UT Health Science Center at Houston Safeguards Personal Health Information with NeoScale

Overview
The University of Texas Health Science Center at Houston is a component of the University of Texas System. Established in 1972, the Health Science Center (HSC) is comprised of schools for public health, nursing, health information services, biomedical sciences, molecular medicine, dentistry, and psychiatrics.
The HSC network services group supports more than 2000 desktops, servers and backend systems such as e-mail, file, networking, application and storage services for general administration, dental and medical schools. The HSC network services department manages a Windows and Novell environment that supports,administrative functions (e.g., e-mail), patient information, patient clinic billing, confidential patient and student (e.g., social security and credit card numbers) data, clinical studies, and locally stored digital radiographs applications, most of which are Personal Health Information (PHI).
With the deployment of NeoScale’s CryptoStor FC, HSC has successfully accomplished its objectives:
-Meeting HIPAA compliance
-Reducing costs
-Streamlining the processes associated with protecting PHI data within its storage infrastructure.

The Challenge
The storage infrastructure comprised of a HP/Compaq SAN managed by SANworks management software and deployed with HP adapters, switches and arrays, and StorageTek libraries. Traditional data network security components included physical, perimeter, operating system and application level security. HSC wanted to manage and reduce HIPAA compliance costs and processes associated with protecting PHI data within its storage infrastructure – a legacy SAN environment with evolving applications.
HSC needed to leverage SAN consolidation while locking down backend PHI data access:
-SANs to augment storage capacity, improve availability, as well as centralize management and support
-HIPAA compliance to force strict PHI access controls and storage environments
-Encryption to conceal the personal, confidential and identifiable information – thereby protecting PHI data
-Storing encrypted PHI data within a SAN and adding additional access controls to reduce the costs and administrative complexity of PHI-centric infrastructure, data classification, management and training efforts

Further considerations included supporting backend storage encryption that complemented front end security:
-Host-based encryption and application encryption for storage would affect application performance and would add administrative burdens that may not scale as new programs were introduced
-NAS-based encryption would not address their heterogeneous environment, nor meet non-file related storage protection requirements, and added more distributed, administrative overhead
-SAN-based storage security that included LUN masking and port Zoning but not data encryption

The Solution
The UT Health Science Center at Houston deployed NeoScale CryptoStor FC in a multi-path, inline configuration between two Brocade switches and the Compaq StorageWorks array. CryptoStor, an enterprise-class storage security appliance, provided UT with wire-speed encryption, optimized rule scalability, centralized policy and key management, storage Firewall access control, and completely transparent SAN operation for storage transport and media privacy (both arrays and tape). This layer of security was dropped in between SAN attached hosts and storage resources, encrypting data regardless of application or platform.
CryptoStor’s secure, remote Web interface allowed UT to set policies that activated access authorization and AES data encryption based on WWN, SID, DID, LUN, volume and block range. The appliance centrally protected and managed policies and keys using authenticated privilege-based access for secure administration. CryptoStor’s high availability maintained security policies across appliance cluster members. CryptoStor streamlined data storage security operations and offloads security processing to a centralized appliance platform.

The Result
UT achieved PHI data protection with the ability to manage shared storage – by having a unique encryption key for each business application. Unauthorized SAN communications were blocked. Designed to be application and platform agnostic, NeoScale appliances allowed The University of Texas Health Science Center at Houston to continue to reap security benefits as its applications and SAN evolved over time.