This HIPAA Compliance Policy describes how EyeGoal (operated by Caribbean Ophthalmics Corp.) safeguards Protected Health Information (PHI) in accordance with the HIPAA Privacy, Security, and Breach Notification Rules (45 CFR Parts 160 and 164). It applies to all PHI created, received, maintained, or transmitted by the platform.
EyeGoal acts as a Business Associate to each eye-care practice (the Covered Entity) that uses the platform. We process PHI only to provide the service and only as permitted by a signed Business Associate Agreement (BAA). A BAA is available to every practice and is included in our enrollment terms.
PHI is hosted on Amazon Web Services in access-controlled, audited data centers. We do not store PHI on portable/unmanaged media; access to production systems is restricted and logged.
Access to PHI is limited to the minimum necessary for each role to perform its function. For example, call-center and front-desk roles see only the limited data their workflow requires.
If a breach of unsecured PHI is discovered, we notify the affected Covered Entity without unreasonable delay and within the timeframes required by 45 CFR §164.410, with the information needed for the Covered Entity to meet its notification obligations.
Patients exercise their HIPAA rights (access, amendment, accounting of disclosures) through their eye-care practice (the Covered Entity). EyeGoal provides the tools and records practices need to honor these requests.
Personnel with potential PHI access operate under confidentiality obligations. Infrastructure and service providers that may process PHI (e.g., AWS) operate under their own BAAs; payment processors are scoped so PHI is not shared with them.
HIPAA / security inquiries and BAA requests: privacy@eyegoal.com.