Notice of Privacy Practices (draft)

shteg.ai is a registered HIPAA clearinghouse operating under a Type-2 organizational NPI, which makes it a covered entity. This Notice of Privacy Practices is therefore framed to HIPAA obligations for protected health information (PHI), not to a general consumer-SaaS posture. This document describes how PHI is used and disclosed under executed Business Associate Agreements.

As a clearinghouse, our core function is to receive, translate, validate, and route healthcare transactions — eligibility, claims, remittance, and status — on behalf of covered-entity customers under a Business Associate Agreement. In production, PHI would be processed only to perform those clearinghouse and settlement functions and the treatment, payment, and healthcare-operations activities they support. We do not sell PHI and do not use PHI for advertising. The system is built to the minimum-necessary principle, isolates PHI per tenant, records access in a hash-chained WORM audit ledger, and fails closed: any integration that would touch PHI without a BAA in place returns a typed refusal and makes no network call. Specific categories of use and disclosure will be enumerated in the binding version.

The finalized notice will describe the individual rights HIPAA guarantees: the right to inspect and obtain a copy of PHI held about you, to request an amendment, to receive an accounting of certain disclosures, to request restrictions on use and disclosure, to request confidential communications, to receive a paper or electronic copy of this notice, and to be notified following a breach of unsecured PHI. Because shteg.ai typically acts as a clearinghouse/business associate rather than the treating provider, many requests are directed to and coordinated with the covered-entity customer that holds the treatment relationship. The binding version will state exactly how each right is exercised and the timelines that apply.

In the event of a breach of unsecured PHI, the finalized notice will commit to the HIPAA Breach Notification Rule: notification of affected individuals and, as applicable, the covered entity, HHS, and the media, within the required timeframes. The hash-chained, append-only audit ledger is designed so that access and movement of PHI are tamper-evident, which supports detection and the accounting required after an incident.

Because this is a draft, a direct answer is the most reliable one. For questions about PHI handling, this notice, or to raise a privacy concern, email us and a human will respond. When a finalized notice is published it will name a Privacy Officer and contact point. You have the right to file a complaint with the U.S. Department of Health and Human Services, Office for Civil Rights, and we will not retaliate for the filing of a complaint.