We take security and privacy seriously

Is my data secure?

• Luminello was built by mental health professionals for mental health professionals and their patients/clients, so we get how important security and privacy is – we use it in our practices everyday!
• Our entire EMR/EHR platform is HIPAA-compliant and we’ll put that in writing for providers in a business associate agreement (BAA).
• Luminello highly encrypts all data, including all communication between patients/clients and providers and between providers.
• No patient/client health information is stored on your computer or phone – so there is no HIPAA penalty if your phone or computer is lost/stolen/hacked.
• Additional state of the art technology is used to protect against hackers, as well as physical protection of data servers and administrative policies that strictly govern access.
• Your notes are auto-saved as a draft every two minutes, just like gmail and other commonly used web applications.
• All saved data is backed up off-site every night.
• Our servers are constantly being monitored for uptime, responsiveness and data security.
• Your credit card information is stored by our trusted credit card partner, on a server with the highest level of protection possible.
• We offer 2-factor authentication if you wish to add another layer of security to your account access.

Is my data private?

• We do not, and will never, sell identifiable patient data.
• Charts can only be viewed by authorized providers.
• Patient accounts are no-cost and ad-free.
• Paid provider subscriptions are ad-free.
• We pledge to abide by our privacy policy. And feel free to contact us if you have any further questions.

Do I really need to be HIPAA compliant?

• Yes, even “mom and pop” solo practitioners have to be compliant and to implement solutions that meet the minimum requirements.
• Aggrieved patients can easily file complaints on the US HHS website – no lawyer or knowledge of medical board needed.
• The HHS conducted 14,000 random audits last year.
• HIPAA is arguably the standard of care.
• One breach – even one that is not your fault, like losing your iPhone or your email getting hacked – may lead to an investigation of all possible breaches – and a data security audit of your entire practice.

What is the worst-case scenario if I’m not HIPAA compliant?

• The fines for HIPAA non-compliance are up to $1.5 million per year.
• Other expenses include investigation costs, serving notice to patients, potential licensing board fines, and having to provide identity protection coverage.
• One data security breach of protected health information can ruin your business reputation.

If I don’t take insurance, I don’t have to be HIPAA compliant, right?

• HIPAA is arguably the standard of care for all mental health providers, thereby making this exemption moot.
• State data privacy laws are becoming even more stringent and have no such exemption.