HIPAA Compliance

Universal Fabrication is committed to maintaining the highest standards of health information privacy and security. As a provider of biomedical devices, research services, and clinical trial services, we recognize the critical importance of protecting Protected Health Information (PHI) in accordance with the Health Insurance Portability and Accountability Act (HIPAA) and its implementing regulations.

This HIPAA Compliance Statement outlines our commitment to protecting health information and describes the measures we have implemented to ensure compliance with HIPAA requirements.

The Health Insurance Portability and Accountability Act (HIPAA) is a federal law that establishes national standards to protect sensitive patient health information from being disclosed without the patient's consent or knowledge.

Universal Fabrication may act as a Business Associate when we provide services that involve the use or disclosure of Protected Health Information (PHI) on behalf of covered entities (such as healthcare providers, health plans, or healthcare clearinghouses).

As a Business Associate, we:

• Enter into Business Associate Agreements (BAAs) with covered entities
• Comply with applicable HIPAA requirements
• Implement appropriate safeguards to protect PHI
• Report any security incidents or breaches to covered entities as required
• Ensure that our subcontractors who handle PHI also comply with HIPAA requirements

We have implemented comprehensive administrative, physical, and technical safeguards to protect PHI in accordance with HIPAA requirements:

All employees and contractors who may have access to PHI are required to complete comprehensive HIPAA training. This training covers:

• HIPAA Privacy and Security Rules
• Our policies and procedures for protecting PHI
• How to identify and report security incidents
• Best practices for handling PHI
• Consequences of non-compliance

Training is provided upon hire and on an annual basis, with additional training provided when policies or procedures are updated.

In the event of a security breach involving PHI, we have established procedures to:

• Immediately investigate and contain the breach
• Assess the nature and scope of the breach
• Notify affected individuals without unreasonable delay (and in no case later than 60 days after discovery)
• Notify the covered entity (if applicable) immediately
• Notify the Secretary of Health and Human Services (HHS) as required
• Implement corrective measures to prevent future breaches

Individuals have certain rights regarding their PHI under HIPAA. These rights include:

• Right to Access: You have the right to access and obtain copies of your PHI
• Right to Amend: You have the right to request amendments to your PHI
• Right to an Accounting: You have the right to receive an accounting of disclosures of your PHI
• Right to Request Restrictions: You have the right to request restrictions on the use and disclosure of your PHI
• Right to Request Confidential Communications: You have the right to request that we communicate with you about PHI in a certain way or at a certain location
• Right to File a Complaint: You have the right to file a complaint if you believe your privacy rights have been violated

To exercise any of these rights, please contact us using the information provided in the Contact section below.

We are committed to maintaining ongoing HIPAA compliance through:

• Regular internal compliance audits and assessments
• Ongoing monitoring of our security measures and practices
• Regular updates to policies and procedures to reflect changes in HIPAA regulations
• Training and education for all workforce members
• Incident response and breach notification procedures

We continuously work to improve our HIPAA compliance program and adapt to evolving threats and regulatory requirements.

If you have questions, concerns, or wish to exercise your rights under HIPAA, please contact our HIPAA Privacy Officer: