Marlien / Security
Know how sensitive information is handled before you share it.
Credentialing can involve provider identifiers, licenses, and controlled-substance registrations. Billing can involve patient information. Marlien uses access controls, encryption, activity logs, and written agreements to protect the information client work requires.
At a glance
How your information is protected
A second sign-in factor is required.
Each account uses a password and a code from an authenticator app. Accounts are created individually, with no self-service sign-up. Sessions end after 30 minutes of inactivity, and no session lasts longer than 8 hours.
Stored documents are encrypted.
Files are encrypted with AES-256 before storage. Encryption keys are kept separately from files and backups.
Access and activity are recorded.
Sign-ins, document views, and review decisions are logged so activity can be traced.
Roles control who can act.
Role-based permissions determine who can review, approve, and change records. Access is not based on shared accounts.
Systems are hosted in the United States.
Client systems run on Google Cloud in the United States under Google's business associate agreement. The database has no public internet address.
Backups and a restore procedure exist.
The database is backed up daily, with backups kept for 14 days and point-in-time recovery available. Document storage is snapshotted daily and kept for 14 days. Marlien has a documented restore procedure and a restore drill scheduled each quarter.
Privacy responsibilities in writing
Agreement first
When client work involves protected health information, the applicable business associate agreement is completed before that information is exchanged.
Review our responsibilities
The agreement explains permitted uses, required safeguards, and the steps that apply if an incident occurs.
Same rules for approved help
Anyone authorized to support work involving protected health information must accept the applicable confidentiality and business associate obligations first.
Sales and marketing systems are not used to store patient information. Client records are kept in approved systems covered by the required agreements.
What we ask of you
Security questions
Not through website forms or ordinary email. After the engagement begins, Marlien provides an approved secure process for sharing documents.
When client work involves protected health information, the applicable business associate agreement is completed before that information is exchanged.
Business contact details only. Do not include patient information, Social Security numbers, tax IDs, bank details, or provider credentials.