Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Risk

8/1/2011
03:37 PM
50%
50%

Tennessee BlueCross BlueShield Encrypts All Its Data

The insurer claims to be first anywhere to encrypt all "at-rest" data across the enterprise, a project that was put on the fast track after an embarrassing data breach.

Healthcare IT Vendor Directory
Slideshow: Healthcare IT Vendor Directory
(click image for larger view and for slideshow)
BlueCross BlueShield of Tennessee (BCBST) claims to be the first private company in the healthcare industry--and possibly in any industry--to encrypt all at-rest data across its entire enterprise, the culmination of a project accelerated by a high-profile data theft nearly two years ago.

Tennessee Blues last week announced the completion of its $6 million encryption effort that included the securing of 885 terabytes of mass data storage, the equivalent of 35,000 single-layer Blu-ray discs, the locking down of 1,000 Windows, AIX, SQL, VMWare, and Xen server hard drives, 6,000 additional workstation and removable hard drives, and 136,000 volumes of backup tape, according to the Chattanooga, Tenn.-based company. BlueCross BlueShield of Tennessee also is securing recordings of 25,000 voice calls per day.

In all, the project took 5,000 hours of work, the company said. "The piece that we think is unique is that we have done all at-rest data in the enterprise," Michael Lawley, BlueCross' VP of technology shared services, told InformationWeek Healthcare. He defined "at-rest" data as anything that can be placed on a storage device. "We searched the country and were unable to find another company that has achieved this level of data encryption."

The company, the largest commercial health insurer in the state, was planning to encrypt many of its data stores, but accelerated and augmented its plan after an October 2009 theft of 57 hard drives from a training facility in Chattanooga. The drives held audio and video recordings of provider and member calls to Blues customer-service representatives, and included personal information on about 1 million insured people, according to the Blues.

"At this point, we have no evidence that any of the data was accessed," said Lawley, who believes that some of his own personal information was on the stolen drives. But the company did take a pounding in the court of public opinion. "Our business is built off trust," Lawley said. Plus, any data loss today would open the company up to greater liability under the tougher HIPAA provisions called for in the 2009 American Recovery and Reinvestment Act.

"What this [theft] did is it sped up a program that we had already started," Lawley said. "We thought it would take three to five years. It took just under two years."

According to Lawley, the encryption encompasses off-the-shelf technology from multiple vendors, with custom engineering by BCBST to assure that there would be little or no performance loss. "When going to encryption," Lawley said, "there's the possibility of performance hits."

He said that the company engineered methods to access the encrypted data in ways that would not slow down authorized users.

"Data encryption is achieved through the use of algorithms, which convert normal, readable information into an indecipherable format, and secure keys, which allow only authorized users to convert the information back into a format they can use. This means that even in the event of a theft or some other security breach, no one would be able to read the data contained on BlueCross hardware, whether it was a computer, server or flash drive," the company said in a press release.

BCBST has posted more information for the public, including a video, at http://www.bcbst.com/data.

Find out how health IT leaders are dealing with the industry's pain points, from allowing unfettered patient data access to sharing electronic records. Also in the new, all-digital issue of InformationWeek Healthcare: There needs to be better e-communication between technologists and clinicians. Download the issue now. (Free registration required.)

Comment  | 
Print  | 
More Insights
Comments
Threaded  |  Newest First  |  Oldest First
News
Inside the Ransomware Campaigns Targeting Exchange Servers
Kelly Sheridan, Staff Editor, Dark Reading,  4/2/2021
Commentary
Beyond MITRE ATT&CK: The Case for a New Cyber Kill Chain
Rik Turner, Principal Analyst, Infrastructure Solutions, Omdia,  3/30/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-23371
PUBLISHED: 2021-04-12
This affects the package chrono-node before 2.2.4. It hangs on a date-like string with lots of embedded spaces.
CVE-2020-24285
PUBLISHED: 2021-04-12
INTELBRAS TELEFONE IP TIP200 version 60.61.75.22 allows an attacker to obtain sensitive information through /cgi-bin/cgiServer.exx.
CVE-2021-29379
PUBLISHED: 2021-04-12
** UNSUPPORTED WHEN ASSIGNED ** An issue was discovered on D-Link DIR-802 A1 devices through 1.00b05. Universal Plug and Play (UPnP) is enabled by default on port 1900. An attacker can perform command injection by injecting a payload into the Search Target (ST) field of the SSDP M-SEARCH discover pa...
CVE-2015-20001
PUBLISHED: 2021-04-11
In the standard library in Rust before 1.2.0, BinaryHeap is not panic-safe. The binary heap is left in an inconsistent state when the comparison of generic elements inside sift_up or sift_down_range panics. This bug leads to a drop of zeroed memory as an arbitrary type, which can result in a memory ...
CVE-2020-36317
PUBLISHED: 2021-04-11
In the standard library in Rust before 1.49.0, String::retain() function has a panic safety problem. It allows creation of a non-UTF-8 Rust string when the provided closure panics. This bug could result in a memory safety violation when other string APIs assume that UTF-8 encoding is used on the sam...