RosettaHealth Security



Physical Security Controls

Physical access to the hosting infrastructure is managed by BYTEGRID. This includes things such as controlled access to the facility, server rooms, network operations center, etc. Their controls have been found in compliance with HIPAA regulations as per their ENHAC accreditation

BYTEGRID is a highly secure, data center used for bio-data hosting, election results, and health IT applications.  BYTEGRID maintains high physical security around their facilities, and offers secure, compliant cloud hosting of data.  They are only of the few HIPAA-compliant hosting facilities to attain the EHNAC OSAP Data Center accreditation.

Network Security Controls

Network controls involve infrastructure mechanism to thwart un-authorized access to systems within the BYTEGRID LAN. This includes items such as Firewalls, Security Information and Event Management (SIEM) tools, and Network Operations monitoring systems. The controls used by BYTEGRID have been found in compliance with HIPAA regulations as per their ENHAC accreditation

Server Security Controls

These controls concern access server instances use for HISPDirect. The major components of these controls include the following:

• VLAN firewalls that control traffic from the internet to the HISPDirect systems. Rules are established to only allow certain types of traffic through certain ports.
  
• IPTable rules on the individual virtual servers control access to each server from within the VLAN
  
• VPN accounts are required to access the HISPDirect servers directly and for all HISPDirect administration systems. Only HISPDirect administrators are given VPN accounts.
  

Application Security Controls

Application Security Controls provide the mechanisms for controlling access to the different components and mechanisms of the HISPDirect system. These controls include:

• Drive level encryption for protection of Direct messages at rest. Encryption is controlled by symmetric key using AES 256. The symmetric keys are held on a secured system outside of the Sidus BioData facility and is only accessible to HISPDirect administrators.
  
• Direct account level security is managed by use of individual account address/password. Only users who possess the proper address/password can access the associated accounts and Direct messages
  
• Direct certificates, which are used for encryption and digital signing of direct messages is protected by symmetric key encryption within the HISPDirect system. The symmetric keys are held on a secured system outside of the Sidus BioData facility and is only accessible to HISPDirect administrators.
  

Operating System Security Controls

Controls at the operating system level provide management of access to the functions of the Linux operating system. These controls include:

• Restricting access to individual HISPDirect administrators through use of Secure Shell (ssh) via VPN tunnels.
• Run-level restrictions for individual services
  

Auditing and Monitoring

Supporting the aforementioned security controls are mechanism for auditing and monitoring various access channels into the HISPDirect system. At the outermost levels are mechanisms employed by Sidus BioData for monitoring and logging access to their facilities and network components. These mechanisms were part of their ENHAC audit and were found to be compliant to HIPAA regulations. Application and Operating System controls are handled by HISPDirect through extensive access and event logging. Monitoring is provided by the OSSEC (http://www.ossec.net) Intrusion Detection System. This system provides real-time reports on access to the HISPDirect systems as well as daily summary reports. These reports are sent for review to all HISPDirect administrations.

HIPAA Compliant Policies and Procedures

To govern the use of the other security architecture components requires a set of proven HIPAA compliant policies and procedures. These are in place for both BYTEGRID and Nitor Group as attested by our respective ENHAC accreditations as an OSAP Data Center and DTAAP HISP. The required audits and inspections required for those accreditations validate the polices and procedures of each organization as being compliant with security requirements of HIPAA.