As business associates (BA) under the Health Insurance Portability and Accountability Act (HIPAA), NeckCare™ demonstrates good faith effort in fulfilling the applicable requirements by establishing and implementing the appropriate policies and procedures.

NeckCare™ is dedicated to appropriately safeguard the protected health information (PHI) received or created with the use of the NeckCare™ System, from any misuse.

NeckCare™ enters into business associate agreements (BAA) with healthcare providers, defined as covered entities, with whom it partners. This will provide the covered entities contractual assurance that NeckCare™ uses disclosed PHI only for the purposes for which have been contracted. If the covered entity does not have a BAA of their own, NeckCare™ can provide one upon request as an addendum to a Subscription Agreement.

To ensure the privacy and security of the PHI, NeckCare™:

• Has established policies and procedures following the HIPAA Privacy and Security Rule;

• Has designated a HIPAA Security Officer, responsible for ensuring that NeckCare’s HIPAA policies and procedures are implemented and followed.

• Has implemented administrative, physical, and technical safeguards to protect confidentiality, integrity, and accessibility of PHI;

• Stores PHI in a HIPAA compliant database;

• Ensures password and authentication management;

• Maintains facility access control;

• Controls and monitors access to PHI;

• Restricts access to PHI to the minimum necessary for the stated purpose;

• Requires HIPAA awareness training for all workforce members;

• Requires extensive training for workforce members with PHI access;

• Has all workforce members sign a confidentiality agreement, making sure they acknowledge and understand the necessary security measures when handling PHI;

• Enters into BAA with subcontractors that store PHI.

We at NeckCare™ are confident that by adhering to our HIPAA policies and procedures and ensuring the fulfillment of the security measures written in this statement, we are able to:

• Ensure the confidentiality of all PHI, received or created with the use of the NeckCare™ System;

• Safeguard all PHI from unlawful disclosures or uses;

• Protect all PHI against any anticipated treats;

• Ensure workforce awareness and compliance;

• Monitor the effectiveness of our procedures and continually make improvements.

For further information or questions, please contact privacy@neckcare.com.