Login
Request a Quote

Privacy & Confidentiality

HIPAA Privacy & Confidentiality Policy

Governing the handling of Protected Health Information in language services engagements

Company

Translation Excellence, Inc.

Effective Date

June 18, 2026

Last Reviewed

June 18, 2026

Role

HIPAA Business Associate
Contents
  • Introduction & Scope
  • Our Role Under HIPAA
  • What Is PHI?
  • Permitted Uses & Disclosures
  • Prohibited Uses & Disclosures
  • Interpreter Confidentiality
  • Safeguards & Security
  • Business Associate Agreements
  • Breach Notification
  • Your Rights Regarding PHI
  • Training & Accountability
  • Complaints & Contact

Translation Excellence, Inc. is committed to protecting the privacy and confidentiality of all health information we encounter in the course of providing language services. This policy governs how we handle Protected Health Information (PHI) as a HIPAA Business Associate and establishes the standards our interpreters, translators, and staff are required to follow when working in healthcare settings.

01
Introduction & Scope

Translation Excellence, Inc. (“Translation Excellence,” “we,” “us,” or “our”) provides professional interpreting, translation, and accessibility services (including ASL and CART) to healthcare organizations, hospitals, clinics, and other covered entities. In the course of providing these services, our personnel may encounter or have access to Protected Health Information (PHI) belonging to patients and healthcare recipients.

This HIPAA Privacy & Confidentiality Policy applies to:

  • All Translation Excellence employees, contractors, and independent interpreters
  • All translation and interpreting assignments performed in healthcare settings
  • Any document translation, transcription, or CART services involving patient or clinical content
  • All ASL interpreting engagements in medical or behavioral health contexts
  • Remote Video Interpreting (VRI) and telephonic interpreting in healthcare environments
ℹ️ This policy applies in addition to — and does not replace — the general confidentiality obligations all Translation Excellence interpreters and translators accept as part of their professional engagement with our company.
02
Our Role Under HIPAA
Under the Health Insurance Portability and Accountability Act of 1996 (HIPAA), as amended by the Health Information Technology for Economic and Clinical Health (HITECH) Act, Translation Excellence operates as a Business Associate when providing services to healthcare Covered Entities.

A Covered Entity is a healthcare provider, health plan, or healthcare clearinghouse that is directly subject to HIPAA. A Business Associate is a person or company that performs services for a Covered Entity that involve access to PHI.

In our role as a Business Associate, Translation Excellence agrees to:
  • Use and disclose PHI only as permitted by our Business Associate Agreement (BAA) and applicable law
  • Implement appropriate administrative, physical, and technical safeguards to protect PHI
  • Report any known or suspected breaches of unsecured PHI to the applicable Covered Entity
  • Ensure that any subcontractors or agents who access PHI agree to the same restrictions and conditions
  • Make our books and records available to the U.S. Department of Health and Human Services (HHS) as required
  • Return or destroy all PHI upon termination of our service relationship, where feasible
✅ HITECH Compliance: Translation Excellence’s obligations under this policy extend to the HITECH Act requirements, including breach notification rules and the direct application of certain HIPAA provisions to Business Associates.
03
What Is Protected Health Information (PHI)?
Protected Health Information (PHI) is any individually identifiable health information that is created, received, maintained, or transmitted by a Covered Entity or Business Associate. PHI can exist in any form — spoken, written, or electronic (ePHI).

Examples of PHI Our Interpreters May Encounter

Any of the following, when linked to an identifiable individual, constitutes PHI:
  • Patient name and contact information
  • Dates of treatment or hospitalization
  • Medical record or account numbers
  • Diagnosis, prognosis, or treatment plans
  • Prescription and medication information
  • Insurance and billing information
  • Mental health and behavioral health records
  • Lab results and imaging reports
  • Social Security or ID numbers
  • Geographic data smaller than a state
Interpreters must treat all information encountered during a healthcare assignment as potentially PHI, regardless of whether it has been formally identified as such, and maintain confidentiality accordingly.
04
Permitted Uses & Disclosures of PHI
Translation Excellence personnel may only use or disclose PHI in the following circumstances:

Purpose

Description

Authorization

Service Delivery

Interpreting or translating health information as necessary to provide the requested language service during a clinical encounter

Permitted

Healthcare Operations

Internal quality review, complaint investigation, or auditing — limited to minimum necessary information

Permitted

Required by Law

Disclosure compelled by valid court order, government agency, or applicable law or regulation

Permitted

Public Health & Safety

Reporting to public health authorities when required by law, or disclosures necessary to prevent a serious and imminent threat to health or safety

