SettleTrack™ is Letter of Protection (LOP) case management software used by personal injury attorneys, ER facilities and notaries. Because personal injury cases involve patient information, parts of the data processed in the Service constitute protected health information (PHI) under the Health Insurance Portability and Accountability Act (HIPAA). This notice explains the role we play and the safeguards we maintain.
Our role under HIPAA
When an ER facility (a covered entity) or a law firm handling PHI on behalf of a covered entity uses SettleTrack, we act as a business associate. Where a law firm is not itself a covered entity or business associate, we may still contractually agree to apply equivalent safeguards. We process PHI only to provide the Service, under the terms of a Business Associate Agreement (BAA) executed with the customer. We make BAAs available to every customer whose use of the Service involves PHI.
Note for patients: SettleTrack does not treat patients and does not decide how your health information is used. If you have questions or requests about your health information (access, amendment, restriction or an accounting of disclosures), please contact the healthcare provider or law firm handling your case; we assist our customers with such requests as provided in our agreements with them.
How we safeguard PHI
SettleTrack is designed around the HIPAA Security Rule's administrative, physical and technical safeguard requirements. The following describes our current practices for informational purposes; the governing terms for each customer’s use of the Service are set forth in the applicable Terms of Service and BAA:
Technical safeguards
- Encryption in transit: TLS 1.2 or higher (or such later version as may be required by industry standards) on every connection.
- Encryption at rest: AES-256 encryption for PHI fields, with managed key rotation.
- Role-based access control: least-privilege by design; a notary never sees billing detail, and a front desk never sees settlement terms.
- Audit trails: every access to and modification of PHI is timestamped and attributed to a named user, and available for export to the customer upon request or as required by law.
- Session controls: automatic session timeout and secure authentication.
Administrative safeguards
- Access is provisioned per role and per organization, and revoked promptly when no longer needed.
- Security practices are reviewed on an ongoing basis and informed by recognized control frameworks (such as NIST or SOC 2 criteria).
- Workforce access to production PHI is restricted, logged and reviewed.
Data handling practices
- SettleTrack is designed and configured so that PHI is not included in system logs, error messages or analytics.
- PHI is never used for third-party marketing or advertising and is never sold.
- Only the minimum necessary information is requested and displayed for each role's task.
- Encrypted backups support recovery without weakening confidentiality.
Subcontractors
Where infrastructure providers (such as cloud hosting, database or file storage) may handle PHI on our behalf, we enter into business associate agreements or agreements containing equivalent HIPAA-required terms so that applicable obligations follow the data downstream.
Breach notification
In the unlikely event of a breach of unsecured PHI, we will notify affected customers without unreasonable delay and within the timeframes required by the HIPAA Breach Notification Rule and our BAAs, and we will reasonably cooperate in investigation, mitigation and any required notifications, in each case as further specified in the applicable BAA.
A note on terminology
HIPAA does not provide a government “certification” for software. SettleTrack is built and operated to support our customers' HIPAA compliance obligations as described above; each customer remains responsible for their own policies, workforce training and appropriate use of the Service.
Contact us
For questions about this notice, our safeguards, or to request a BAA, email support@settletrack.io. See also our Privacy Policy and Terms of Service. We may update this notice from time to time to reflect changes in our practices or applicable requirements.