TFSurvey's HIPAA Compliance Framework
TFSurvey operates as a Business Associate under HIPAA for all research engagements involving covered entities — pharmaceutical companies, hospital systems, health plans, and their business associates. Our compliance framework addresses every stage of the research lifecycle, from panel recruitment through data delivery and retention.
What HIPAA Governs in Healthcare Panel Research
HIPAA's Privacy and Security Rules apply to Protected Health Information (PHI) — individually identifiable health information about patients. Most physician panel market research does not collect patient PHI; it collects healthcare professionals' professional opinions, prescribing patterns, and clinical perspectives. TFSurvey's panel surveys are designed to operate squarely within the market research context, without creating obligations that would require IRB oversight of a research study involving human subjects.
What TFSurvey does not collect: patient identifiers, individual patient records, patient outcomes linked to identifiable individuals, or any information that would constitute PHI under HIPAA definitions.
Business Associate Agreements
TFSurvey executes Business Associate Agreements (BAAs) for all engagements with HIPAA covered entities and their business associates. Our standard BAA covers:
- Permitted uses and disclosures of PHI (where any tangential PHI might arise)
- Safeguards appropriate to the sensitivity of information handled
- Sub-processor agreements covering CalibraSync and cloud infrastructure providers
- Breach notification procedures consistent with HIPAA requirements
- Data return or destruction procedures at engagement conclusion
Data Security Safeguards
TFSurvey implements Administrative, Physical, and Technical safeguards consistent with HIPAA Security Rule requirements:
- Encryption in transit and at rest for all research data using AES-256 encryption standards
- Access controls limiting research data access to personnel with documented legitimate need
- Audit logging of all data access events for compliance documentation
- Workforce training on HIPAA requirements for all personnel handling research data
- Incident response procedures with defined escalation paths and notification timelines
NPI Verification and Panelist Privacy
Healthcare professional panelists participate voluntarily with explicit informed consent. NPI verification is conducted to confirm professional credentials — it does not involve accessing or retaining any patient records or PHI associated with the NPI holder's practice. Panelist data is managed in accordance with our data minimisation policies and retained only as long as necessary for panel management and research purposes.
Requesting HIPAA Compliance Documentation
Research clients requiring HIPAA compliance documentation — including BAA templates, data handling policy summaries, or security safeguard descriptions — should contact us through the feasibility request form. We provide compliance documentation as part of the project onboarding process for all regulated engagements.