ChartSwap is a secure health information platform where providers, patients, and businesses can securely exchange health records.

 

The ChartSwap platform facilitates the exchange of health records by making the process simple.

1. A provider, patient, or business (“requestor”) uses ChartSwap to request records.
2. The receiving provider reviews the request and determines whether it will provide the records. 
3. If the provider chooses to provide the records, it uploads them to ChartSwap. 
4. After the records are uploaded to ChartSwap, the requestor is notified.
5. The requestor uses ChartSwap to pay the custodian fee and download the records.
6. ChartSwap transfers the custodian fee to the provider of the records.

 

ChartSwap allows users to:

1. Utilize ChartSwap's database of providers or invite health care providers to join the ChartSwap network.
2. Submit record requests and patient authorizations securely online.
3. Check the status of requests and receive notification when an invoice has been submitted. Make payments online.
4. As soon as payment is submitted, access and download records. No waiting for a package to arrive.

 

Receive email notification when a new request has been submitted online, or log in to view new requests in your queue.

Review the scope of the request along with with any authorizations or attachments. Add the medical record fee and securely upload the requested chart. Sign any forms or certifications electronically.

Receive payment instantly through Paypal or choose to receive a check each month. Providers can also manage pending requests, track disclosures and share charts with other providers absolutely free.

 

Providers with paper health records can also use ChartSwap.  ChartSwap works with zPaper which will accept faxed records, convert them into electronic form, and upload them to ChartSwap for the provider.

 

ChartSwap collects other information from users to provide the service. 

 

Requestor.  To make a request for a patient’s health records, a requestor may be required to submit the patient’s name, date of birth, and social security number.  In addition, the requestor may be required to upload other documents, including the patient’s signed authorization form.  Some of these forms could include health information.  Before downloading the records, the requestor may need to submit payment information, including credit card or PayPal information.

 

Provider.  When a provider uploads a patient’s health records, the provider may also electronically sign any required forms or certifications using DocuSign.  ChartSwap may collect these forms and certifications, which may contain health information.

 

Website Usage.  ChartSwap may also collect anonymous platform usage information to comply with HIPAA disclosure requirements, perform internal security audits, and improve the service.

 

While ChartSwap is a platform for users to exchange health records, ChartSwap’s employees may be required, at times, to have access to health information, including health records and forms containing health information.  Only employees with admin-level security rights have access to health information.  All employees will receive HIPAA/privacy training to help ensure health information is accessed and used in accordance with HIPAA and other privacy requirements.

 

ChartSwap does not use patient records.  It provides a platform for requestors and providers to exchange patient records.  ChartSwap will only access patient records for a limited number of reasons, such as when it is necessary by law or for a customer service purpose.

 

ChartSwap will only share health information with requestors and providers as necessary to provide the service.  ChartSwap employs third parties as its agents to help it provide the service, and they may have access to health information.  They must comply with HIPAA, and ChartSwap has Business Associate agreements requiring each of them to provide the proper administrative, technical, and physical safeguards to protect the information and to only use the information to perform their duties to ChartSwap.

 

Salesforce.com.  Salesforce.com provides some of the underlying architecture to make ChartSwap work.  They will store information submitted by requestors and providers, which may contain health information.  The information will be encrypted, and ChartSwap users can only access the information with a secure log-in and password.

 

Amazon Web Services.  Amazon Web Services will provide the data storage for the health records that are uploaded using ChartSwap.  The health records will be deleted from Amazon Web Services within 10 days of them being downloaded by the requestor.

 

DocuSign.  DocuSign provides electronic signature services.  Some of the forms that will be electronically signed by providers or requestors may contain health information.  Docusign will delete the forms that contain health information, but it will maintain a signature history for the documents.

 

zPaper.  zPaper converts faxed health records into electronic form for use by the ChartSwap platform.  zPaper will destroy the faxed health records and delete the electronic health records after they have been uploaded to the ChartSwap platform.

 

ApeniMED.  ApeniMED helps ChartSwap exchange records with Medicare via the National Information Health Network.

 

ChartSwap may also use third-party service providers, such as PayPal, to facilitate payment.  Those service providers will not have access to any health information.

 

After a provider uploads health records to Amazon Web Services using the ChartSwap platform, the records will remain at Amazon for up to 10 days after the requestor has downloaded them.  As required by HIPAA, Amazon will implement reasonable safeguards to protect health records in connection with the disposal.

 

ChartSwap may retain other information about the transaction that does not include health information, such as the request date and the fulfillment date

.

No, ChartSwap is only a platform for exchanging health information.  Patients should contact their health care providers if their records are incorrect.

 

The HIPAA Security Rule requires appropriate administrative, physical and technical safeguards to ensure the confidentiality, integrity, and security of electronic protected health information.  ChartSwap and its third-party services providers comply with the Security Rule.

 

All health information and other sensitive information is encrypted by Salesforce.com and Amazon Web Services.  All ChartSwap users will use a secure SSL log-in and password. 

 

ChartSwap will manually authenticate requestors by cross-referencing NPI codes, phone numbers, and email addresses. ChartSwap calls users at the registered numbers to ensure the users are who they say they are and to validate the other contact information provided by the requestor.

 

ChartSwap provides a platform for requestors to request patient records, but does not participate in the process of determining whether the request is valid. The provider receiving the request is obligated to verify that the request is valid and will not upload the health records unless it determines the request is valid.

 

ChartSwap allows providers to fax paper health records to zPaper so it can be uploaded to the ChartSwap platform.  When a provider wants to fax paper health records, it will print a cover sheet from ChartSwap that will be faxed along with the health records.  The cover sheet will include instructions to immediately delete the records if they are received in error.

 

If a provider mistakenly uploads the wrong records in a response to a request, the requestor is obligated under our user agreement to immediately delete the records once notified by the provider or ChartSwap.

 

ChartSwap will send an email to the requestor using the email address we have manually authenticated when the requestor registered with ChartSwap.  That email will contain a link to the health records on ChartSwap.  Before downloading the information, the requestor will be obligated to log in using its unique log-in/password combination.

 

If for some reason ChartSwap sends an email to an incorrect recipient, that incorrect recipient will not have access to the health records, because that recipient will need to log in to ChartSwap using the account that made the request.