OvaShiftOvaShift
Log inGet started
Effective: June 29, 2026

HIPAA Notice of Privacy Practices

This Notice describes how health information about you may be used and disclosed and how you can get access to this information.

Please review this Notice carefully.

1. Our Commitment to Your Privacy

OvaShift Inc. is committed to protecting the privacy of your Protected Health Information ("PHI") as required by the Health Insurance Portability and Accountability Act of 1996 ("HIPAA") and its implementing regulations. This Notice of Privacy Practices ("Notice") applies to PHI that OvaShift creates, receives, maintains, or transmits in its role as a healthcare staffing platform.

OvaShift may act as a Business Associate to Covered Entities (healthcare facilities) to whom we provide staffing services. In that capacity, we handle PHI only as permitted by our Business Associate Agreements and by HIPAA.

2. What is Protected Health Information?

PHI includes any information that relates to your past, present, or future physical or mental health condition, the provision of healthcare to you, or payment for healthcare services, and that can be used to identify you. This may include your name, address, dates of service, diagnosis codes, or treatment information that appears in connection with our staffing services.

3. How We May Use and Disclose PHI

3.1 Treatment, Payment & Healthcare Operations

We may use and disclose PHI for treatment coordination, payment processing, and healthcare operations as permitted by HIPAA without requiring your additional authorization. Examples include:

  • Sharing credential and licensure information with Facilities to staff clinical shifts;
  • Communicating shift assignments and clinical role requirements with Workers;
  • Processing timesheets and payroll records associated with healthcare services rendered.

3.2 Required by Law

We will disclose PHI when required by federal, state, or local law, including disclosures to public health authorities, law enforcement, or the Secretary of the U.S. Department of Health and Human Services.

3.3 Business Associates

We may share PHI with vendors and service providers (Business Associates) who help us operate — such as payroll processors, background check providers, and cloud hosting services — under written Business Associate Agreements that require them to protect PHI appropriately.

3.4 With Your Authorization

For uses and disclosures not described above, we will obtain your written authorization. You may revoke an authorization in writing at any time, except where we have already relied on it.

4. Your Rights Regarding PHI

4.1 Right to Inspect and Copy

You have the right to inspect and obtain a copy of your PHI held by OvaShift. We may charge a reasonable cost-based fee. To request access, contact our Privacy Officer.

4.2 Right to Amend

If you believe your PHI is inaccurate or incomplete, you may request an amendment. We may deny the request under certain circumstances and will provide you with a written denial.

4.3 Right to an Accounting of Disclosures

You have the right to request a list of certain disclosures of your PHI made by OvaShift in the past six years. This does not include disclosures for treatment, payment, or healthcare operations.

4.4 Right to Request Restrictions

You may request that we restrict certain uses and disclosures of your PHI. We are not required to agree to all requests, but where we do agree we will honor the restriction.

4.5 Right to Confidential Communications

You may request that we communicate with you about PHI in a specific way or at a specific location. We will accommodate reasonable requests.

4.6 Right to a Paper Copy of This Notice

You may request a paper copy of this Notice at any time, even if you received it electronically.

5. Our Duties

OvaShift is required by law to:

  • Maintain the privacy of your PHI;
  • Provide you with this Notice of our legal duties and privacy practices;
  • Notify you following a breach of unsecured PHI; and
  • Abide by the terms of the Notice currently in effect.

6. Breach Notification

If a breach of unsecured PHI occurs that affects you, OvaShift will notify you in writing within 60 days of discovery of the breach, as required by the HITECH Act. The notification will include a description of the breach, the types of PHI involved, steps you can take to protect yourself, and what OvaShift is doing to investigate and prevent future breaches.

7. Changes to This Notice

We reserve the right to change the terms of this Notice and to make the new terms effective for all PHI we maintain. The current Notice will always be available on our website and upon request.

8. Complaints

If you believe your privacy rights have been violated, you may file a complaint with:

We will not retaliate against you for filing a complaint.

9. Contact Our Privacy Officer

For questions about this Notice or to exercise any of your rights:
OvaShift Privacy Officer
privacy@ovashift.com
528 Chelmsford Street, Floor 2, Lowell, MA 01851
Tel: (512) 555-0100