1. Introduction

Luma Health, Inc (“Luma”) is committed to ensuring the confidentiality, privacy, integrity, and availability of all electronic protected health information (ePHI) it receives, maintains, processes and/or transmits on behalf of its Customers. As a provider of the Patient Success Platform, Luma strives to maintain compliance, proactively manage information security risks, and ensure that any confirmed security incidents are communicated to affected parties completely, effectively, and in a timely manner. The following documents address core policies used by Luma to maintain compliance and assure the proper protections of infrastructure used to store, process, and transmit ePHI for Luma Customers.

Luma Health’s leadership team sets the tone from the top and ensures that adequate resources are available to maintain an effective Information Security Management System.

The objective of Luma Health’s Information Security Management System is continued compliance with applicable frameworks and regulations such as HIPAA and HITRUST, and continuous improvement.

1.1 Scope

The scope of Luma Health’s HIPAA compliance policies encompasses the management of information security as applied to Luma Health’s services — including the Patient Success Platform, the Tonic Health Platform, and AI-enabled services — as well as the associated processes, technology, assets, and remote organizational units.

1.2 Objectives

Luma Health’s Information Security Management Program main objective is to Demonstrate Luma Health’s commitment to maintenance of customer confidence, its legal obligations, security of both its own and its customers data and protection of revenue through continuous improvement of its Information Security Management Program. Luma Health will act on any necessary improvements as described in the policies and procedures documented in this policy library.

1.3 Compliance Inheritance

Luma utilizes AWS for hosting whose privacy documentation can be found on their site at AWS Privacy. Luma does not have physical access to the servers being used. Luma’s Patient Success Platform is deployed entirely on the AWS platform.

Luma signs business associate agreements (BAAs) with its Customers. These BAAs outline Luma obligations and Customer obligations, as well as liability in the case of a breach. In providing infrastructure and managing security configurations that are a part of the technology requirements that exist in HIPAA and HITRUST, as well as future compliance frameworks, Luma manages various aspects of compliance for Customers. The aspects of compliance that Luma manages for Customers are inherited by Customers, and Luma assumes the risk associated with those aspects of compliance. In doing so, Luma helps Customers achieve and maintain compliance, as well as mitigates Customers risk.

Luma does not act as a covered entity.

Certain aspects of compliance cannot be inherited. Because of this, Luma Customers, in order to achieve full compliance or HITRUST Certification, must implement certain organizational policies. These policies and aspects of compliance fall outside of the services and obligations of Luma.

Mappings of HIPAA Rules to Luma controls and a mapping of what Rules are inherited by Customers are covered in §2.