Privacy Policy

---

At KMET Logistics, we understand that the pharmaceutical products, medical devices, and supplies we transport are integral to patient health. In the course of our delivery services, we are often entrusted with information that constitutes Protected Health Information (PHI) as defined by the Health Insurance Portability and Accountability Act (HIPAA) of 1996.

This document outlines our strict policies and practices concerning the use and disclosure of PHI. We are committed to maintaining the highest standards of confidentiality and security for all health information we handle.

 PHI is any individually identifiable health information that is created, received, maintained, or transmitted by a "covered entity" (like your hospital, pharmacy, or clinic) or their "business associate" (like KMeT Logistics). This information can relate to:

• The past, present, or future physical or mental health of an individual.
• The provision of healthcare to an individual.
• The past, present, or future payment for the provision of healthcare.

Common examples of PHI we may handle include, but are not limited to:

• Patient names, addresses, and phone numbers.
• Prescription details and medication names.
• Medical device serial numbers or identifiers linked to a patient.
• Doctor, clinic, or pharmacy names.
• Any other unique identifying information on a shipping label or manifest.

 KMET Logistics operates as a "Business Associate" under HIPAA. This means we perform activities on behalf of our healthcare clients (the "Covered Entities") that involve the use or disclosure of PHI. We do not provide healthcare services, process insurance claims, or manage patient treatment.

To formalize our commitment, we enter into a Business Associate Agreement (BAA) with each of our healthcare clients. This legally binding contract obligates KMeT Logistics to:

• Use and disclose PHI only as permitted by the BAA and HIPAA rules.
• Implement and maintain appropriate safeguards to prevent unauthorized use or disclosure of PHI.
• Report any security incident or breach of unsecured PHI to our client.
• Ensure our subcontractors also agree to protect the confidentiality of PHI.

  The security of PHI is our top operational priority. Our comprehensive safeguards include:

A. Administrative Safeguards:

• Training: All employees, including drivers and office staff, undergo mandatory, ongoing HIPAA compliance and security training.
• Policies & Procedures: We have developed and enforce strict internal policies governing the handling of PHI, from order intake to final proof of delivery.
• Risk Management: We conduct regular risk assessments to identify and mitigate potential vulnerabilities in our processes.

B. Physical Safeguards:

• Secure Facilities: Our warehouses and offices have controlled access. PHI in physical form (e.g., paper manifests) is stored in locked cabinets and is securely destroyed when no longer needed.
• Vehicle Security: Delivery vehicles are secured and locked when unattended to prevent theft or tampering with packages containing PHI.

C. Technical Safeguards:

• Secure Technology: Our electronic systems (dispatch software, tracking portals) are protected by secure login credentials, encryption, firewalls, and antivirus software.
• Access Controls: Employee access to electronic PHI is restricted on a "need-to-know" basis to perform their job duties.
• Secure Transmission: Data transmitted electronically is protected using industry-standard encryption technologies.

KMET Logistics uses and discloses PHI only for the following specific purposes:

• For Treatment: To ensure the correct medication or device is delivered to the correct patient at the correct location.
• For Logistics Operations: To coordinate pickups, manage inventory, track shipments in real-time, and provide proof of delivery.
• As Required by Law: To comply with a court order, subpoena, or other legal mandate.

We do not and will not sell PHI or use it for marketing purposes. 

 Despite our robust safeguards, no system is entirely without risk. In the unlikely event of a security breach involving your PHI, KMET Logistics is committed to:

1. Mitigating the breach to the best of our ability.
2. Notifying our affected healthcare client(s) without unreasonable delay, as required by our BAA and HIPAA law.
3. Cooperating fully with our client to manage the situation and comply with any required patient or regulatory notifications. 

As a patient, your HIPAA rights (such as the right to access, amend, or request an accounting of disclosures) are primarily exercised through the healthcare provider, pharmacy, or health plan that created your PHI (the Covered Entity). We support our clients in fulfilling these rights when necessary and as directed by them.

KMET Logistics is required by law to maintain the privacy and security of your PHI. We are legally bound to abide by the terms of this notice and our Business Associate Agreements. We reserve the right to change the terms of this notice, and any updates will be posted on our website.