Incident Reporting
Suspected data breaches or security concerns must be reported immediately.
Report a Security or Compliance Concern
Security incidents (suspected breach, data exposure, phishing, lost or stolen device): secops@medsuite.com
Compliance and privacy concerns: compliance@medsuite.com
These are monitored mailboxes reviewed by MedSuite Security & Compliance, not individual inboxes. They cover all MedSuite companies. If unsure, use either address — your report will reach the right team.
What to expect once reported:
- Acknowledgment of receipt
- Formal documentation in our tracking system
- Regular updates on the status throughout the incident lifecycle
HR & Ethics Hotline
MedSuite provides a confidential hotline for reporting workplace concerns, including harassment, discrimination, ethics violations, or any other matter requiring human resources attention.
Contact: James Barrett, Director of Security & Compliance
Phone: 865-384-7865
Email: james.barrett@medsuite.com
Alternate contact (independent of the Director of Security & Compliance): Ken Clegg, Virtual CISO — ken.clegg@greatersumventures.com
Human resources matters may also be raised directly with Jason Vandenbogaard, Chief Financial Officer (Human Resources) — jason.vandenbogaard@medsuite.com
- All reports are treated as confidential to the extent permitted by law
- Retaliation against anyone who makes a good-faith report is strictly prohibited
- Reports may be made anonymously if preferred
- Matters will be investigated promptly and fairly
Privacy
How MedSuite companies protect the information entrusted to them.
PHI (Protected Health Information)
Any information in a medical context that can identify an individual and relates to their past, present, or future physical or mental health condition, healthcare provided, or payment for healthcare. It is a subset of PII but specifically pertains to health data and is protected under HIPAA. Examples include medical records, insurance information, or details of doctor visits tied to a person.
PII (Personally Identifiable Information)
Any data that can identify an individual, either directly (like a name, Social Security number, or email address) or indirectly (like combining a ZIP code and birth date to identify someone). PII is a broader category that encompasses any personal information, not just healthcare-related information.
Our Commitment
- Where a MedSuite company handles PHI on behalf of a healthcare organization, it does so under a Business Associate Agreement and only for the purposes that agreement allows.
- MedSuite does not sell, rent, or share PII or PHI with any party for marketing or commercial purposes.
- Company-wide policies, including our policy on handling PHI and exchanging files with customers, apply across all MedSuite companies.
Compliance
Our commitment to regulatory standards and best practices.
- MedSuite is committed to maintaining compliance with all applicable laws and regulations governing the privacy and security of PII and PHI, including HIPAA and HITECH.
- Each MedSuite company maintains its own compliance program, assessments, and certifications, with oversight from MedSuite Security & Compliance.
- Policies and procedures are reviewed and updated to reflect changes in regulations and best practices.
- Certifications and independent assessments are held at the company level. See each company’s compliance page below, or contact compliance@medsuite.com.
Our Companies
Compliance information for each MedSuite company.
Leadership & Designations
MedSuite leadership and the roles responsible for security, compliance, and oversight.
Contact
MedSuite corporate office.
MedSuite
2035 Lakeside Centre Way, Suite 180
Knoxville, TN 37922
Security: secops@medsuite.com
Compliance & privacy: compliance@medsuite.com
General inquiries: contact@medsuite.com