Permitted

Business Associate Functions

Sharing PHI with subcontractors who have executed a BAA and are performing services on behalf of Translation Excellence

Permitted

Patient Authorization

Any use or disclosure specifically authorized by the patient in writing

Auth Required

Marketing or Sale

Using or disclosing PHI for marketing purposes or exchanging PHI for remuneration

Prohibited

⚠️ Minimum Necessary Standard: When accessing, using, or disclosing PHI, Translation Excellence personnel must limit their exposure to the minimum amount of information necessary to accomplish the task. Interpreters should not review medical records or clinical documentation beyond what is directly needed to perform the requested service.
05
Prohibited Uses & Disclosures
The following are strictly prohibited for all Translation Excellence personnel and contractors:
  • Discussing PHI outside the assignment — Discussing patient information with anyone not directly involved in the care or service
  • Using PHI for personal purposes — Using any patient information encountered during an assignment for any personal benefit or non-work-related purpose
  • Unauthorized recording — Recording, photographing, or copying any PHI or patient-related content without explicit authorization from the Covered Entity
  • Social media disclosure — Posting, sharing, or referencing any details of a healthcare interpreting assignment on social media or public platforms — even without naming the patient
  • Taking documents — Removing, copying, or retaining physical or digital documents containing PHI after an assignment
  • Curiosity-driven access — Accessing PHI out of personal curiosity rather than necessity for service delivery
  • Reidentification — Attempting to identify a patient from de-identified information
🚫 Violation Consequences: Violations may result in immediate removal from assignment, termination of contract or employment, and referral to regulatory or law enforcement authorities. HIPAA violations can carry civil penalties of up to $1.9 million per violation category per year.
06
Interpreter Confidentiality Obligations
Translation Excellence interpreters are bound by both professional ethical codes and HIPAA requirements when working in healthcare settings.

During the Assignment

  • Interpret accurately and completely, without omitting, adding, or altering information
  • Maintain strict impartiality — do not advocate, advise, or insert personal opinion
  • Refrain from engaging in separate conversations with the patient outside the interpreted exchange
  • Alert the clinical provider if you believe a patient safety issue exists that is not being communicated
  • Do not accept gifts, tips, or personal contact information from patients

After the Assignment

  • Do not retain, record, or share any information learned during the assignment
  • Return or destroy any PHI-containing materials provided for preparation, per instructions from the Covered Entity
  • Report any concerns about PHI exposure or potential breach immediately to Translation Excellence management
  • Do not acknowledge the identity of any individual you have interpreted for in any professional or social context

Remote & Video Interpreting (VRI/Telephonic)

  • Conduct sessions from a private, secure location where PHI cannot be overheard by others
  • Use only Translation Excellence-approved or client-designated platforms
  • Ensure no unauthorized persons are present in the room during the session
  • Close and secure any PHI-related documents or screens after each session
📋 All Translation Excellence interpreters assigned to healthcare accounts must sign a Confidentiality and HIPAA Compliance Agreement as a condition of assignment eligibility.
07
Safeguards & Security
Translation Excellence maintains administrative, physical, and technical safeguards to protect PHI in accordance with the HIPAA Security Rule.

Administrative Safeguards

  • HIPAA compliance training required for all personnel prior to healthcare assignments
  • Designated HIPAA Privacy Officer responsible for policy oversight and compliance
  • Workforce clearance and background procedures for personnel accessing PHI
  • Sanction policy for workforce members who violate HIPAA policies

Physical Safeguards

  • Secure workspaces for any remote interpreting or translation involving PHI
  • Secure disposal (shredding) of any physical documents containing PHI
  • Access controls for any physical locations where PHI is handled

Technical Safeguards (ePHI)

  • Encrypted transmission of any ePHI via secure, approved platforms only
  • Access controls and unique user identification for systems containing ePHI
  • Automatic logoff on devices used for sessions involving ePHI
  • Audit controls to track access to ePHI
08
Business Associate Agreements (BAA)
Before providing language services in any setting where Translation Excellence personnel may access PHI, a fully executed Business Associate Agreement (BAA) must be in place between Translation Excellence and the Covered Entity client.

The BAA governs the specific permitted uses and disclosures of PHI, Translation Excellence’s obligations to safeguard PHI, breach notification procedures and timelines, the return or destruction of PHI at the end of the service relationship, and downstream subcontractor requirements.

