HIPAA and Clinical Data Protection

RadOnc eLearning Center, LLC recognizes the importance of protecting patient information and maintaining appropriate privacy and security standards in medical education.

EduCase is an educational technology platform designed to support radiation oncology contouring workshops, residency training, professional development, and competency assessments.

Our Approach to Clinical Data

EduCase is designed primarily for educational use involving appropriately de-identified clinical imaging and associated datasets.

Participating institutions and clinical case contributors are responsible for ensuring that materials submitted to EduCase have been de-identified in accordance with applicable laws, institutional requirements, and contractual obligations.

This includes reviewing DICOM metadata, imaging content, annotations, and associated clinical records for information that could identify patients.

HIPAA Applicability

The Health Insurance Portability and Accountability Act of 1996 (HIPAA) establishes privacy and security requirements for covered entities and business associates in circumstances defined by U.S. law.

EduCase's role and obligations depend on the nature of the services provided and the information processed.

Where EduCase is required to act as a business associate, protected health information may be processed only after appropriate contractual, privacy, and security arrangements have been established.

Customers must not upload identifiable protected health information without prior written authorization from EduCase.

Access and Security

EduCase supports individual user accounts, role-based access permissions, and administrative controls designed to help institutions restrict access to authorized educational materials.

EduCase maintains administrative and technical security measures appropriate to its Services. Specific safeguards and contractual security commitments are documented where applicable.

Educational Data and AI

Clinical cases and educational submissions are processed for authorized educational and assessment purposes.

Submission of data to EduCase does not automatically authorize its sale, distribution, or use for training external commercial artificial intelligence models.

Any additional use of institution-provided clinical datasets must comply with applicable law, contractual permissions, and relevant institutional requirements.

Institutional Responsibilities

Institutions remain responsible for determining the lawfulness of their disclosures, establishing appropriate case preparation and de-identification procedures, and managing participant authorizations.

EduCase is responsible for the privacy and security obligations applicable to its role, including commitments expressly undertaken in written agreements.

Privacy and Further Information

Additional information is available in the EduCase Privacy Policy, Terms of Use, the GDPR Information page, and applicable institutional Service Agreements.

Questions about clinical data protection or proposed uses involving protected health information should be directed to EduCase before uploading such information.