Inovalon is committed to protecting your privacy and protecting your Personal Information. This Privacy Policy sets forth the online data collection and usage policies and practices that apply to information about you, the user, that Inovalon collects via the Converged Patient Assessment portal (the “Software”). It does not necessarily apply to information collected by Inovalon in any other fashion.

This Privacy Policy also does not apply to any protected health information (“PHI”) disclosed to or by you. Inovalon’s privacy and security obligations related to PHI disclosed on the Software are governed by the Health Insurance Portability and Accountability Act of 1996, amending statutes, and enabling regulations (collectively, the “HIPAA Rules”), as well as the HIPAA business associate agreements we sign with the health plans on whose behalf PHI is uploaded into the Software.

Nonetheless, whether in regard to PHI or users’ Personal Information, Inovalon employs industry-leading privacy and security standards related to the protection of information maintained and transmitted through the Software, and has established rigorous safeguards and controls in accordance with legal and regulatory requirements.

By using the Software or submitting information via the Software, you acknowledge and agree to the terms of this Privacy Policy.

Inovalon maintains appropriate physical, electronic and administrative security standards and procedures to safeguard its data and systems. Moreover, all employees are trained in Inovalon’s privacy and security policies and are required to comply with them as a condition of employment. Employees are permitted to access and use only that personal and proprietary information necessary to perform their duties. We have made information security and data privacy foundational principles of our business operations.

Any highly confidential information (such as a username and/or password) transmitted over the Internet will be encrypted. Further, Inovalon’s security professionals periodically monitor and test Inovalon’s web interface and implement technology updates in an effort to block unauthorized intrusion.

We may collect the following categories of personal information about our users:

• Identifiers: identifiers such as first name, last name, NPI, registration code (sent to the user with their Provider Welcome Packet), email address, password, security question, and security answer
• Online Activity: Internet and other electronic network activity information related to use of the converged patient assessment portal
• Cookies: Inovalon’s website may deposit a small file called a “cookie” on a user’s computer hard drive to personalize their experience or track aggregate site visitation statistics

Inovalon uses the information gathered on Inovalon’s website, whether personal, demographic, collective or technical, for the purpose of operating and improving the site, fostering a positive user experience, and delivering Inovalon’s products and services. In addition, Personal Information may be used for detecting security incidents, protecting against malicious, deceptive, fraudulent, or illegal activity, and prosecuting those responsible for that activity, debugging to identify and repair errors that impair existing intended functionality, and undertaking internal research for technological development and demonstration.

Our Services are designed for adults, not children. As such, we do not intend to collect Personal Information from children under the age of 16, and our Services are not designed for such information. If you are under the age of 16, you are not permitted to use this website.

Disclosures for California Residents 

The California Consumer Privacy Act of 2018 (“CCPA”), as amended by the California Privacy Rights Act of 2020 (“CPRA”), provides California residents (“consumers”) with specific rights regarding their Personal Information. This disclosure sets forth our privacy practices as required by the CCPA in those limited circumstances where we collect personal information that is not governed by the Health Insurance Portability and Accountability Act (“HIPAA”). This section describes your CCPA rights and explains how to exercise those rights as follows. 

• Notice Of Collection And Use Of Personal Information 

If you use the Software, we may collect the following categories of personal information about you:  

• Identifiers: We may collect identifiers such as your name, address, NPI, email or IP address, and other similar identifiers. 
• Sensitive Personal Information (Cal. Civ. Code § 1798.80):  We do not collect “sensitive personal information” through the Software, such as signature, insurance policy number, education, bank account number and other financial information, medical information, or health insurance information.   
• Protected Classifications: We do not collect any protected classifications, such as race, color, national origin, religion, age, sex, gender, gender identity, gender expression, sexual orientation, marital status, medical condition, medical history, ancestry, genetic information, disability, citizenship status, or military and veteran status. 

• Commercial Information: We may collect commercial information, including information related to the employer on whose behalf you are using the Software, such as insurance carrier billed. 
• Online Activity: We may collect website activity information, including, but not limited to, information regarding your interaction with the Software. 
• Geolocation Data: We do not collect information about where the device from which you provide information is located. 
• Sensory Information: We do not collect audio, electronic, visual, and similar information through our website. 
• Biometric Information: We do not collect biometric information through our website. 

• Employment Information: We may collect information about your employer and your job description. 

We may use the categories of personal information listed above for the purposes described in this Privacy Notice.  In addition, we may use these categories of personal information for certain business purposes specified in the CCPA, as described in this table, regardless of whether you are a California resident:  

 

Purposes	Categories of Personal Information
Performing contracted services for our health plan clients	Identifiers; Commercial Information; Online Activity; and Employment Information
Auditing related to a current interaction with you and concurrent transactions	Identifiers; Commercial Information; Online Activity; and Employment Information
Detecting security incidents, protecting against malicious, deceptive, fraudulent, or illegal activity, and prosecuting those responsible for that activity	Identifiers; Commercial Information; Online Activity; and Employment Information
Debugging to identify and repair errors that impair existing intended functionality	Identifiers; Commercial Information; Online Activity; and Employment Information
Undertaking internal research for technological or other website or product development and demonstration	Identifiers; Commercial Information; Online Activity; and Employment Information

 

• No Prior Collection, Use Or Disclosure Of Personal Information 

No Personal Information was collected, shared, sold or disclosed for a business purpose prior to the first Effective Date of this Privacy Policy. 

