Authorization to share health information with a third-party app

Please read this carefully before connecting your health data. By proceeding, you acknowledge and agree to the following:

You’re asking Devoted Health (“we” or “us”) to share your Protected Health Information (“data”) with a third-party application developer (“App”).

This may include claims history, clinical records, medication lists, and other sensitive information.

Devoted Health doesn’t control your data once it leaves our system. 

Once we send your data to the App, it’s no longer protected by our internal security systems and we’re not responsible for its security, privacy, or integrity. If any breach, unauthorized access, or misuse of your data occurs within the app or as a result of the app's security practices, we’re not liable — and we won’t be able to notify you. 

Unlike Devoted Health, federal data privacy laws may not apply to this App.

Most third-party apps are not covered by the Health Insurance Portability and Accountability Act (HIPAA). Depending on their own privacy policy, they may be able to share or sell your data to others. And they may not be legally required to tell you if your data is hacked or stolen.

We strongly recommend that you review the App’s privacy policy and terms of service before connecting, to get answers to questions like:

• Will this App use your data for marketing, or sell it to advertisers or other companies?
• Will the App share your data with others without asking you first?
• Does the App have a security policy? Do they use encryption to protect your records?
• Does the App allow you to permanently delete your data if you stop using their service?

You can revoke this App's access to future health data sharing.

You can do this in your Devoted Health member portal settings at any time. Revoking access stops future data sharing, but it does not delete data that the app has already received.

You have the right to file a complaint.

If you believe this App has misused your data or misled you, you can file a complaint with the Federal Trade Commission (FTC) at reportfraud.ftc.gov/assistant. 

You can also file a complaint with the Office for Civil Rights (OCR) at hhs.gov/hipaa/filing-a-complaint. But OCR may not have authority over third-party apps, because HIPAA typically doesn’t apply to them.

Devoted may deny or stop data sharing for safety reasons.

Consistent with federal regulations (including 42 CFR 422.119(e), 431.60(e), and 45 CFR 156.221(e)), Devoted Health reserves the right to deny, terminate, or suspend the App's access to your health data if we determine that allowing access would endanger our own systems or result in an unacceptable security risk.