1

New Healthcare Client Onboarding

Translation Excellence’s operations team confirms whether a BAA is required. A BAA template is provided to the client for review and execution prior to service commencement.
2

Subcontractor / Independent Interpreter BAA

Any independent interpreter or subcontractor assigned to a healthcare account must execute a BAA with Translation Excellence before their first assignment.
3

BAA Maintenance & Renewal

Translation Excellence maintains executed BAAs on file and reviews them annually or when the scope of services materially changes.
⚠️ No Translation Excellence personnel shall begin a healthcare assignment that may involve access to PHI without confirmation that a valid BAA is in place with the client Covered Entity.
09
Breach Notification
Under the HIPAA Breach Notification Rule, Translation Excellence is required to notify applicable Covered Entities of any breach of unsecured PHI. A breach is defined as the unauthorized acquisition, access, use, or disclosure of PHI that compromises its security or privacy.

What Constitutes a Breach

  • An interpreter sharing PHI with an unauthorized party
  • Loss or theft of a device containing ePHI
  • PHI sent to the wrong recipient via email, fax, or message
  • Unauthorized access to patient records during a translation assignment
  • A ransomware or cyberattack affecting systems containing ePHI

Breach Reporting Procedure

1

Immediate Internal Reporting

Any employee, interpreter, or contractor who discovers or suspects a PHI breach must report it to Translation Excellence management no later than 24 hours of discovery.
2

Internal Investigation

Translation Excellence will assess the incident to determine whether it constitutes a reportable breach under the HIPAA “Low Probability of Compromise” standard within 5 business days.
3

Covered Entity Notification

If a breach is confirmed, Translation Excellence will notify the applicable Covered Entity without unreasonable delay and no later than 60 calendar days of discovery, per 45 CFR § 164.410.
4

Documentation

All breach investigations and notifications are documented and retained for a minimum of 6 years in accordance with HIPAA’s documentation requirements.
10
Individual Rights Regarding PHI
As a Business Associate, Translation Excellence supports the rights of patients and healthcare recipients regarding their PHI. Requests should be directed to the patient’s Covered Entity healthcare provider. Translation Excellence will cooperate with Covered Entities in honoring these rights.
📋

Right to Access

Request inspection and copies of PHI held about you by the Covered Entity.
✏️

Right to Amend

Request corrections or amendments to inaccurate or incomplete PHI in your records.

📊

Right to Accounting

Request a record of disclosures of your PHI made by the Covered Entity or its Business Associates.

🔒

Right to Restrict

Request restrictions on certain uses and disclosures of your PHI.
📮

Right to Confidential Comms

Request that PHI be communicated to you only through certain means or at certain locations.
📄

Right to a Copy of This Policy

Request a copy of this HIPAA Privacy & Confidentiality Policy at any time.

11
Training & Accountability

Translation Excellence is committed to maintaining a well-trained, HIPAA-compliant workforce. Training and accountability measures include:

  • Initial HIPAA training: All new employees and contractors assigned to healthcare accounts must complete HIPAA privacy and security training before their first assignment, covering PHI recognition, confidentiality obligations, permitted and prohibited disclosures, and breach reporting.
  • Annual refresher training: All active healthcare interpreters and translators complete annual HIPAA compliance refresher training.
  • Policy acknowledgment: All personnel must review and sign this policy, acknowledging understanding and commitment to compliance.
  • HIPAA Privacy Officer: Translation Excellence designates a Privacy Officer responsible for HIPAA compliance, receiving breach reports, and coordinating with Covered Entity clients on privacy matters.
  • Sanction policy: Violations may include warnings, removal from assignment, termination, and referral to regulatory authorities.
  • Documentation retention: Training records, BAAs, breach investigation files, and policy documents are retained for a minimum of 6 years.
12
Complaints & Contact
If you believe your privacy rights have been violated, or if you have questions or concerns about how Translation Excellence handles PHI, you have the right to file a complaint with Translation Excellence directly or with the U.S. Department of Health and Human Services Office for Civil Rights (OCR). Translation Excellence will not retaliate against any person for filing a good-faith complaint.

Contact our HIPAA Privacy Officer with any questions, concerns, or complaints:

Company

Translation Excellence, Inc.

Email

info@translationexcellence.com

Mailing Address

Translation Excellence, Inc. 3300 S. Parker Rd., Suite 200 Aurora, CO 80014

Website

translationexcellence.com

HHS Office for Civil Rights (OCR) — Federal Complaint

You also have the right to file a complaint directly with the U.S. Department of Health and Human Services Office for Civil Rights:

 

U.S. Department of Health & Human Services

200 Independence Avenue, S.W., Washington, D.C. 20201

Online: www.hhs.gov/ocr/complaints

Phone: 1-800-368-1019  |  TDD: 1-800-537-7697

Complaints must be filed within 180 days of when you knew or should have known of the alleged violation. OCR may extend this deadline for good cause.