PatientLink bid-tendering platform is restricted to users posting missions for bid and those tendering bids for consideration
  • -Only the posting company has access to individual bids related to their specific posting

Employee Confidentiality

  • -As a condition of employment with PatientLink, each employee is contractually obligated to treat all private client information with the utmost confidentiality. Any breach of confidentiality may result in dismissal from employment with PatientLink and possible criminal prosecution.
  • -PatientLink employees are prohibited from selling, publishing, transferring, disclosing, sharing or otherwise utilizing any private client information collected by the company for use on its online platform.

Electronic Data Security

As an exclusively online platform, PatientLink is extremely sensitive to the need to protect its users’ private information. Toward that end, the company utilizes a number of digital security strategies to ensure the integrity of the platform and safeguard sensitive business information.The following outlines several key features of the platform (including links) to help clients better understand what PatientLink is doing to protect their private information.

Security Features:

  • •The Amazon Relational Database Service (https://aws.amazon.com/rds/) provides re-sizable capacity while automating provisioning, database setup, patching and backups.
  • •The database resides in a MySQL (https://aws.amazon.com/rds/mysql/) environment, allowing for simple deployment, predictable storage, easy backup/recovery, monitoring, isolation and security. This environment also provides an automated seven-day activity snapshot (back-up).
  • •For its web server PatientLink utilizes an EC2 Instance (https://aws.amazon.com/ec2/details/), which allows the company to scale up or down to handle changes in requirements or spikes in usage, thus reducing the need to forecast traffic. The server is secured and blocked with access only through HTTPS and SSH. This access is only available with a private key-pair.
  • •The PatientLink database utilizes an Ubuntu Linux server (https://aws.amazon.com/mp/solutions/ubuntu/). Lean, fast and powerful, the Ubuntu server delivers services reliably, predictably and economically. It is the perfect base on which to build a virtual computing environment.
  • •The hard drive used by the web server is separate hardware that can be attached and detached from the server at any time. This allows the virtual computing environment to be changed in minutes.
  • •The system has two lambda scripts (https://aws.amazon.com/lambda/faqs/) that automatically take daily snapshots (back-ups) of the hard drive that are each retained for seven days.
  • •All data sent or received in the database is encrypted using SSL through Let’s Encrypt. This is a service provided by the ISRG (https://letsencrypt.org/about/).
  • •The database also utilizes Cloudwatch, which provides alerts when the application is not accessible for more then two minutes or when the CPU usage goes over 60% for more than five minutes.

Create an account

Choose the type of account you need.