The Dictation Source, LLC
Health Insurance Portability And Accountability Act
(HIPAA) Policy

REVISED APRIL 15, 2002

Business Associate Contracts

The HIPPA standards protect all "individually identifiable health information" ("I.I.H.I.") that is transmitted electronically, maintained electronically or maintained in any other form or medium. In simpler terms, the HIPPA standards protect all individually identifiable health information whether in paper, electronic or even verbal form.

Before healthcare providers may disclose I.I.H.I. to a "business associate", they must obtain satisfactory assurance that the business associate will appropriately safeguard the information.

For this reason The Dictation Source(TDS) provides the following safeguards on the use and transfer of all I.I.H.I.:

1. TDS assigns every individual using the dictation phone system a password. No one can access specific information without the use of the providers password.
2. Voice files that are transmitted over the Internet are transferred via a secure file transfer protocol that is encrypted and password protected.
3. Physical access to our network and facility is secured with ID Cards, locked access, and alarm systems.
4. The Dictation Source never transmits data through direct web transfers. All transmitted data is transferred using secure FTP's.
5. Clients requesting files via email must sign written consent forms; however, The Dictation Source does not recommend the use of email for transmitting I.I.H.I..
6. Desktop access to all files, both voice and text is secured with password/log-on protection.
7. In addition, all Dictation Source employees receive HIPAA instruction as a part of their orientation and sign confidentiality agreements as a term of employment.
8. All individuals working with I.I.H.I. entrusted to TDS are employees of TDS. We do not outsource any of our transcription work.
9. Transfer of I.I.H.I. between company computers and client computers requires positive identification of both IP addresses and user information.
10. No I.I.H.I. is posted on unsecured portions of the World Wide Web.
11. Any I.I.H.I. sent via the Internet is broken up into discreet packets ( much like a very complex jig saw puzzle) that cannot be deciphered if inadvertently intercepted by an unauthorized recipient.

The Dictation Source's Company Policy
regarding HIPAA and IIHI Security is as follows:

The Dictation Source (TDS) may be permitted to use protected health information ("Information") as described by the Health Insurance Portability and Accountability Act ("HIPAA") and the privacy regulations in 45 CFR Part 160 (the "HIPAA Regulations") only in performance of its contractual duties for a healthcare provider (Agency). TDS will not use sub-contractors to perform any work for the agency. All work sent to TDS from an agency will be completed by TDS or its partner companies. TDS will not use or further disclose the information in a manner that would violate the requirements of HIPAA, except that:

1. TDS may only use and disclose protected health information for the proper management and administration of its business, as provided in §164.504(e)(4) of the HIPAA Regulations; and
2. TDS may provide data aggregation services relating to the health care operations of the covered entity such as management and billing reports.

TDS shall:

1. Not use or further disclose the information other than as permitted or required by the contract or as required by law;
2. Use appropriate safeguards to prevent use or disclosure of the information other than as provided for by its contract;
3. Report to the Agency any use or disclosure of the information not provided for by its contract of which it becomes aware;
4. Ensure that each business associate to whom it provides protected health information received from the Agency, or created or received by TDS, agrees to the same restrictions and conditions that apply to the TDS with respect to the information;
5. Make available information in accordance with §164.524 of the HIPAA Regulations;
6. Make available information for amendment and incorporate any amendments to information in accordance with §164.526 of the HIPAA Regulations;
7. Make available the information required to provide an accounting of disclosures in accordance with §164.528 of the HIPAA Regulations;
8. Make its internal practices, books and records relating to the use and disclosure of information received from, or created or received by it, on behalf of the Agency, available to the Secretary for purposes of determining the Agency's compliance with applicable HIPAA Regulations;
9. At termination of the contract, return or destroy all information received from, or created or received by it, on behalf of, the Agency's that it still maintains in any form and retain no copies of such information; and,
10. Comply with all other relevant sections of the HIPAA Regulations as amended from time to time.

Agency may terminate contract if it determines that the TDS has violated a material term of this HIPAA Confidentiality Policy

FOR THE AGENCY

James B. Winkler
President and CEO