Identifiable patient data stays with the care provider.

Loomency is designed around that one rule. This page sets out how we keep to it, and how to reach us about a security concern.

How it is protected

• Identifiable patient data stays within the care provider’s own network. Our hosted services are designed to work with coded clinical information only, with no names, record numbers, dates of birth or free-text notes.
• The on-site part of the system makes outbound, encrypted connections only. It does not need to be reachable from the internet.
• Data in transit is encrypted, and our hosted services run on Microsoft Azure, which encrypts stored data at rest.
• The keys that protect identifiable data stay with the provider. Linking information back to a named patient happens only on the provider’s own systems, with an extra verification step and a recorded reason.
• Our staff accounts require multi-factor authentication. Access is based on role, support access needs the customer’s approval and is time-limited, and data access is recorded in audit logs.

Agreements and integrations

Where we handle protected health information for a provider, we do so under a Business Associate Agreement. We connect to electronic health record and imaging systems only with the provider’s authorization, through each vendor’s official developer program and within its terms. If a security incident affects a customer’s data, we will notify them as our agreements and the law require.

Reporting a vulnerability

If you believe you have found a vulnerability, email [email protected] with enough detail for us to reproduce it. We will acknowledge your report and keep you informed as we investigate.

Please do not access, change or keep any patient or customer data, do not test against systems at a healthcare provider or disrupt our services, and give us reasonable time to fix the issue before sharing it publicly. We will not pursue action against anyone who reports to us in good faith within these guidelines.

Contact

Security [email protected]
Integrations [email protected]