As a healthcare technology provider, we take our responsibility to protect data and systems seriously. We're compliant with HIPAA and SOC-2 frameworks, and we enforce a comprehensive set of security policies and measures to ensure our client, member, and employee data stays safe.
Information security policies
Amino maintains and enforces a comprehensive set of security and privacy policies, including:
Acceptable Usage
Access Control
Anti-Virus and Anti-Malware
Authentication
CMS QE Program Data Access and Usage
Change Management
Data Backup
Data Classification and Management
De-Identification of PHI
Document Retention and Disposal
Encryption
Firewall Management
Health Information Privacy
Health Information Security Program
Hiring, Onboarding, and Termination
Incident Response
Information Security, Integrity and Availability
International Travel
Logging, Monitoring, and Alerting
Physical Security
Risk Assessment and Management
Screening and Background Checks
Server Configuration
Third Party Management
Training
Vulnerability Management
Workforce Sanctions
Workstation, Mobile Device, and Removable Media
Compliance frameworks
Our products and internal processes are designed with compliance in mind. We use the following compliance frameworks to evaluate and improve our approach:
SOC 2: Amino passed an independent SOC 2 Type 1 audit in December 2020. We’re currently undergoing a SOC 2 Type 2 audit and expect to complete this work by the end of 2021.
HIPAA: We partner with attorneys, security consultants, and healthcare policy experts to ensure HIPAA compliance as a business associate, and provide a HIPAA privacy notice to our members. We undergo an annual third-party HIPAA risk assessment.
Application security measures
Encryption
We use SSL Encryption to protect PII and PHI from unauthorized access. All communication between Amino members and our application is encrypted in transit, and databases / database backups are encrypted at rest.
Data access
To protect our customers' data, Amino practices least-access principles. Customer data is only made available to approved employees with roles that require access to perform their primary job duties.
Third-party vendors
Every third-party vendor used by Amino goes through a thorough internal risk assessment process. We sign business associate agreements (BAAs) with any vendors accessing sensitive client data.
Pentesting and security scans
Amino conducts third-party pentests at least annually. In addition to regular pentesting, we also use dynamic and static scanning tools to monitor and detect vulnerabilities, and participate in a bug bounty program.
Responsible disclosure and bug bounty program
If you believe you have discovered a vulnerability within Amino’s application, or if you would like to participate in Amino’s bug bounty program as hosted by HackerOne, please contact our Security Engineering team by emailing security@amino.com.
