Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Risk

8/1/2011
03:37 PM
50%
50%

Tennessee BlueCross BlueShield Encrypts All Its Data

The insurer claims to be first anywhere to encrypt all "at-rest" data across the enterprise, a project that was put on the fast track after an embarrassing data breach.

Healthcare IT Vendor Directory
Slideshow: Healthcare IT Vendor Directory
(click image for larger view and for slideshow)
BlueCross BlueShield of Tennessee (BCBST) claims to be the first private company in the healthcare industry--and possibly in any industry--to encrypt all at-rest data across its entire enterprise, the culmination of a project accelerated by a high-profile data theft nearly two years ago.

Tennessee Blues last week announced the completion of its $6 million encryption effort that included the securing of 885 terabytes of mass data storage, the equivalent of 35,000 single-layer Blu-ray discs, the locking down of 1,000 Windows, AIX, SQL, VMWare, and Xen server hard drives, 6,000 additional workstation and removable hard drives, and 136,000 volumes of backup tape, according to the Chattanooga, Tenn.-based company. BlueCross BlueShield of Tennessee also is securing recordings of 25,000 voice calls per day.

In all, the project took 5,000 hours of work, the company said. "The piece that we think is unique is that we have done all at-rest data in the enterprise," Michael Lawley, BlueCross' VP of technology shared services, told InformationWeek Healthcare. He defined "at-rest" data as anything that can be placed on a storage device. "We searched the country and were unable to find another company that has achieved this level of data encryption."

The company, the largest commercial health insurer in the state, was planning to encrypt many of its data stores, but accelerated and augmented its plan after an October 2009 theft of 57 hard drives from a training facility in Chattanooga. The drives held audio and video recordings of provider and member calls to Blues customer-service representatives, and included personal information on about 1 million insured people, according to the Blues.

"At this point, we have no evidence that any of the data was accessed," said Lawley, who believes that some of his own personal information was on the stolen drives. But the company did take a pounding in the court of public opinion. "Our business is built off trust," Lawley said. Plus, any data loss today would open the company up to greater liability under the tougher HIPAA provisions called for in the 2009 American Recovery and Reinvestment Act.

"What this [theft] did is it sped up a program that we had already started," Lawley said. "We thought it would take three to five years. It took just under two years."

According to Lawley, the encryption encompasses off-the-shelf technology from multiple vendors, with custom engineering by BCBST to assure that there would be little or no performance loss. "When going to encryption," Lawley said, "there's the possibility of performance hits."

He said that the company engineered methods to access the encrypted data in ways that would not slow down authorized users.

"Data encryption is achieved through the use of algorithms, which convert normal, readable information into an indecipherable format, and secure keys, which allow only authorized users to convert the information back into a format they can use. This means that even in the event of a theft or some other security breach, no one would be able to read the data contained on BlueCross hardware, whether it was a computer, server or flash drive," the company said in a press release.

BCBST has posted more information for the public, including a video, at http://www.bcbst.com/data.

Find out how health IT leaders are dealing with the industry's pain points, from allowing unfettered patient data access to sharing electronic records. Also in the new, all-digital issue of InformationWeek Healthcare: There needs to be better e-communication between technologists and clinicians. Download the issue now. (Free registration required.)

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
News
Inside the Ransomware Campaigns Targeting Exchange Servers
Kelly Sheridan, Staff Editor, Dark Reading,  4/2/2021
Commentary
Beyond MITRE ATT&CK: The Case for a New Cyber Kill Chain
Rik Turner, Principal Analyst, Infrastructure Solutions, Omdia,  3/30/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-22879
PUBLISHED: 2021-04-14
Nextcloud Desktop Client prior to 3.1.3 is vulnerable to resource injection by way of missing validation of URLs, allowing a malicious server to execute remote commands. User interaction is needed for exploitation.
CVE-2021-27989
PUBLISHED: 2021-04-14
Appspace 6.2.4 is vulnerable to stored cross-site scripting (XSS) in multiple parameters within /medianet/sgcontentset.aspx.
CVE-2021-25316
PUBLISHED: 2021-04-14
A Insecure Temporary File vulnerability in s390-tools of SUSE Linux Enterprise Server 12-SP5, SUSE Linux Enterprise Server 15-SP2 allows local attackers to prevent VM live migrations This issue affects: SUSE Linux Enterprise Server 12-SP5 s390-tools versions prior to 2.1.0-18.29.1. SUSE Linux Enterp...
CVE-2021-28797
PUBLISHED: 2021-04-14
A stack-based buffer overflow vulnerability has been reported to affect QNAP NAS devices running Surveillance Station. If exploited, this vulnerability allows attackers to execute arbitrary code. QNAP have already fixed this vulnerability in the following versions: Surveillance Station 5.1.5.4.3 (an...
CVE-2020-36323
PUBLISHED: 2021-04-14
In the standard library in Rust before 1.50.3, there is an optimization for joining strings that can cause uninitialized bytes to be exposed (or the program to crash) if the borrowed string changes after its length is checked.