6. Data Management Policy

Luma has procedures to create and maintain retrievable exact copies of electronic protected health information (ePHI) stored.

Data backup is an important part of the day-to-day operations of Luma. To protect the confidentiality, integrity, and availability of ePHI, complete backups are performed daily to ensure data remains available in the event of a disaster: Luma uses AWS’ Backup Service for AWS-hosted systems and databases, and MongoDB Atlas’ backup service for databases hosted on Atlas.

Violation of this policy and its procedures by workforce members may result in corrective disciplinary action, as described in §19.7.

Of note, Luma does not physically house any systems used by its Platform in Luma facilities. The physical infrastructure environment is hosted at Amazon Web Services (AWS) including the network components and supporting network infrastructure. Luma does not own any equipment which houses ePHI.

6.1 Applicable Standards

6.1.1 Applicable Standards from the HITRUST Common Security Framework

  • 01.v - Information Access Restriction

6.1.2 Applicable Standards from the HIPAA Security Rule

  • 164.308(a)(7)(ii)(A) - Data Backup Plan
  • 164.310(d)(2)(iii) - Accountability
  • 164.310(d)(2)(iv) - Data Backup and Storage

6.2 Backup Policy and Procedures

  1. Perform daily snapshot backups of all systems that process, store, or transmit ePHI for Luma Customers, automated via AWS’ Backup Service; databases hosted on MongoDB Atlas are backed up via MongoDB Atlas’ backup service.
  2. The Luma Infrastructure (SRE) Team is designated to be in charge of backups.
  3. Infrastructure (SRE) Team members are trained and assigned to complete backups if deemed necessary beyond the automated backups as above. This is managed through the Amazon AWS dashboard.
  4. Document backups
    • Name of the system
    • Date & time of backup
    • Where backup stored (or to whom it was provided)
  5. Securely encrypt stored backups in a manner that protects them from loss or environmental damage.
  6. Backups are replicated to ensure redundancy: AWS-hosted systems and databases replicate across AWS availability zones, and databases hosted on MongoDB Atlas replicate across Atlas’ own cluster nodes/regions.
  7. Test backups and document that files have been completely and accurately restored from the backup media.

6.3 Data Classification

  1. Luma, based on the data classification level, registers media prior to use, places reasonable restrictions on how such media be used, and provide an appropriate level of physical and logical protection for media containing covered information until properly destroyed or sanitized
  2. Media is labeled, encrypted, and handled according to its classification
  3. Guidelines are issued by the organization on the ownership, classification, retention, storage, handling and disposal or all records and information
  4. Sensitivity of systems and applications is identified and defined by the system / appplication owner. Luma considers all systems and applications that contain customer information to be confidential and are defined by the system owner as such
  5. Luma considers all customer information to be confidential
  6. All employee issued devices are considered confidential and can be traced to the individual
  7. All AWS infrastructure is considered confidential and is the responsibility of Luma’s SRE team

6.4 Data De-Identification

Luma follows the U.S. Department of Health and Human Services Safe Harbor guidelines for de-indentification of data containing PHI to ensure we remain in compliance with HIPAA.

Luma ensures that the following identifiers (if existing) are removed:

  1. Names
  2. All geographic subdivisions smaller than a state, including street address, city, county, precinct, ZIP code, and their equivalent geocodes, except for the initial three digits of the ZIP code if, according to the current publicly available data
    • The geographic unit formed by combining all ZIP codes with the same three initial digits contains more than 20,000 people
    • The initial three digits of a ZIP code for all such geographic units containing 20,000 or fewer people is changed to 000
  3. All elements of dates (except year) for dates that are directly related to an individual
  4. Telephone Numbers
  5. Vehicle Identifiers
  6. Fax Numbers
  7. Device information, such as serial numbers
  8. Email Addresses
  9. Web URLs
  10. Social Security Numbers
  11. IP Address information
  12. Medical Record Numbers
  13. Biometric Identifiers
  14. Health Plan beneficiary numbers
  15. Photographs
  16. Account Numbers
  17. Any other unique identifying number, characteristic, or code
  18. Certificate/license numbers