19. Employees Policy

Luma is committed to ensuring all workforce members actively address security and compliance in their roles at Luma. As such, training is imperative to assuring an understanding of current best practices, the different types and sensitivities of data, and the sanctions associated with non-compliance.

19.1 Applicable Standards

19.1.1 Applicable Standards from the HITRUST Common Security Framework

• 02.e - Information Security Awareness, Education, and Training
• 06.e - Prevention of Misuse of Information Assets
• 07.c - Acceptable Use of Assets
• 09.j - Controls Against Malicious Code
• 01.y - Teleworking

19.1.2 Applicable Standards from the HIPAA Security Rule

• 164.308(a)(5)(i) - Security Awareness and Training

19.2 HR Security Roles and Responsibilities

It is the duty of the Human Resources representative to understand and commit to the following roles and responsibilities:

• Implement and act in accordance with the organization’s information security policies;
• Protect assets from unauthorized access, disclosure, modification, destruction, or interference;
• Execute particular security processes or compliance activities;
• Ensure responsibility is assigned to the individual for actions taken;
• Report security events or potential events or other potential security risks to the organization;
• Designate a level of risk to each position, where appropriate, to be reviewed on an annual basis and tracked with a ClickUp ticket;
• Conduct background verification checks on all candidates for employment, contractors, and third-party users in accordance with relevant laws, regulations and ethics, and proportional to the business requirements, the classification of the information to be accessed, and the perceived risks. This can include but is not limited to:
  • Character references (e.g., 1 business, 1 personal);
  • A criminal background check;
  • Confirmation of academic and professional qualifications; and
  • Independent identity check (e.g., passport or similar document)
• Screening against applicable exclusion and sanctions databases, including the HHS OIG List of Excluded Individuals/Entities (LEIE) and other applicable government watchlists, where required; and
• Track progress for all new workforce members, including contractors, on assigned security training.

19.3 Background Check Process

All full-time employees and interns within the organization are required to undergo a formal background check. The standardized background check involves a national and state background check, employment verification, and education verification. Finance employees undergo an additional credit check.

The background check process is as follows:

1. After the offer letter is signed, HR initiates the candidate’s Rippling onboarding workflow and adds their information to the shared Google Calendar invite
2. Employees and Direct Contractors: As part of the Rippling onboarding workflow, the candidate receives instructions to complete their background check through the onboarding process.
3. Third-party contractors (e.g., TurnKey): The employer of record completes the background check and provides the finalized report to Luma via the shared Google Drive folder for HR review.
4. HR will review the completed background checks and follow up on flagged items with the candidate, if deemed necessary

All candidates are subject to the most thorough background screening possible.

19.4 Employee Onboarding

Luma ensures that employees, contractors and third party users agree to the terms and conditions concerning information security appropriate to the nature and extent of access they will have to Luma’s assets and systems. Access privileges are not granted until the terms and conditions and other relevant agreements have been signed.

The terms and conditions of their employment contract shall include but are not limited to:

1. Responsibilities as it pertains to information security;
2. Responsibilities as it pertains to Luma’s IT assets;
3. Management of organizational assets associated with information systems and services handled by the employee, contractor, or third party user;
4. Management of information received from other companies or external parties;
5. Responsibilities of the employee for the handling of all covered information;
6. Actions to be taken if the employee, contractor, or third party user disregards the security requirements, as described in §19.5; and
7. Responsibilities as it pertains to the intellectual property of Luma, including information created as a result of, or in the course of, employment with Luma

19.5 Employment Policies

1. All new workforce members, including contractors, are given training on security policies and procedures, including operations security, within 30 days of employment.
   • Records of training are kept for all workforce members.
   • Current Luma training is leveraging content created by the Information Security Team and industry leader in compliance, Rippling along with custom content that is distributed via Northpass or during a live session
   • Employees must complete a live training with a member of the Information Security team before accessing production systems containing ePHI.
   • Incident response and contingency training will be assigned to information system users with assigned roles and responsibilities within 90 days of assuming an incident response role or responsibility and annually thereafter
2. All workforce members are granted access to formal organizational policies, which include the sanction policy for security violations.
3. The Luma Employee Handbook clearly states the responsibilities and acceptable behavior regarding information system usage, including rules for email, Internet, mobile devices, and social media usage.
   • Workforce members are required to sign an agreement stating that they have read and will abide by all terms outlined in the Luma Employee Handbook, along with all policies and processes described in this document.
   • A Human Resources representative will provide the agreement to new employees during their onboarding process.
4. Luma does not allow mobile devices to connect to any of its production networks.
5. All workforce members are educated about the approved set of tools to be installed on workstations.
6. All new workforce members are given HIPAA training within 30 days of beginning employment. Training includes HIPAA reporting requirements, including the ability to anonymously report security incidents, and the levels of compliance and obligations for Luma and its Customers and Partners.
7. All remote (teleworking) workforce members are trained on the risks, the controls implemented, their responsibilities, and sanctions associated with violation of policies.
8. All workforce members who fail to comply with established policy and procedures on the handling and reporting of ePHI breaches will be subject to sanctions as described in §19.7.
9. Employees may only use Luma-purchased and -owned workstations for accessing production systems with access to ePHI data.
   • An Acceptable Use Agreement is signed by all employees that notifies them of monitoring, security responsibilities and acceptable and unacceptable use of Luma’s IT assets
   • Any workstations used to access production systems must be configured as prescribed in §7.8.
   • Any workstations used to access production systems must have virus protection software installed, configured, and enabled.
   • Luma may monitor access and activities of all users on workstations and production systems in order to meet auditing policy requirements (§8).
10. Access to internal Luma systems can be requested using the procedures outlined in §7.2. All requests for access must be granted by the Luma Security Officer.
11. Request for modifications of access for any Luma employee can be made using the procedures outlined in §7.2.
12. Luma employees are strictly forbidden from downloading any ePHI to their workstations.
    • Restricting transfers of ePHI is enforced through technical controls as described in §7.3.
    • Employees found to be in violation of this policy will be subject to sanctions as described in §19.7.
13. Employees are required to cooperate with federal and state investigations.
    • Employees must not interfere with investigations through willful misrepresentation, omission of facts, or by the use of threats against any person.
    • Employees found to be in violation of this policy will be subject to sanctions as described in §19.7.
14. Full-time employees who have been employed for at least 3 months at the time of performance reviews are subject to the organization-wide bi-annual performance review process, which utilizes the Rippling platform.
    • HR communicates when Bi-Annual Performance Reviews will be scheduled, and an entry is made to the shared Google Corporate Calendar.
    • HR assigns self reviews for all eligible employees utilizing Rippling.
    • Employees complete a self-reflection, which is reviewed by their manager.
    • Managers have up to 30 days to examine the employee’s reflection, write comments, and meet with the employee for a 1:1.
    • After 30 days, HR follows up with managers who have not yet completed the review.
15. Termination of employees will require completing the Termination Checklist which includes return of all equipment such as laptops, badges, and keys to access the facility and restricting access to Luma systems.
16. Employees email is configured to block suspicious emails and unnecessary file types prior to being delivered to the employee’s inbox.

