Compliance Audits and External Communications
2023.3
LifeOmic may be requested occasionally to share additional details regarding its compliance, privacy and security program by an external entity such as a customer, media, legal or law enforcement. Such external communication, beyond what is already publicly published, needs to comply with the following policies and procedures.
Policy Statements
LifeOmic policy requires that:
(a) LifeOmic operations must comply with all applicable laws, regulations, security standards and frameworks. External audits shall be conducted accordingly to each applicable compliance requirement.
HIPAA/HITECH. LifeOmic must comply with all requirements listed in the HIPAA (Health Insurance Portability and Accountability Act of 1996) and the Health Information Technology for Economic and Clinical Health (HITECH) Act.
HITRUST. LifeOmic security program and controls are aligned with the HITRUST Common Security Framework (CSF).
GDPR. LifeOmic must protect the personal data and privacy of EU citizens according to the regulatory requirements set forth in the European Union General Data Protection Regulation (GDPR).
NIST. LifeOmic security shall implement the applicable controls outlined in NIST Special Publication 800-53.
(b) All external communications related to compliance and customer/employee privacy must follow pre-established procedures and handled by approved personnel. This includes but is not limited to distribution of audit reports, assessment results, incidents and breach notification.
(c) Audit and compliance reports may be shared with an external party only when under signed NDA and approved by LifeOmic Security and/or Privacy Officer.
Controls and Procedures
Compliance Program Management
LifeOmic management and security/compliance team has identified and regularly reviews all relevant statutory, regulatory, and contractual requirements.
LifeOmic’s compliance policy includes requirements to meet any and all applicable compliance requirements.
Additionally, the Vendor Risk Management policies and procedures specify the details related to contractual agreements with clients, partners and vendors, as well as requirements and process related to intellectual property rights and the use of proprietary software products.
Requesting Audit and Compliance Reports
LifeOmic, at its sole discretion, shares audit reports, including its HITRUST reports and Corrective Action Plans (CAPs), with customers on a case by case basis. All audit reports are shared under explicit NDA in LifeOmic format between LifeOmic and party to receive materials. Audit reports can be requested by LifeOmic workforce members for Customers or directly by LifeOmic Customers.
The following process is used to request audit reports:
- A request may be sent by email to compliance@lifeomic.com or by submitting a request via LifeOmic Internal Support Portal or Email. In the request, please specify the type of report being requested and any required timelines for the report.
- An Issue with the details of the request into the LifeOmic Security Project on Jira, which is used to track requests status and outcomes.
- LifeOmic security team will confirm if a current NDA is in place with the party requesting the audit report. If there is no NDA in place, LifeOmic will send one for execution.
- Once it has been confirmed that an NDA is executed, LifeOmic staff will move the Jira Issue to “Under Review”.
- The LifeOmic Security Officer or Privacy Officer must Approve or Reject the Issue. If the Issue is rejected, LifeOmic will notify the requesting party that we cannot share the requested report.
- If the Issue has been Approved, LifeOmic will send the customer the requested audit report and complete the Jira Issue for the request.
See detailed policy and procedures in Breach Notification.
External Audits of Information Access and Activity
Prior to contracting with an external audit firm, LifeOmic shall:
- Outline the audit responsibility, authority, and accountability;
- Choose an audit firm that is independent of other organizational operations;
- Ensure technical competence of the audit firm staff;
- Require the audit firm’s adherence to applicable codes of professional ethics;
- Obtain a signed HIPAA business associate agreement;
- Assign organizational responsibility for supervision of the external audit firm.
Whenever possible, a third party auditing vendor should not be providing the organization IT oversight services (e.g., vendors providing IT services should not be auditing their own services to ensure separation of duties).
Contacts for External Communications Requests
Direct all other communication requests to one of the following:
For incident reporting, vulnerability disclosure and other security related inquiries:
For privacy concerns, including report of violation:
For all compliance related issues, including request of audit reports:
Continuous Compliance Monitoring
The status of compliance is tracked internally via multiple security tools. Compliance dashboards are configured with applicable internal and external standards and frameworks. Any potential gaps detected are reported on the compliance dashboards.