Compliance & Trust

Compliance and trust, by design.

How Alara's entities relate, the rules we operate under, and the controls built into the platform. Written to be examined.

How Alara is structured

Three entities, one management agreement.

Alara Healthcare Consulting LLC

Doing business as Alara Healthcare, a management services organization owned and led by Jonan Portal Alvarez, its Chief Executive Officer. Its administrative, analytics, and operations personnel are its own employees or contractors, never the practice's. It licenses the platform and provides administrative and management services only. It does not provide medical care.

Alara Population Health

The software platform operated by Alara Healthcare and provided to customers in isolated instances.

Alara One Care LLC

A Florida limited liability company owned and controlled by licensed practitioners, with every clinical matter and every major decision reserved to its practitioner members. Its President is Gonzalo Portal Lemock, APRN. Alara Healthcare Consulting LLC provides it administrative and management services under a written management services agreement and holds no office, employment, or authority in it.

Every client signs a combined business associate and confidentiality agreement before any data is exchanged.
Management fees are set in advance at fair market value for the services provided. They are never a share of collections or revenue and are not tied to the volume or value of referrals.
Clinical services and clinical decisions belong to the practice's licensed practitioners.
The two companies are related: Jonan Portal Alvarez, who owns and leads Alara Healthcare, is the son of Gonzalo Portal Lemock, Alara One Care's President. The management fee between them is set at fair market value on a documented basis, and the entities remain separately owned, separately governed, and separately banked.

What a management services organization does, and what it does not

Regulatory framework

The rules we operate under.

No arrangement is executed without review by Florida healthcare counsel, and every arrangement is structured to comply with applicable federal and Florida law. Participating practices should consult their own legal counsel before signing any agreement.

Federal Anti-Kickback Statute: Arrangements structured to meet applicable safe harbors.
Stark Law: Evaluated wherever designated health services are involved.
HIPAA Privacy and Security Rules: The platform is HIPAA compliant, and every client relationship begins with a signed business associate and confidentiality agreement. We do not hold, and do not claim, a third-party certification such as SOC 2 or HITRUST.
CMS program integrity: RADV readiness through Risk IQ audits and documentation review.
OIG compliance program guidance: The seven elements as the model for policies, training, auditing, and response.

Platform security controls

What the platform enforces.

Mandatory multi-factor authentication (authenticator app or phone), bot protection on sign-in, and trusted-device management. Invitation-only accounts; no public sign-up.
Role decides what you may do; location assignment decides whose data you see; providers see only their own attributed panel. Enforced in the database on every table, not just in the interface.
Every view of patient-level detail writes an access-log entry. Sign-ins, MFA events, and lockouts are recorded.
An immutable history of every work event: assignment, start, completion, skip, reopen.
Sessions time out after inactivity, with a hard 12-hour ceiling. Three failed sign-ins lock the account.
Notifications never carry protected health information, and the platform enforces that rule rather than trusting it.
Locked, fingerprinted MIPS snapshots so a filed position can be reproduced later.
Each customer is provisioned its own instance: a separate database, with its own credentials, holding that customer's data alone. No shared tables, no cross-customer control plane.
Documentation never displays customer data; screenshots come from a synthetic demonstration tenant.
A HIPAA-compliant platform. Every client signs a combined business associate and confidentiality agreement before any data is exchanged.

Data handling

Your data stays yours.

Each customer's data lives in an instance provisioned for that customer alone.
Documentation never displays customer data; screenshots come from a synthetic demonstration tenant with an automated PHI-pattern guard.
When a data quality check fails badly enough, the affected dataset is withheld rather than shown wrong.
Users are deactivated, never deleted, so completed work and history stay attached to the record.

Questions

For compliance, privacy, or security questions, write to compliance@alarahealth.net. Privacy requests go to privacy@alarahealth.net.