HIPAA Authorization

HIPAA authorization

Medipply offers services, such as helping you to find and learn about relevant medical device suppliers, of your choice – managing and forwarding your health history forms and other health-related information.

 As part of providing the Medipply Services, Medipply may collect, use, share, and exchange your health history forms and other health-related information with your medical device suppliers. Under a federal law called the Health Insurance Portability and Accountability Act (“HIPAA”), some of this health and health-related information may be considered “protected health information” or “PHI” if such information is received from or on behalf of your medical device suppliers.

Safeguards for PHI

HIPAA protects the privacy and security of your PHI by limiting the uses and disclosures of PHI by most medical device suppliers and by health plans (called “Covered Entities”) as well as companies, like Medipply, that provide certain types of assistance to Covered Entities (called “Business Associates”). Under certain circumstances described in HIPAA, an individual needs to sign an Authorization form before a Covered Entity, like your medical device suppliers, can disclose protected health information to a third party.

Non-Protected Health Information

As a condition of creating your Medipply account, you are required to read and agree to Medipply’s Privacy Policy. Medipply’s Privacy Policy explains how Medipply processes and shares information received from you that is not covered by HIPAA (“Non-PHI”).

Your PHI Authorization

The purpose of this Medipply Authorization (“Authorization”) is to request your written permission to allow Medipply to use and disclose your PHI in the same way as we use and disclose your Non-PHI. If Medipply is a Business Associate of your medical device suppliers, Medipply needs your Authorization to be able to use and disclose your PHI in the same way it can currently use and disclose your Non-PHI when Medipply is not working on behalf of your medical device suppliers, but is instead working on its own behalf. Therefore, when Medipply relies on this Authorization, and uses and discloses PHI as described in this Authorization, it is not working as a Business Associate and the HIPAA requirements that apply to Business Associates will not apply to such uses and disclosures.

If you e-sign this Authorization, you give your permission to Medipply to retain your PHI and to use and/or disclose your PHI in the same way that you have agreed that your Non-PHI can be used and disclosed.

Specifically, you agree that Medipply can use your PHI to: enable and customize your use of the Medipply Services; notify you regarding supplier we think you may be interested in learning more about; share information with you regarding services, products or resources about which we think you may be interested in learning more; provide you with updates and information about the Medipply Services; market to you about Medipply and third party products and services; conduct analysis for Medipply’s business purposes; support development of the Medipply Services; and create de-identified information and then use and disclose this information in any way permitted by law, including to third parties in connection with their commercial and marketing efforts.

You also agree that Medipply can disclose your PHI to: third parties assisting Medipply with any of the uses described above; your medical device suppliers to enable them to refer you to other suppliers on your behalf, provided that you choose to use the applicable Medipply Service; a third party as part of a potential merger, sale or acquisition of Medipply; our business partners who assist us by performing core services (such as hosting, billing, fulfillment, or data storage and security) related to the operation or provision of our services, even when Medipply is no longer working on behalf of your medical device suppliers; a supplier of medical supplies, in the event of an emergency; and organizations that collect, aggregate and organize your information so they can make it more easily accessible to your suppliers.


If Medipply discloses your PHI, Medipply will require that the person or entity receiving your PHI agrees to only use and disclose your PHI to carry out its specific business obligations to Medipply or for the permitted purpose of the disclosure (as described above). Medipply cannot, however, guarantee that any such person or entity to which Medipply discloses your PHI or other information will not re-disclose it in ways that you or we did not intend or permit.

Expiration and Revocation of Authorization

Your Authorization remains in effect until you provide written notice of revocation to Medipply.


If you wish to revoke this Authorization, you must notify Medipply by submitting a revocation through your account settings page. Your decision not to execute this Authorization or to revoke it at any time will not affect your ability to use certain of the Medipply Services. A Revocation of Authorization is effective after you submit it to Medipply, but it does not have any effect on Medipply’s prior actions taken in reliance on the Authorization before revoked.

Once Medipply receives your Revocation of Authorization, Medipply can only use and disclose your PHI as permitted in Medipply’s agreements with your medical device suppliers (s). Your Revocation of Authorization does not affect Medipply’s use of your Non-PHI.

We will make available to your medical device suppliers (s), current and past, your agreement to or revocation of this Authorization.