Last Updated: October 6, 2026
365 EasyScreen recognizes that testing and program records involve sensitive personal and, at times, health-adjacent information. This page describes how that information is handled and protected.
Electronic Chain-of-Custody
Testing results are processed electronically through the Abbott eScreen network, using end-to-end electronic chain-of-custody to reduce manual handling errors and processing delays.
Access Controls
Access to donor/employee testing records is limited to personnel and systems that need it to deliver the service, consistent with our role as a service agent and C/TPA. Employer clients access their own program data through a dedicated client portal.
Data Transmission and Storage
Data submitted through this site and our client portal is encrypted in transit using industry-standard TLS encryption. We do not publish specific security certifications (such as SOC 2 or FIPS) on this page unless and until they have been formally obtained and documented; this page will be updated if and when that changes.
Billing & Payment Data
Billing is handled through our CRM platform, which routes card payments directly to a PCI DSS-compliant third-party payment gateway, independently validated annually. Card numbers are captured and processed by that gateway directly; they do not pass through or get stored on 365 EasyScreen's own systems.
Staff Confidentiality
Personnel with access to donor/employee testing records are subject to confidentiality obligations as a condition of their role, and access is limited to what is needed to perform their job function.
Vendor and Subprocessor Oversight
We work with the Abbott eScreen network, its certified laboratory partners, and Medical Review Officers, each of whom is subject to their own applicable regulatory and security obligations for the portion of the process they perform.
Data Retention and Disposal
Records are retained per the schedule in our Privacy Policy, consistent with 49 CFR § 40.333 and related DOT recordkeeping obligations, then securely deleted or de-identified.
Incident Notification
In the event of a confirmed security incident affecting donor/employee or client data, we will notify affected employer clients without unreasonable delay and no later than 30 calendar days after discovery, consistent with Florida's breach notification statute (our registered state) and the strictest deadlines among the states where our clients operate. Where a signed service agreement specifies a different timeline, that agreement controls.
Contact
Security questions or concerns: inquiries@365easyscreen.com