HIPAA & Compliance Policy

This policy describes how LS Consulting Solutions LLC fulfills its obligations as a HIPAA Business Associate for home health clients and its confidentiality obligations for RCFE facility clients.

Overview

LS Consulting Solutions LLC is committed to the highest standard of protection for all patient and resident information received in connection with its documentation support services. This policy describes how LS Consulting Solutions LLC fulfills its legal obligations with respect to two categories of sensitive information:

• Protected Health Information (PHI)received from licensed home health agency clients in connection with pre-submission quality assurance review services, governed by HIPAA and the applicable Business Associate Agreement

• Resident informationreceived from licensed RCFE facility clients in connection with LIC form preparation and binder organization services, governed by applicable California privacy law and the applicable Confidentiality Agreement

Foundational principle

No patient PHI and no resident information of any kind is submitted, received, accessed, reviewed, or transmitted by LS Consulting Solutions LLC until the applicable agreement — Business Associate Agreement for home health clients, Confidentiality Agreement for RCFE clients — is fully executed. This requirement admits of no exception.

LS Consulting Solutions as a Business Associate — home health clients

LS Consulting Solutions LLC meets the definition of a Business Associate under HIPAA with respect to each licensed home health agency client for which it performs pre-submission quality assurance review services, as such services require access to PHI contained in patient charts. As a Business Associate, LS Consulting Solutions LLC is directly subject to the HIPAA Security Rule (45 C.F.R. Parts 160 and 164, Subparts A and C) with respect to electronic PHI and the Breach Notification Rule (45 C.F.R. Parts 160 and 164, Subparts A and D) with respect to unsecured PHI.

LS Consulting Solutions LLC does not function as a covered entity. It does not provide healthcare services, make clinical determinations or diagnoses, assign or finalize ICD-10 diagnostic codes, or submit claims to health plans or insurers.

Business Associate Agreement — home health clients

A fully executed Business Associate Agreement (BAA) between LS Consulting Solutions LLC and each home health agency client is a mandatory prerequisite to the commencement of any QA review service. No patient chart or PHI of any kind will be received, accessed, or reviewed absent a signed BAA on file.

The BAA governs the permissible uses and disclosures of PHI, requires appropriate safeguards, establishes breach notification obligations, ensures subcontractor compliance, and requires return or destruction of PHI upon termination. Prospective home health clients may request a copy of the standard BAA at any time by contacting info@lsconsultingsolutions.com.

PHI transmission methods — home health clients

LS Consulting Solutions LLC supports two HIPAA-compliant methods for PHI transmission by home health agency clients:

4.1 — Dropbox Business upload (agencies without EMR)

Agencies that store patient chart documents outside an electronic medical record system upload required documents via a designated HIPAA-compliant Dropbox Business shared folder established specifically and exclusively for that client agency. Dropbox Business is a HIPAA-eligible platform configured with access controls, audit logging, and encryption of data at rest and in transit. Each agency's folder is segregated from all other clients.

4.2 — Dedicated EMR user login (agencies with EMR)

Agencies that maintain patient chart documents within an online EMR provide LS Consulting Solutions LLC with a dedicated individual user login established specifically for LS Consulting Solutions LLC's use. This login is used exclusively to access the specific charts submitted for review. No broader system access is requested, used, or permitted.

4.3 — Prohibited transmission methods

PHI must not be transmitted to LS Consulting Solutions LLC through unencrypted email, unsecured file sharing services, text message, SMS, any form on this website, or any channel not expressly established during onboarding.

Resident information — RCFE clients

Resident information received from RCFE facility clients is not governed by HIPAA to the same extent as PHI from home health clients, as most RCFEs are not HIPAA covered entities. However, resident information contains sensitive personal and medical data and is protected by applicable California privacy law, including the Confidentiality of Medical Information Act (Cal. Civ. Code § 56 et seq.).

5.1 — Confidentiality Agreement required

A fully executed Confidentiality Agreement between LS Consulting Solutions LLC and each RCFE facility client is a mandatory prerequisite to the receipt of any resident source documents. No resident information of any kind will be received or accessed absent a signed Confidentiality Agreement on file.

5.2 — Resident information transmission

RCFE facility clients submit source documents exclusively through a designated secure Dropbox Business shared folder established specifically for that client facility during onboarding. Completed forms and organized binders are uploaded to the same folder by LS Consulting Solutions LLC upon completion. Both the facility and LS Consulting Solutions LLC maintain secure access to the shared folder at all times.

Safeguards and security — both services

LS Consulting Solutions LLC implements and maintains comprehensive administrative, physical, and technical safeguards to protect all sensitive information it receives in connection with both services:

6.1 — Administrative safeguards

• Security management processes to identify and mitigate risks to sensitive information

• Access management policies limiting information access to authorized personnel with a legitimate need

• Training on applicable privacy and security requirements

• Regular evaluation and review of security practices

6.2 — Technical safeguards

• Use of Dropbox Business, a HIPAA-eligible platform with enterprise-grade encryption at rest and in transit

• Unique user identification and access controls for all systems containing sensitive information

• Audit controls recording access to sensitive information systems

• Transmission security including encryption for all sensitive information transferred electronically

Breach notification — home health clients

In the event of a discovered or suspected breach of unsecured PHI, LS Consulting Solutions LLC will conduct a four-factor risk assessment as required by the HIPAA Breach Notification Rule, notify the affected home health agency client without unreasonable delay and in no event later than sixty (60) calendar days following discovery, and cooperate fully with the covered entity in fulfilling its own notification obligations to individuals, HHS, and where applicable the media.

Report suspected incidents immediately

Clients who become aware of a suspected security incident involving information shared with LS Consulting Solutions LLC must notify us immediately at info@lsconsultingsolutions.com or (747) 260-5460.

Retention and disposal

LS Consulting Solutions LLC retains PHI and resident information only for as long as necessary to complete the applicable service and fulfill obligations under the applicable agreement and applicable law. Upon termination of the service relationship, LS Consulting Solutions LLC will, where feasible, return or destroy all sensitive information received from the client in accordance with the terms of the applicable BAA or Confidentiality Agreement. All information disposed of will be rendered unreadable and unable to be reconstructed.

State law considerations

LS Consulting Solutions LLC serves home health agencies across all 50 states and RCFE facilities in California. Where applicable state privacy law is more protective of patient or resident privacy than federal law, LS Consulting Solutions LLC will comply with the more stringent standard. California imposes specific healthcare privacy protections under the Confidentiality of Medical Information Act and other applicable statutes. RCFE facility clients operating in California should ensure that their disclosure of resident information to LS Consulting Solutions LLC is consistent with applicable California law and any resident consents or authorizations maintained by the facility.

Contact and reporting

• Email:info@lsconsultingsolutions.com

• Phone:(747) 260-5460