Sitemap

Clinical Information Database

The Health Buddy System includes a comprehensive security and privacy plan to prevent compromise of patient data.
Securing Protected Health Information

All clinical and patient information collected via the Health Buddy telemedical system is securely transmitted and stored in HIPAA-compliant databases that incorporate the requirements of customers, federal guidelines, and industry standards to provide data security and privacy using the best of modern technology.

A security and privacy plan requires continual review of both products and processes to prevent any compromise of patient data.  As such, we are committed to the ongoing inspection and enhancement of our data security and privacy.

Security Architecture

The clinical information databases of the Health Buddy system invoke a security architecture that involves four different areas of protection:


  • Physical Site Security
    The Health Buddy secure network is physically located at the NTT/Verio Premier site in San Jose, California. The Premier data center hosting the Health Buddy technology platform is one of six Premier centers in the United States, providing our customers with the best of network security and availability.  The Health Buddy platform has invoked a site security system consisting of comprehensive physical controls and multi-layered internal network safeguards. The core of the system resides in a premier data center under the physical and administrative control of one the world’s largest telecom and data service providers, NTT/Verio. The data center is physically protected by intrusion alarms, biometric devices, mantraps, surveillance cameras, and round-the-clock onsite security personnel.

 

  • Network Level Security
    The Health Buddy system’s perimeter access is controlled by proxy firewall mechanisms and around-the-clock intrusion detection. Client data is logged, archived and stored in a central data vault under the control of the Health Buddy System through our managed services partner, Euclid. Transport layer communications are currently secured with a standard 40-bit encryption technology under license of RSA Data Security, Inc. The standard 40-bit version includes capability for Server Gated Cryptography (SGC) that allows secure 128-bit transactions with the host server. Currently, more than 90% of the Health Buddy system’s customers take advantage of 128-bit connectivity, providing the most secure connection available over the Internet today. Another important element of any security strategy is the prevention of data attacks before they occur. Euclid provides real-time scanning of dedicated servers, as well as quarterly vulnerability tests by simulating attacks on networking systems. This allows network vulnerabilities to be corrected before security can be breached. Quarterly security audits are conducted with members of the Euclid and the Health Buddy system technical teams to review the outcomes of daily and quarterly assessments.

 

  • Server and Session Security
    The Health Buddy Desktop application requires encryption of transmissions that contain any patient healthcare information, including patient-identifying information. When transmitting data for display in a supported browser (i.e., Internet Explorer 5 or greater), the Health Buddy system presently allows either SSL 40-bit or 128-bit encryption, configurable on a per client basis. Authentication with a proper digital certificate is required before batch transfers of data; all data transmitted in these transfers is via SSL encryption. No unencrypted transactions occur with any Internet-based products that run on our technology platform.

 

  • Application Layer Security
    The Health Buddy Desktop application uses web servers that process HTTPS (secure HTTP) transactions from web clients using the Internet. The web servers authenticate the initial identification of a user, which remains active during a transaction session.The Health Buddy technology platform ensures the authenticity, integrity, and confidentiality of patient records during transmission. To meet this requirement, the Health Hero technology platform employs a combination of private phone lines and, when transmitting information over the Internet or other WAN, an encrypted hypertext transmission protocol using secure sockets layer technology (HTTPS). Patient information is collected as often as necessary by the platform, through connection of their Health Buddy patient interface to the Health Hero technology platform. Individual patients are uniquely identified and verified before data transfer occurs, and all unverified connections are logged and monitored. Patient information is transferred from the telecommunication servers to the database servers over the Internet utilizing the HTTPS secure and encrypted protocol and stored in the patient database.