19.6 Issue Escalation

Luma workforce members are to escalate issues using the procedures outlined in the Employee Handbook, and can do so via an anonymous form. Issues that are raised are brought to the Escalation Team and assigned an owner. The membership of the Escalation Team is maintained by the Chief Executive Officer.

Security incidents, particularly those involving ePHI, are handled using the process described in §11.2. If the incident involves a breach of ePHI, the Security Officer will manage the incident using the process described in §12.2. Refer to §11.2 for a list of sample items that can trigger Luma’s incident response procedures; if you are unsure whether the issue is a security incident, contact the Security Officer immediately.

It is the duty of that owner to follow the process outlined below:

1. Create an Issue in ClickUp.
2. The Issue is investigated, documented, and, when a conclusion or remediation is reached, it is moved to Review.
3. The Issue is reviewed by another member of the Escalation Team. If the Issue is rejected, it goes back for further evaluation and review.
4. If the Issue is approved, it is marked as Done, adding any pertinent notes required.
5. The workforce member that initiated the process is notified of the outcome via email. If it is anonymous, this will be communicated more broadly if deemed by the Escalation Team to be needed.

19.7 Workforce Sanctions & Disciplinary Records

This policy applies to all Luma employees and is designed to be positive and corrective. Employee discipline is considered a serious action that is undertaken with care, objectivity and full consideration for the rights and interests of the employee. Discipline shall be administered in a judicious manner that strives to be corrective and appropriate to the offense rather than punitive.

Sanctions are fairly applied to employees following violations of the information security policies. Suspected security policy violations are reported to and investigated by the Security Officer per §5.3.3; substantiated violations are then referred to Human Resources for disciplinary action. Luma documents personnel involved in incidents, steps taken, and the timelines associated with those steps, steps taken for notification, the rationale for discipline, and the final outcome for each incident. A list of employees involved in security incidents is maintained in the HR Google Drive.

Violation of any security policy or procedure by workforce members may result in corrective disciplinary action, up to and including termination of employment. Violation of this policy and procedures by others, including business associates, customers, and partners may result in termination of the relationship and/or associated privileges. Violation may also result in civil and criminal penalties as determined by federal and state laws and regulations.

The process below applies to general performance and conduct violations. A violation resulting in a breach of confidentiality of ePHI (i.e. release of PHI to an unauthorized individual), change of the integrity of any ePHI, or inability to access any ePHI by other users requires immediate termination of the workforce member and is not eligible for the Performance Improvement Plan process below.

The process for disciplinary action is as follows:

1. Manager consults with HR and provides the applicable and necessary details
2. If the violation is an employee security incident, HR will contact the Security Officer to identify the individual and the reason for the sanction
3. Manager completes a Performance Improvement Plan
4. Manager sets up a meeting with employee and HR to conduct the performance review
5. The performance review and expectations are applied for an agreed-upon period of time and the manager will communicate weekly feedback with the employee
6. If an employee succeeds and meets expectations within the period of time, the Performance Improvement Plan is kept on file in HR Google Drive
7. If an employee fails to meet expectations, they will be terminated

19.8 Employee Offboarding

Logical and physical access to systems and equipment are reviewed, updated, or revoked when there is any change in responsibility or employment within at minimum 24 hours. This is tracked with a Rippling ticket opened by the Human Resources representative. Upon opening a ticket, admins for the apps that the user has access to will be automatically notified of the termination and will be prompted to terminate access.

The organization formally addresses:

• Terminating access when the access is no longer needed;
• Assignment of responsibility for removing information system and/or physical access; and
• Timely communication of termination actions to ensure that the termination procedures are appropriately followed;
• Ensure any covered information for which terminated employees had prior access remains confidential
• Termination process includes the return of all previously issued software and hardware.
• In cases where an employee, contractor or third-party user uses their own personal equipment, all relevant information is transferred to the organization and securely erased from the equipment.