1. Purpose and scope
These policies set out the patient privacy and security requirements that apply whenever CloudNook staff handle client or patient information across CloudNook engagements. They apply to every nurse, team member and contractor working with a client practice. All work is performed in strict adherence to the Business Associate Agreement signed with each client and to all applicable law, including HIPAA and state privacy laws.
2. Privacy and permitted use
Patient information stays strictly inside the client's EHR and approved tools. Staff may not copy, print, photograph or store patient information on personal devices or in any unapproved system.
- No copying, printing or downloading of patient information outside the client's systems.
- No patient information on personal devices, personal email or personal cloud storage.
- No storage of patient information in any tool the client has not approved.
Staff draft and route clinical work for physician review. They never diagnose, prescribe or make clinical decisions.
3. Workspace, devices and access
Every staff member works from a verified, private setup:
- A dedicated private room with a closed door, free from household traffic and eavesdropping.
- Encrypted computers used only for work, with screen lock enabled.
- Operating system, browser and security software kept up to date.
- Each setup is verified by CloudNook before the staff member handles any patient information.
4. HIPAA training
- HIPAA certification is required before any staff member handles patient data.
- Annual refresher training is required to stay current on privacy and security rules.
- Practice training EHRs and any sample data used in training are treated as confidential.
5. Incident reporting
Any suspected privacy or security issue must be reported the same day, and in all cases within 24 hours, to CloudNook and the client practice. This includes lost devices, misdirected messages, suspected unauthorized access and any accidental disclosure, however small it may seem.
6. Monitoring and verification
- Routine time tracking is required during working hours. Screenshots are blurred to protect patient information and are deleted after 90 days.
- Every 90 days, each staff member confirms in writing that no patient data is held locally on any device or personal account.
7. Ending engagement
When an engagement ends, all credentials, files and materials must be returned immediately or destroyed with certified proof of destruction. Privacy duties continue after the engagement ends: patient information learned during the engagement must never be used or disclosed.
8. Updates and inquiries
We may update these policies from time to time and will post the current version on this page. Questions about these policies or about how patient information is handled can be sent to compliance@mycloudnook.com.
9. About CloudNook
The CloudNook services (the “Services”) are provided by Masterful Ventures LLC, a New Mexico limited liability company, doing business as “CloudNook” (the “Company”). CloudNook operates as a staffing and matching service that introduces vetted, Philippine-based medical virtual assistants (“MVAs”) to independent United States healthcare practices, and as an educational provider offering related training. The Company is not a healthcare provider, a covered entity as defined under HIPAA, a professional employer organization, a law firm, an accounting firm, or a healthcare clearinghouse.
10. No Medical, Legal, or Professional Advice
Content published on the Sites, in webinars, in marketing materials, and in training programs is provided for general educational and informational purposes only. It does not constitute, and should not be relied upon as, medical, legal, tax, compliance, billing, or other professional advice. You should consult a qualified professional licensed in your jurisdiction before acting on any information provided by or through the Services.
11. HIPAA and Protected Health Information
The Company’s posture with respect to the Health Insurance Portability and Accountability Act of 1996, as amended (“HIPAA”), is as follows:
- Non-solicitation of PHI. In the ordinary course of matching, sales, marketing, and support, the Company does not solicit and does not want to receive Protected Health Information (“PHI”) as defined by HIPAA. Do not submit PHI through the Sites, contact forms, chat, or email.
- Business Associate status. Where a Client’s use of a placed MVA necessarily involves the disclosure of PHI to the Company or to the MVA acting on the Company’s behalf, the Company will execute a written Business Associate Agreement (“BAA”) with the Client before any such PHI is disclosed. The BAA, once executed, controls with respect to the handling of PHI.
- Direct engagement of MVAs by Client. Where the Client engages an MVA directly under the Client’s own workforce policies, the MVA is a member of the Client’s workforce for HIPAA purposes, and the Client is responsible for training, sanctions, and safeguards applicable to that workforce member.
- Safeguards. The Company maintains administrative, technical, and physical safeguards that are reasonable and appropriate to the scope of its role, including access controls, encryption in transit, workforce training, and remote-environment reviews for MVAs.
- Incidental disclosures. Any incidental PHI received by the Company outside of an executed BAA will be handled with reasonable safeguards and returned or destroyed. Sending PHI to the Company outside a BAA does not create a business-associate relationship.
12. Scope of Practice
MVAs placed through the Services are administrative and clinical-support personnel. They do not diagnose, treat, prescribe, or render clinical judgment, and they do not provide medical advice to patients. The Client is solely responsible for ensuring that tasks assigned to an MVA are consistent with applicable law, professional licensure requirements, and the standard of care in the Client’s jurisdiction. Under no circumstance shall an MVA be asked to perform an act that requires a license the MVA does not hold in the relevant jurisdiction.
13. No Guarantee of Results
Testimonials, case studies, income statements, and performance figures presented in connection with the Services reflect the experience of specific individuals or practices and are not representative of the results any particular Client or applicant should expect. Individual results depend on many factors, including practice setup, workflows, patient volume, and effort. The Company does not guarantee any specific clinical, operational, or financial result.
14. Third-Party Content and Integrations
The Services may reference, link to, or integrate with third-party platforms, including electronic health record systems, scheduling tools, and communication services. The Company does not endorse, is not responsible for, and makes no representations regarding the availability, accuracy, security, or terms of any third-party product or service. Your use of a third-party service is governed by that service’s own terms and privacy policy.
15. Forward-Looking Statements
Statements on the Sites and in marketing materials that are not historical facts, including projections about time savings, revenue impact, or workflow changes, are forward-looking. Actual results may differ materially. The Company undertakes no obligation to update forward-looking statements.
16. Fair Use and Verified Claims
Claims made on the Sites about Philippine-trained nurses in United States healthcare, including the share of United States registered nurses trained in the Philippines and the duration of United States recruitment relationships, are drawn from publicly available government and industry data. The Company relies on such sources in good faith and does not independently audit them.
17. Governing Law
This page is governed by, and construed in accordance with, the laws of the State of New Mexico, without regard to conflict-of-laws principles.
18. Contact
For BAA requests, HIPAA-related inquiries, or questions about this page, please contact:
Masterful Ventures LLC (d/b/a CloudNook)
Attn: Compliance
Email: compliance@mycloudnook.com