HIPAA notice
Effective August 3, 2026 · Last updated August 3, 2026
Responder Worx is a business associate, not a covered entity. Patients receive their Notice of Privacy Practices from the EMS agency or department that treated them. This notice explains how we handle PHI on that agency's behalf.
1. Our role
When an agency uses Traumix, we create, receive, maintain, and transmit PHI on its behalf. We execute a Business Associate Agreement with every agency before go-live. Individual subscribers who are themselves covered entities sign the same agreement.
2. PHI in Traumix
Run audio and everything derived from it — transcript, narrative, flagged events, call timeline — is treated as PHI end to end. Audio captured during patient care can include patient identifiers, clinical findings, family members, bystanders, and other crews. We handle all of it as PHI regardless of who is speaking.
3. Permitted uses and disclosures
We use and disclose PHI only:
- To perform the service the agency engaged us for — transcription, narrative generation, timeline extraction, delivery, and support.
- For our own proper management and administration, and to carry out our legal responsibilities, as the BAA permits.
- To subcontractors bound by written business associate terms at least as protective as ours.
- As required by law.
We do not sell PHI, use it for marketing, or use it to train third-party models. We do not use PHI to train or fine-tune our own models unless the agency authorizes it in writing.
4. Safeguards
- Encryption of audio on the device before upload, and of PHI in transit and at rest.
- Per-provider accounts with device PIN, role-based access, and least-privilege administrative access.
- An audit trail per run: who recorded, who opened, who edited, who accepted, and when.
- Workforce training, confidentiality obligations, and sanctions for violations.
- Configurable retention, including deletion of source audio at the moment the provider accepts the narrative.
5. Minimum necessary
We limit PHI access to the workforce members and subcontractors who need it to deliver or support the service, and to the minimum content necessary for that purpose.
6. Breach notification
If we discover a use or disclosure not permitted by the BAA, or a breach of unsecured PHI, we notify the agency without unreasonable delay and no later than the period the BAA and HIPAA require, with the information the agency needs to make its own notifications.
7. Patient rights
Patients exercise their HIPAA rights — access, amendment, accounting of disclosures, restriction, and complaints — through the treating agency. We support the agency in responding, including producing an accounting of disclosures and amending records at its direction. Patients who contact us directly will be referred to their agency's privacy officer.
8. Recording law
HIPAA is not the only rule that applies to recorded audio. State wiretap and consent statutes, agency policy, medical direction, and public records law may also govern. Each agency is responsible for confirming its use of ambient recording is lawful in its jurisdiction before deployment.
9. Return or destruction
On termination we return or destroy all PHI we hold, or, where return or destruction is infeasible, extend the protections of the BAA to the retained PHI and limit further use to what makes destruction infeasible.
10. Contact
Privacy and security matters, BAA requests, and suspected incidents: privacy@responderworx.com.