CLEAR SYNC · TRUST CENTER
Privacy is personal.
Our standards are clear.
Understand the policies and principles that guide the handling of health information, from permission and access to security and recovery.
Clear choices.
Meaningful permission.
A useful privacy policy explains what information is involved, why it is needed and who may receive it.
Consent should be specific to the service and the information being shared. Account access, family relationships and permission to share health information are separate decisions.
Know the purpose
Review the information, recipients and intended use before deciding to share.
Understand your choices
Access, correction, withdrawal and deletion can have different processes and legal limits.
A framework for
health information.
HIPAA sets requirements for covered entities and business associates that handle protected health information.
Those responsibilities depend on the organization, its role and the actual service. They include appropriate privacy practices, security safeguards and agreements with service providers where required.
Assess the full information journey: people, access, systems, vendors and operating procedures. A hosting provider’s safeguards or agreement alone do not establish an organization’s compliance.
Protection at
every boundary.
Security requires deliberate controls for each system that handles information.
Our infrastructure standard calls for a separately reviewed clinical environment, individual access, encryption, protected secrets and audit records. The website, health services and their vendors each require their own assessment.
Limit access
Match permissions to a person’s role and purpose, with strong authentication and clear removal procedures.
Reduce exposure
Keep health information out of unnecessary logs, analytics and support tools.
Plan for disruption.
Prove the recovery.
Recovery planning starts with the people and workflows that depend on a service.
Our recovery standard calls for protected backups, recoverable keys, assigned response roles and measured restore exercises. Recovery objectives must reflect the actual service and be validated before they become commitments.
Validate the restored information, apply current retention and deletion records, recheck permissions and confirm essential workflows. A backup or successful restart alone does not demonstrate disaster recovery.
This overview does not make an uptime, recovery-time or data-loss guarantee.
Evidence with
a defined scope.
SOC 2 is an independent examination of an organization’s controls by a CPA firm.
A report must be read in context: the services it covers, the criteria examined and the period reviewed. A vendor’s report covers that vendor’s stated scope; it does not become a CLEAR SYNC report.
This Trust Center explains our standards and policy topics. It does not represent a CLEAR SYNC SOC 2 report or claim independent certification.
THE DETAILS, IN PLAIN LANGUAGE