Yes. Oana is a telehealth platform that handles Protected Health Information (PHI), which means Oana is required to follow the Health Insurance Portability and Accountability Act (HIPAA) — the federal law that governs how healthcare entities handle sensitive patient information in the United States.
What HIPAA covers, in plain language:
HIPAA protects information about your health, your healthcare, and the payment for your healthcare. This includes:
- Your medical history that you share with Oana during the intake
- Your symptoms, diagnoses, and treatment plans as evaluated by Oana clinicians
- Your prescriptions and medication history through Oana
- Communications with your clinician through messaging in your account
Payment information related to your treatment
Specific HIPAA protections that apply at Oana:
- Confidentiality. Your medical information cannot be disclosed to anyone outside your direct care team without your explicit authorization. This includes family members, employers, insurers, and other healthcare providers.
- Your right to access your records. You have the right to view and obtain copies of your medical records through Oana. You can request these through your account or by contacting support.
- Your right to corrections. If you believe information in your medical record is incorrect, you have the right to request a correction.
- Limits on use. Oana can use your information to provide your care and operate the platform — but not for marketing to third parties or other uses outside the scope of your care.
Breach notification. If there were ever a data breach affecting your information, you'd be notified as required by law.
- Audit trails. Access to your medical information is logged. Oana can demonstrate who accessed your records and when, if needed.
Coordination with other providers:
If you want Oana to share information with another healthcare provider — for example, your OB-GYN or primary care doctor — you can authorize that through your account. Without your authorization, Oana won't share your information with outside providers.
If you want another provider to share information with Oana — for example, sending bloodwork results to your Oana clinician — you'd typically need to authorize the other provider to send that information.
What HIPAA doesn't protect against:
A few important distinctions worth knowing:
- HIPAA protects your medical information held by Oana, but it doesn't extend to information you share elsewhere. If you discuss your treatment in a public forum, on social media, or with friends, that information isn't HIPAA-protected — only the information held by HIPAA-covered entities like Oana.
- Information you authorize Oana to share with other entities (other providers, family members, etc.) is no longer protected by Oana's HIPAA obligations once it leaves Oana's systems.
For specifics about Oana's HIPAA practices and your rights as a patient, see the Privacy Policy and the Notice of Privacy Practices.
If you have specific questions about HIPAA or how a particular privacy situation works at Oana, contact support at support@oanahealth.com.