10. Facility Access Policy

Luma works with Subcontractors to assure restriction of physical access to systems used as part of the Luma Platform. Luma and its Subcontractors control access to the physical buildings/facilities that house these systems/applications, or in which Luma workforce members operate, in accordance with the HIPAA Security Rule 164.310 and its implementation specifications. Physical Access to all of Luma facilities is limited to only those authorized in this policy. In an effort to safeguard ePHi from unauthorized access, tampering, and theft, access is allowed to areas only to those persons authorized to be in them and with escorts for unauthorized persons. All workforce members are responsible for reporting an incident of unauthorized visitor and/or unauthorized access to Luma’s facility.

Of note, Luma does not physically house any systems used by its Platform in Luma facilities. The physical infrastructure environment is hosted at Amazon Web Services (AWS) including the network components and supporting network infrastructure. Luma has no physical access to the environment.

10.1 Applicable Standards

10.1.1 Applicable Standards from the HITRUST Common Security Framework

  • 08.b - Physical Entry Controls
  • 08.d - Protecting Against External and Environmental Threats
  • 08.j - Equipment Maintenance

10.1.2 Applicable Standards from the HIPAA Security Rule

  • 164.310(a)(2)(ii) Facility Security Plan
  • 164.310(a)(2)(iii) Access Control & Validation Procedures

10.2 Luma-Controlled Facility Access Policies

Luma currently operates as a fully remote organization and does not maintain a physical office facility. Should Luma establish such a facility in the future, the following controls apply:

  1. Visitor and third party support access is supervised. All visitors are escorted.
  2. Repairs are documented and the documentation is retained.
  3. Fire extinguishers and detectors are installed according to applicable laws and regulations.
  4. Maintenance is controlled and conducted by authorized personnel in accordance with supplier-recommended intervals, insurance policies and the organization’s maintenance program.
  5. Physical access is restricted using smart locks that track all access.
    • Restricted areas and facilities are locked when unattended (where feasible).
    • Only authorized workforce members receive access to restricted areas (as determined by the Security Officer).
    • Access and keys are revoked upon termination of workforce members.
    • Workforce members must report a lost and/or stolen key(s) to the Security Officer.
    • The Security Officer facilitates the changing of the lock(s) within 7 days of a key being reported lost/stolen.
  6. Workstations assigned to the facility must remain there during work hours, in an area where access is restricted via card access.

The following control applies regardless of whether Luma operates a physical facility:

  1. Enforcement of Facility Access Policies
    • Report violations of this policy to the restricted area’s department team leader, supervisor, manager, or director, or the Privacy Officer.
    • Workforce members in violation of this policy are subject to disciplinary action, as described in §19.7.
    • Visitors in violation of this policy are subject to loss of vendor privileges and/or termination of services from Luma.