Legal
HIPAA Notice
Every scholar, mentor, and host practice operates under these privacy obligations. Completion of HIPAA training and a signed confidentiality agreement is required before any clinical contact.
Scope
Protected health information
Protected health information (PHI) is any individually identifiable health information created or received by a covered entity, including names, dates, contact details, record numbers, images, and any other identifier that could reasonably identify a patient.
Scholars participate as observers. They do not diagnose, treat, document, or hold electronic health record credentials. Access to PHI is incidental to observation and is limited to what is necessary for the learning experience under direct supervision.
Obligations
Rules that apply to every participant
- Complete HIPAA training and sign the confidentiality agreement before the first clinical day
- Never discuss patients outside the care setting, including with family or classmates
- No photography, video, audio recording, or personal device use in clinical or procedural areas
- No social media posting about patients, cases, or clinic operations, even deidentified
- Patients may decline the presence of an observer at any time, without explanation
- Report any suspected privacy incident to the supervising physician and program office immediately
Research
Deidentification standard
All research and outcomes data discussed publicly by the program is deidentified using the HIPAA Safe Harbor method (45 CFR 164.514(b)(2)): all eighteen identifiers are removed, and there is no actual knowledge that the remaining information could be used to identify an individual.
Mentors prepare and deidentify datasets before scholars access them. Where a project is intended for publication, a written IRB exemption determination is requested before data collection. See the Research page for full ethics guidance, and the compliance checklist for onboarding requirements.
This notice describes program obligations and is not a substitute for a host practice's own Notice of Privacy Practices provided to patients.