HIPAA Privacy Standards
Mythos World Services LLC handles protected health information (PHI) exclusively as a Business Associate under HIPAA, never under our general website privacy policy. We require a signed Business Associate Agreement (BAA) with every practice before any patient data is accessed.
Breach Notification Commitment
While HIPAA allows up to 60 days for breach notification, our BAA commits us to notifying practices of any breach of unsecured patient data without unreasonable delay and within 30 days of discovery. We will provide preliminary notice sooner whenever possible.
Substance Use Records (42 CFR Part 2)
For behavioral health practices handling records protected by 42 CFR Part 2, Mythos acts as a Qualified Service Organization and complies fully with Part 2 requirements.
Data Usage Restrictions
Patient data is used solely to provide contracted billing services and operate our business as permitted by HIPAA. It is never sold, never used for marketing, and never used to train third-party AI models. We may de-identify data to HIPAA's standard to improve tools and publish benchmarks, ensuring it cannot be linked back to patients.