Privacy & Security Controls
The technical and policy controls that protect workforce health data, enforce access boundaries, and prevent re-identification.
Privacy controls
MeasuredNo aggregated view is shown for any group smaller than 11 members. Prevents re-identification through small populations.
Employer admins can never retrieve individual clinical records, member-level health data, or raw measurements. Access is restricted to aggregated, privacy-safe views.
Filter combinations (division + location + period) that would produce a group under 11 members are automatically suppressed. No partial results are shown.
PHI is de-identified per HIPAA Safe Harbor and Expert Determination methods where applicable. De-identified data is used for analytics and benchmarking.
Access is granted by role, not by page visibility. Data-layer enforcement ensures users cannot access data their role does not permit, regardless of UI state.
All data access, modifications, and exports are logged with user identity, timestamp, and action. Logs are retained for 7 years and available to auditors.
All data in transit is encrypted using TLS 1.2 or higher. Certificate management and rotation are automated.
All stored data is encrypted at rest using AES-256. Key management follows industry best practices with regular rotation.
Data classification & access boundaries
ObservedWeight, BMI, blood pressure, HbA1c, prescription records, clinical outcomes
Name, email, employee ID, department, location, role title
Workforce KPIs, cost summaries, participation rates, trend charts
SLA metrics, vendor performance, system uptime, audit logs
The 11-member minimum aggregation rule
Every aggregated view in this platform enforces a minimum group size of 11 members. If a filter combination (division + location + period) produces a group smaller than 11, the view is suppressed — no partial results, no counts, no percentages. This prevents re-identification through small populations and is enforced at the data layer, not just in the UI.
Employee Privacy Protected by Design
Employer reporting is designed to present aggregate workforce and health-program insights without exposing individual clinical records. Small-group reporting restrictions help reduce the risk of employee identification.
Aggregated information is not described as HIPAA-de-identified unless applicable de-identification requirements have been satisfied and verified.