+1 (248)-841-1040
+1 (248)-841-1040
Appointment
Facebook Instagram

Privacy Rule Compliance

  • Notice of Privacy Practices: Display a notice on the website detailing how Protected Health Information (PHI) is used and shared, in line with the HIPAA Privacy Rule.
  • Patient Rights: Clearly outline the rights patients have concerning their PHI, including access to their medical records, requesting amendments, and obtaining an account of disclosures.
Security Rule Compliance
  • Data Encryption: Use SSL/TLS encryption for all data transmitted between the patient and the website. Also, encrypt PHI that is stored or at rest.
  • Access Control: Implement role-based access control to ensure only authorized personnel have access to PHI. This includes secure login mechanisms like multi-factor authentication (MFA).
Breach Notification Rule Compliance
  • Develop a breach notification process that aligns with HIPAA’s requirements. If a data breach occurs, notify affected individuals, the Department of Health and Human Services (HHS), and, in some cases, the media within 60 days.
Business Associate Agreements (BAA)
  • Ensure all third-party vendors (such as web hosting providers, email marketing tools, and online appointment scheduling services) who handle PHI sign a Business Associate Agreement (BAA). This agreement mandates that these third parties comply with HIPAA regulations.
Risk Assessment and Management
  • Conduct regular risk assessments to identify and address vulnerabilities in the website’s data handling processes. Implement security measures to mitigate risks, such as firewalls, anti-malware software, and intrusion detection systems.
Secure Communication
Use secure communication channels, like encrypted email or patient portals, for sharing PHI. Avoid sending PHI through unencrypted email or other insecure methods.
Employee Training
Train all employees who handle PHI on HIPAA compliance, including privacy and security practices and breach notification procedures.
GDPR Compliance Requirements (If Applicable)
Although GDPR primarily applies to entities operating within the EU or handling the data of EU citizens, Dr. Sangita Pradhan’s website should still consider GDPR principles if it collects or processes data from EU citizens. The following requirements should be implemented:
Lawful Basis for Processing
Establish a lawful basis for collecting and processing personal data, such as obtaining explicit consent from patients before collecting their data or providing services.
Transparency and Consent
Provide clear information about data collection and processing purposes in plain language. Ensure that consent is specific, informed, freely given, and explicit (e.g., via an opt-in checkbox).
Data Subject Rights
Implement mechanisms to enable data subjects (patients) to exercise their rights under GDPR, including the right to access, rectification, erasure (the “right to be forgotten”), and data portability.
Data Minimization and Purpose Limitation
Limit data collection to only what is necessary for the intended purposes. Ensure that personal data is used only for the stated purpose and not retained longer than needed.
Data Security
Implement technical and organizational measures to secure personal data, including encryption, pseudonymization, and regular security audits.
Data Breach Notification

Notify relevant authorities (such as the GDPR supervisory authority if applicable) and affected individuals within 72 hours in the event of a data breach involving EU citizens’ data.

Appointment of a Data Protection Officer (DPO)
Consider appointing a Data Protection Officer (DPO) if the website processes large amounts of personal data or handles sensitive information regularly.
Additional Considerations:
  • Cookie Policy and Management: Provide a cookie consent notice that complies with both HIPAA and GDPR standards, allowing users to opt in or out of non-essential cookies.
  • Cross-border Data Transfer: If the website processes or transfers data between the U.S. and the EU, ensure compliance with GDPR’s data transfer rules, such as using Standard Contractual Clauses (SCCs).
Contact Us
If you have any questions or concerns about our HIPAA and GDPR compliance, please contact our Data Protection Officer:
Dr. Sangita Pradhan, MD
We are dedicated to ensuring the security of your personal and health information and respecting your privacy rights. Thank you for trusting Dr. Sangita Pradhan, MD with your care.

Dr. Sangita Pradhan is an independent health care provider specializing in primary care and internal medicine for adults.

Quick Links
Pay Your Bill
OUR SERVICES
CONTACT US
Connect on Social
Facebook Instagram

2025 © Dr. Sangita Pradhan

2025 © Dr. Sangita Pradhan

Design & Developed By Great Lakes.