Compliance

Porto MD keeps written HIPAA privacy and security policies, a security risk assessment, and records of which policies were adopted and when. Our policies require everyone at Porto MD with access to patient information to complete privacy and security training every year. Our safeguards are described on the Security page.

A clinic signs a Business Associate Agreement with Porto MD before any real patient information is handled for it. Until then, the clinic’s patient features run as practice records only. See Patient Privacy & HIPAA.

Prescribing is off for every clinic by default. It is turned on only for clinics whose prescribers Porto MD has verified, including their license and National Provider Identifier (NPI). Clinics with prescribing on are screened every week against the HHS Office of Inspector General’s list of excluded individuals and entities, and any possible match is reviewed by a person.

Suppliers sign the Porto MD Supplier Agreement and are approved before they can sell. Every product a supplier submits is reviewed by Porto MD before it appears in the marketplace, and products that need a license, a prescription or a minimum age are sold only to buyers who qualify, in states where the law allows.

Porto MD does not bill insurers or government health programs for its customers, and does not offer anything of value to induce referrals or purchases of items paid for by those programs. Coverage, coding and billing are the ordering practice’s responsibility. The full statement is in the disclosures at the foot of every page.

We send text messages only to people who opted in, and every message can be stopped by replying STOP. See our SMS / Text Messaging Policy.

If you have a compliance concern about Porto MD, a clinic, a supplier or a representative on the platform, email compliance@portomd.com. We look into every report, and we do not retaliate against anyone who raises a concern in good faith.