Health
Health ManagementWellness ManagementWealthLegacyCompany
AboutOur StoryMission & VisionLeadershipCareersCorporate PoliciesResearch
Research OverviewResearch PartnersPublicationsCase StudiesFor Partners
Brokers & EmployersHealth Plans & TPAsHealthcare OrganizationsLTC & Assisted LivingMedical ProvidersPartner NetworkPartner DirectoryResources
BlogCase StudiesMedia KitLearning CenterContactView
Legacy Cloud DirectoryObituary DirectoryCorporate Policy
Information Security Policy
How we secure systems, data, and infrastructure.
Last updated: May 18, 2026
1. Commitment to Security
Alphiniti is committed to maintaining the highest standards of information security. This policy outlines our approach to protecting the confidentiality, integrity, and availability of your data.
2. Security Framework
Our security program is built on industry-standard frameworks:
- SOC 2 Type II compliance (ready)
- HIPAA compliance for healthcare data
- NIST Cybersecurity Framework
- ISO 27001 principles
- GDPR data protection requirements
3. Technical Safeguards
Encryption
- End-to-end encryption for all data in transit (TLS 1.3)
- AES-256 encryption for data at rest
- Encrypted backups and disaster recovery
- Key management using industry best practices
Access Controls
- Multi-factor authentication (MFA) required
- Role-based access control (RBAC)
- Principle of least privilege
- Regular access reviews and audits
- Session timeout and automatic logout
Network Security
- Firewall protection and intrusion detection
- Regular vulnerability scanning
- Penetration testing by third parties
- DDoS mitigation and monitoring
- Secure software development lifecycle
4. Organizational Safeguards
Employee Training
All employees receive:
- Annual security awareness training
- Role-specific security education
- Phishing simulation exercises
- Confidentiality agreements
Background Checks
All employees and contractors with access to sensitive data undergo comprehensive background checks prior to employment.
5. Data Protection
Data Classification
We classify data into categories:
- Public - Information that can be freely shared
- Internal - Business information for employees only
- Confidential - Sensitive business data
- Restricted - PHI, PII, and highly sensitive information
Data Handling
- Minimum necessary data collection
- Purpose limitation and data minimization
- Secure data disposal procedures
- Data retention policies and schedules
6. Incident Response
We maintain a comprehensive incident response program:
- 24/7 security monitoring and alerting
- Documented incident response procedures
- Dedicated incident response team
- Regular tabletop exercises
- Breach notification within 72 hours
- Post-incident review and remediation
7. Business Continuity
We maintain:
- Geographically distributed data centers
- Automated backup procedures
- Disaster recovery plans with RTO/RPO targets
- Regular backup testing and restoration drills
- Redundant systems and failover capabilities
8. Third-Party Risk Management
All vendors and service providers undergo:
- Security assessments prior to engagement
- Contractual security requirements
- Regular compliance monitoring
- Data processing agreements (DPAs)
- Annual security reviews
9. Compliance and Auditing
We conduct:
- Annual SOC 2 Type II audits
- Regular HIPAA compliance assessments
- Internal security audits quarterly
- Continuous compliance monitoring
- Comprehensive audit logging
10. Policy Updates
This Information Security Policy is reviewed annually and updated as needed to reflect changes in our operations, technology, and regulatory requirements.
Questions About Compliance?
For questions about this policy, please contact us at: compliance@alphiniti.com