The RosettaHealth Platform was designed and operates with the highest levels of security. Our security and privacy goes beyond HIPAA and HITECH requirements, to provide a high security cloud-platform for exchanging records that is used by federal agencies, state-level HIEs, and many Health IT vendors and Hospitals.
All transmission protocols into or out of our protected infrastructure is encrypted. Web services are protected by industry standard SSL/TLS encrypted channels. Direct Secure Messaging is protected by a highly secure PKI infrastructure approved by HHS.
Direct Secure Messaging encrypts data using a PKI infrastructure that ensures non-repudiation. The digital certificates used require level of assurance 3 (LOA3) proofing of individuals and organizations -- so you know you are talking to who you intend to talk to. Additionally, certificates are exchanged by organizations that trust each other. Only trusted organizations can exchange data. RosettaHealth uses the largest trust network available: DirectTrust.org. All member of the trust network undergo rigorous accreditation for HIPAA, HITECH and additional security and procedures.
RosettaHealth maintains a high level of security on it's protected infrastructure. The following provides an overview of the security architecture and operating procedures the ensure RosettaHealth's security.
The security architecture of HISPDirect is based on a multi-component model. This model covers the entire scope of systems related security from the outermost layers of physical security controls to the lowest level of digital controls. This model also includes supporting components that provide the governance polices and implementation mechanisms required for a securely operating solution.
Physical Security Controls
Physical access to the hosting infrastructure is managed by BYTEGRID. This includes things such as controlled access to the facility, server rooms, network operations center, etc. Their controls have been found in compliance with HIPAA regulations as per their ENHAC accreditation
BYTEGRID is a highly secure, data center used for bio-data hosting, election results, and health IT applications. BYTEGRID maintains high physical security around their facilities, and offers secure, compliant cloud hosting of data. They are only of the few HIPAA-compliant hosting facilities to attain the EHNAC OSAP Data Center accreditation.
Network Security Controls
Network controls involve infrastructure mechanism to thwart un-authorized access to systems within the BYTEGRID LAN. This includes items such as Firewalls, Security Information and Event Management (SIEM) tools, and Network Operations monitoring systems. The controls used by BYTEGRID have been found in compliance with HIPAA regulations as per their ENHAC accreditation
Server Security Controls
These controls concern access server instances use for HISPDirect. The major components of these controls include the following:
VLAN firewalls that control traffic from the internet to the HISPDirect systems. Rules are established to only allow certain types of traffic through certain ports.
IPTable rules on the individual virtual servers control access to each server from within the VLAN
VPN accounts are required to access the HISPDirect servers directly and for all HISPDirect administration systems. Only HISPDirect administrators are given VPN accounts.
Application Security Controls
Application Security Controls provide the mechanisms for controlling access to the different components and mechanisms of the HISPDirect system. These controls include:
Drive level encryption for protection of Direct messages at rest. Encryption is controlled by symmetric key using AES 256. The symmetric keys are held on a secured system outside of the Sidus BioData facility and is only accessible to HISPDirect administrators.
Direct account level security is managed by use of individual account address/password. Only users who possess the proper address/password can access the associated accounts and Direct messages
Direct certificates, which are used for encryption and digital signing of direct messages is protected by symmetric key encryption within the HISPDirect system. The symmetric keys are held on a secured system outside of the Sidus BioData facility and is only accessible to HISPDirect administrators.
Operating System Security Controls
Controls at the operating system level provide management of access to the functions of the Linux operating system. These controls include:
- Restricting access to individual HISPDirect administrators through use of Secure Shell (ssh) via VPN tunnels.
Run-level restrictions for individual services
Auditing and Monitoring
Supporting the aforementioned security controls are mechanism for auditing and monitoring various access channels into the HISPDirect system. At the outermost levels are mechanisms employed by Sidus BioData for monitoring and logging access to their facilities and network components. These mechanisms were part of their ENHAC audit and were found to be compliant to HIPAA regulations. Application and Operating System controls are handled by HISPDirect through extensive access and event logging. Monitoring is provided by the OSSEC (http://www.ossec.net) Intrusion Detection System. This system provides real-time reports on access to the HISPDirect systems as well as daily summary reports. These reports are sent for review to all HISPDirect administrations.
HIPAA Compliant Policies and Procedures
To govern the use of the other security architecture components requires a set of proven HIPAA compliant policies and procedures. These are in place for both BYTEGRID and Nitor Group as attested by our respective ENHAC accreditations as an OSAP Data Center and DTAAP HISP. The required audits and inspections required for those accreditations validate the polices and procedures of each organization as being compliant with security requirements of HIPAA.
Our security and privacy policies and procedures are available for review upon request.
Our security and privacy goes beyond required compliance. With RosettaHealth, you are ensured of the highest levels of security in health information exchange. Some example practices are:
Data encryption: whether at rest, or in-transport, we are committed to keeping data encrypted.
Running and monitoring OSSEC intrusion detection systems on our production systems,
Running and auditing penetration tests on a regular basis,
All external connections are encrypted and authenticated,
- Direct access to infrastructure is limited to a few employees via VPN with digital certificate credentials,
- Vendor and user access to health data requires LOA3 identity proofing,
- Federal Bridge Cross Certified certificates used in PKI,
- All transactions in or out of protected infrastructure are audited and traceable through simple tools.