Compliance

PDHI products and services comply with the following standards and laws concerning privacy, security, usability, delegation, and regulations.

HITRUST Certification

The ConXus Platform hosted at Microsoft Azure has earned HITRUST Risk-based, 2-year (r2) Certification from the HITRUST’s CSF Assurance Program for data security and protection of protected health information (PHI). The CSF includes federal and state regulations, standards, and frameworks such as HIPAA, NIST, ISO, and COBIT.

The CSF Assurance Program provides healthcare organizations and their business associates with a comprehensive, flexible, and efficient approach to regulatory compliance and risk management. For non-healthcare organizations with active GRC programs (governance, risk, compliance under Sarbanes-Oxley and other state privacy regulations) HITRUST CSF is mapped to the NIST Cybersecurity Framework.

HITRUST r2 Certification is valid for 2 years from the certification date and designates that an organization meets all the following requirements:

1. Completion of an assessment questionnaire to identify security controls, resources, and tools utilized
2. Submission of supporting documentation and evidence for each control
3. Onsite testing and report preparation by an approved CSF assessor
4. HITRUST review and validation

The benefits to clients and prospects of our platform’s HITRUST r2 Certification include:

• Independent verification that we meet the healthcare industry’s highest standards in protecting healthcare information and mitigating this risk
• Removal of an administrative burden and associated costs for organizations who conduct a formal vendor risk-management process
• Significant reductions in time and effort should a client apply for HITRUST certification

Certified Data Centers

The ConXus Platform is hosted on Microsoft Azure, a comprehensive set of cloud services. Azure provides highly scalable, reliable, and secure hosting from multiple data centers across the United States.

Azure is certified to the Health Information Trust Alliance Common Security Framework (HITRUST CSF). Azure also complies with Service Organization Controls standards for operational security (SOC 2 and SOC 3).

NCQA Certification

ConXus Profile (health risk assessment) and ConXus Steps (self-management tools) have received Wellness and Health Promotion (WHP) certification from the National Committee for Quality Assurance (NCQA).

Download NCQA Health Appraisal Certificate
Download NCQA Self-Management Tools Certificate

Health Plans

Health plans using ConXus modules receive automatic credit when undergoing NCQA Health Plan Accreditation for the following standards:

• 2024 PHM 4: Wellness and Prevention, Element A Frequency of Health Appraisal Completion
• 2024 PHM 4: Wellness and Prevention, Element B Topics of Self-Management Tools

Wellness Companies

Wellness service providers using ConXus modules receive automatic credit for health appraisals (WHP 5) and self-management tools (WHP 7) when undergoing NCQA Wellness and Health Promotion Accreditation.

FDR Medicare Compliance

PDHI qualifies as a first tier, downstream, or related entity (FDR) for clients operating as Medicare Advantage organizations.

To complete annual FDR attestation, PDHI complies with the following requirements:

1. Distribution of our code of conduct within 90 days of hiring or contracting and annually thereafter
2. Completion of CMS Medicare Parts C & D Fraud, Waste, and Abuse and General Compliance Training within 90 days of hiring or contracting and annually thereafter
3. Review of federal-level exclusion lists (DHHS-OIG List of Excluded Individuals and Entities and GSA System for Award Management) prior to hiring or contracting with any individual or entity, and monthly thereafter to ensure that none are excluded from participating in federal healthcare programs

National CLAS Standards

PDHI follows the National Culturally and Linguistically Appropriate Services (CLAS) Standards in Health and Health Care published by the Office of Minority Health, US Department of Health and Human Services.

The National CLAS Standards are intended to advance health equity, improve quality, and help eliminate healthcare disparities by providing a blueprint for individuals and health and healthcare organizations to implement culturally and linguistically appropriate services.

Text and images used in the PDHI health risk assessment and self-management tools are designed to be understandable by and respectful of all users, regardless of age, gender, education, and socioeconomic background.