Security & Data Handling
How we protect client information
Public website
Our public forms are not meant for patient information or PHI. Please do not submit PHI through contact or assessment forms.
Client information and agreements
Access requirements, responsibilities, approved systems and agreements are set during onboarding. A Business Associate Agreement is in place before we access PHI, where one is required.
Access management
Access is limited to authorized personnel, and only to what each role and task requires.
Secure access and devices
Client information is accessed and exchanged only through approved systems. Multi-factor authentication and managed, encrypted devices are required. PHI is shared only through approved, controlled channels, never consumer messaging tools.
Workforce responsibilities
Everyone on our team follows confidentiality, access-control and information-security requirements.
Incident management
Potential security or privacy incidents are escalated, investigated and addressed under internal and client-specific procedures.
Vendors and technology
Third-party technologies are evaluated based on the information they process and each engagement’s requirements.
Continuous improvement
Our security practices are reviewed and updated as services, technology and regulatory responsibilities change.
Reporting a concern
Contact us about security questions. Please don’t include sensitive information in your first message.
Questions? Email [email protected]. Please don't include patient information or PHI.