UT Health Science Center at Houston Safeguards Personal Health Information with NeoScale

Case Study: UT Health Science Center at Houston, revised in 2007
UT Health Science Center at Houston Safeguards Personal
Health Information with NeoScale Application HIPAA Compliance to Prevent Unauthorized Disclosure or Misuse of PHI "We tested the appliance and Overview determined that it provided the data protection capability completely transparent to users and without The University of Texas Health Science Center at Houston is a component of the affecting application performance." University of Texas System. Established in 1972, the Health Science Center (HSC) is comprised of schools for public health, nursing, health information services, biomedical - Kevin Granhold, Network sciences, molecular medicine, dentistry, and psychiatrics. Services Manager, UT Health Science Center at Houston The HSC network services group supports more than 2000 desktops, servers and backend systems such as e-mail, file, networking, application and storage services for general administration, dental and medical schools. The HSC network services department manages a Windows and Novell environment that supports,administrative Benefits functions (e.g., e-mail), patient information, patient clinic billing, confidential patient and student (e.g., social security and credit card numbers) data, clinical studies, and locally ƒ Remove access and theft stored digital radiographs applications, most of which are Personal Health Information risk for tapes leaving the data center (PHI). With the deployment of NeoScale's CryptoStor FC, HSC has successfully ƒ Enforce confidentiality of accomplished its objectives: customer data ƒ Meeting HIPAA compliance ƒ Reducing costs ƒ Integrate seamlessly into ƒ Streamlining the processes associated with protecting PHI data within its existing infrastructure storage infrastructure. ƒ Achieve audit and regulatory privacy compliance The Challenge The storage infrastructure comprised of a HP/Compaq SAN managed by SANworks management software and deployed with HP adapters, switches and arrays, and StorageTek libraries. Traditional data network security components included physical, perimeter, operating system and application level security. HSC wanted to manage and reduce HIPAA compliance costs and processes associated with protecting PHI data within its storage infrastructure - a legacy SAN environment with evolving applications. HSC needed to leverage SAN consolidation while locking down backend PHI data access: ƒ SANs to augment storage capacity, improve availability, as well as centralize management and support ƒ HIPAA compliance to force strict PHI access controls and storage environments ƒ Encryption to conceal the personal, confidential and identifiable information - thereby protecting PHI data ƒ Storing encrypted PHI data within a SAN and adding additional access controls to reduce the costs and administrative complexity of PHI-centric infrastructure, data classification, management and training efforts Copyright ©2002-2007 by NeoScale Systems, Inc. Milpitas, CA, USA. All rights reserved. 1 Case Study: UT Health Science Center at Houston, revised in 2007
HIPAA Compliance The Challenge Continued Further considerations included supporting backend storage encryption that The Health Insurance Portability & complemented front end security: Accountability Act (HIPAA) is intended to improve health care ƒ Host-based encryption and application encryption for storage would affect administration and transaction application performance and would add administrative burdens that may not information processing. The act scale as new programs were introduced ensures the protection of Personal ƒ NAS-based encryption would not address their heterogeneous environment, Health Information (PHI) as a nor meet non-file related storage protection requirements, and added more means to reduce fraud and distributed, administrative overhead inappropriate use. HIPAA ƒ SAN-based storage security that included LUN masking and port Zoning but compliance prevents unauthorized not data encryption disclosure or misuse of PHI and is mandatory to all parties engaged in the health industry. In particular, all members associated with a transaction The Solution involving PHI data must demonstrate best practices for the reasonable protection of the data The UT Health Science Center at Houston deployed NeoScale Crypto... [download for more]