How COSA Nexus handles protected health information.

COSA Nexus is a HIPAA-compliant medical referral and telehealth platform operated for chiropractic partner offices, medical evaluators, and internal administrative staff. This Privacy Policy describes how we collect, use, disclose, and protect Protected Health Information ("PHI") and other personal information you provide or that is created through your use of the platform.

Under the Health Insurance Portability and Accountability Act of 1996 ("HIPAA"), COSA Nexus operates as a Business Associate to the partner offices and providers who use the platform. Business Associate Agreements ("BAAs") govern our handling of PHI on behalf of Covered Entities.

• Account information — name, email, phone, role, and office affiliation for authenticated users.
• Patient referral data — patient name, DOB, contact information, attorney/claim information, evaluation type, urgency, and clinical notes provided by the referring office.
• Clinical documentation — Chief Complaint, HPI, examination findings, assessment, plan, EMC determination, ICD-10 codes, and uploaded reports produced by evaluating providers.
• Session data — telehealth session start/end timestamps, patient consent records (including state-specific AI disclosure acknowledgements), and audit logs of every material action.
• Technical data — IP address, browser user-agent, session tokens, and access timestamps used for security and audit purposes.

We use the information above only for the purposes for which it was submitted: coordinating referrals, running telehealth sessions, generating and delivering clinical reports, notifying stakeholders, and meeting our HIPAA obligations (access controls, audit logging, retention, and breach response).

We do not sell or rent PHI. We do not use PHI to train third-party AI models. When the AI clinical scribe is used, transcripts and clinical notes are processed only under a signed BAA with the AI vendor (Anthropic), and only after the patient has been shown the state-specific AI disclosure (e.g. California AB 3030).

• Data is stored in PostgreSQL databases hosted on infrastructure providers with signed BAAs (AWS for production).
• Uploaded documents (intake, MRI, reports) are stored encrypted at rest (AES-256 or KMS-managed keys), retrieved only through 15-minute signed URLs.
• Backups are encrypted and retained under the same policies as the primary data.

• All traffic is transmitted over TLS 1.2 or higher.
• Data at rest is encrypted using AES-256 or equivalent provider-managed encryption.
• Access is role-based; every authenticated user sees only the records their role permits.
• Multi-factor authentication is available for all accounts and required for administrator and provider accounts once enabled.
• Sessions expire automatically after 30 minutes of inactivity and after 8 hours of use regardless of activity.
• Every material action — logins, status changes, note saves, file downloads — is written to an append-only audit log retained for at least six years.
• Passwords are hashed with bcrypt (cost factor 12). Multi-factor secrets are encrypted with AES-256-GCM at rest.

We retain PHI for a minimum of six years from the date of last effective access, consistent with HIPAA §164.316. After that period, referrals in a terminal status (Closed, Cancelled, Report Delivered, No Show) are hard-deleted by an automated retention purge that also removes the underlying stored bytes.

Audit logs are excluded from purge — they document compliance itself. Individual users may request account deletion through the account settings page; requests are reviewed by administrators.

The following categories of vendor may process PHI on our behalf; each has a signed Business Associate Agreement in place:

• Cloud infrastructure (AWS or equivalent HIPAA-eligible hosting)
• Telehealth video (Doxy.me)
• AI clinical documentation (Anthropic Claude API)
• Email delivery for status notifications and password resets
• SMS delivery for reminders (when enabled)
• Fax delivery to law offices and insurance carriers (when enabled)

If you are a patient whose information is stored in the platform, you may request access, correction, restriction, accounting of disclosures, or deletion of your information by contacting the referring office. Your rights under HIPAA are described in your provider's Notice of Privacy Practices.

If you are a platform user (office staff, administrator, provider), you may review and update your account information from the Account page. To request deletion of your account, use the deletion-request queue on the same page.

In the event of a breach of unsecured PHI, we will notify the affected Covered Entity without unreasonable delay and no later than 60 days after discovery, consistent with 45 CFR §164.410. Notifications will include the identifiers involved, the nature of the breach, and the mitigation steps taken.

For privacy or security questions, please contact your platform administrator or reach out via your organization's designated compliance channel. Regulator or patient enquiries should be directed to the COSA Nexus Privacy Officer at your Covered Entity.