• No Sale Of Personal Information 

We do not sell your personal information.  Period.  We also do not share your personal information with third parties for cross-context advertising.  As such, we do not post a link for you to opt out of such sale or sharing: you do not need to opt out because we simply do not sell or share your personal information. 

• Disclosure Of Personal Information For A Business Purpose 

If you use the Software, we may disclose all the categories of personal information about you described above to a third-party service provider if such vendor supports our provision of services to our health plan clients. 

• Past 12 Months’ Activity 

In the past 12 months, we have used personal information collected through the Software or otherwise to facilitate our services to our health plan clients, and to respond to user outreach.  We have not sold any such personal information.  We may have provided some such personal information to a third-party service provider that we utilize to store such website contact information and/or otherwise support our provision of services to our health plan clients.     

 

• Retention Periods 

We retain your personal information for as long as necessary to fulfill the purpose for which it was collected.    

• Privacy Choices 

If you are a California resident, you have certain choices regarding our use and disclosure of your personal information, as described below: 

• Access: The right to request, twice in a 12-month period, to have us disclose to you the personal information we have collected, used, disclosed and sold about you during the past 12 months. 

• Correction: The right to request that we make commercially-reasonable efforts to correct information about you that is inaccurate. 
• Deletion: The right to request that we delete certain personal information we have collected from you.  Your request to delete your personal information may be denied if it is necessary for us to retain your information under one or more of the exceptions listed in the CCPA. 
• Opt-Out of Automated Decision-Making: The right to request access to and information about how automated decision technologies work and what their likely outcomes are, and to opt out of the use of automate decision making technology, including profiling.  However, we do not utilize automated decision-making technologies, so you have no need to affirmatively opt out. 
• Opt-Out of Sale:  The right to opt-out of the sale of their personal information.  However, we do not sell your personal information, so you have no need to affirmatively opt out. 
• Opt-In if Under 16. The personal information of California residents who are 16 years old or younger may not be sold without that minor’s prior authorization.  If the minor is less than 13 years old, their personal information may not be sold without “opt-in” authorization from a parent or guardian.   As noted, however, we never sell your personal information. 

• Shine the Light Request: California residents have the right to request that we provide you with: (1) a list of certain categories of personal information we have disclosed to third parties for their direct marketing purposes during the immediately preceding calendar year, and (2) the identity of those third parties. 

 

• How to Submit a Request or Opt-Out/In (California Residents) 

For a California resident to submit a request, or to opt-out/into of the sale or sharing of your personal information, email us at Privacy@inovalon.com, or call us at (301) 809-4000. To help protect your privacy and maintain security, we will take steps to verify your identity before granting you access to your personal information or complying with your request.  If you request access to or deletion of your personal information, we may require you to provide certain information to help us identify you.  In addition, if you ask us to provide you with specific pieces of personal information, we will require you to sign a declaration under penalty of perjury that you are the consumer whose personal information is the subject of the request. If you designate an authorized agent to make an access, deletion or opt-out of sale request on your behalf (1) we may require you to provide the authorized agent written permission to do so, and (2) for access and deletion requests, we may require you to verify your own identity directly with us (as described above). 

The CCPA prohibits discrimination against a consumer because the consumer exercised any of the consumer’s rights under the CCPA. To the extent permitted by applicable law, we may charge a reasonable fee to comply with your request. This Statement is available in alternative formats upon request. To request this Statement in an alternative format, email us at Privacy@inovalon.com, or call us at (301) 809-4000.  

Only you, or a person that you authorize to act on your behalf, may make a request related to your personal information. In the case of access and deletion, your request must be verifiable before we can fulfill such request. We cannot respond to your request or provide you with personal information if we cannot verify your identity or authority. 

We do not charge a fee to process or respond to your verifiable consumer request unless it is excessive, repetitive, or manifestly unfounded. Under normal circumstances, we will provide you with requested information in a readily-usable format, within forty-five (45) days of verifying your request.  If we determine that the request warrants a fee, we will tell you why we made that decision and provide you with a cost estimate before completing your request. 

Inovalon may amend this policy from time to time, and therefore encourages you to review it periodically. Your continued use of the converged patient assessment portal after modifications are posted constitutes your consent to such modifications. 

If you have any questions about this policy, the practices of Inovalon, or your dealings with this site, please contact Inovalon at the below address: 

Inovalon
4321 Collington Road
Bowie, MD 20716
U.S.A.
(301) 809-4000
Privacy@inovalon.com 

This privacy policy was last updated on April 23, 2023.