Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Risk

8/1/2011
03:37 PM
50%
50%

Tennessee BlueCross BlueShield Encrypts All Its Data

The insurer claims to be first anywhere to encrypt all "at-rest" data across the enterprise, a project that was put on the fast track after an embarrassing data breach.

Healthcare IT Vendor Directory
Slideshow: Healthcare IT Vendor Directory
(click image for larger view and for slideshow)
BlueCross BlueShield of Tennessee (BCBST) claims to be the first private company in the healthcare industry--and possibly in any industry--to encrypt all at-rest data across its entire enterprise, the culmination of a project accelerated by a high-profile data theft nearly two years ago.

Tennessee Blues last week announced the completion of its $6 million encryption effort that included the securing of 885 terabytes of mass data storage, the equivalent of 35,000 single-layer Blu-ray discs, the locking down of 1,000 Windows, AIX, SQL, VMWare, and Xen server hard drives, 6,000 additional workstation and removable hard drives, and 136,000 volumes of backup tape, according to the Chattanooga, Tenn.-based company. BlueCross BlueShield of Tennessee also is securing recordings of 25,000 voice calls per day.

In all, the project took 5,000 hours of work, the company said. "The piece that we think is unique is that we have done all at-rest data in the enterprise," Michael Lawley, BlueCross' VP of technology shared services, told InformationWeek Healthcare. He defined "at-rest" data as anything that can be placed on a storage device. "We searched the country and were unable to find another company that has achieved this level of data encryption."

The company, the largest commercial health insurer in the state, was planning to encrypt many of its data stores, but accelerated and augmented its plan after an October 2009 theft of 57 hard drives from a training facility in Chattanooga. The drives held audio and video recordings of provider and member calls to Blues customer-service representatives, and included personal information on about 1 million insured people, according to the Blues.

"At this point, we have no evidence that any of the data was accessed," said Lawley, who believes that some of his own personal information was on the stolen drives. But the company did take a pounding in the court of public opinion. "Our business is built off trust," Lawley said. Plus, any data loss today would open the company up to greater liability under the tougher HIPAA provisions called for in the 2009 American Recovery and Reinvestment Act.

"What this [theft] did is it sped up a program that we had already started," Lawley said. "We thought it would take three to five years. It took just under two years."

According to Lawley, the encryption encompasses off-the-shelf technology from multiple vendors, with custom engineering by BCBST to assure that there would be little or no performance loss. "When going to encryption," Lawley said, "there's the possibility of performance hits."

He said that the company engineered methods to access the encrypted data in ways that would not slow down authorized users.

"Data encryption is achieved through the use of algorithms, which convert normal, readable information into an indecipherable format, and secure keys, which allow only authorized users to convert the information back into a format they can use. This means that even in the event of a theft or some other security breach, no one would be able to read the data contained on BlueCross hardware, whether it was a computer, server or flash drive," the company said in a press release.

BCBST has posted more information for the public, including a video, at http://www.bcbst.com/data.

Find out how health IT leaders are dealing with the industry's pain points, from allowing unfettered patient data access to sharing electronic records. Also in the new, all-digital issue of InformationWeek Healthcare: There needs to be better e-communication between technologists and clinicians. Download the issue now. (Free registration required.)

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Mobile Banking Malware Up 50% in First Half of 2019
Kelly Sheridan, Staff Editor, Dark Reading,  1/17/2020
Active Directory Needs an Update: Here's Why
Raz Rafaeli, CEO and Co-Founder at Secret Double Octopus,  1/16/2020
Google Lets iPhone Users Turn Device into Security Key
Kelly Sheridan, Staff Editor, Dark Reading,  1/15/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
The Year in Security: 2019
This Tech Digest provides a wrap up and overview of the year's top cybersecurity news stories. It was a year of new twists on old threats, with fears of another WannaCry-type worm and of a possible botnet army of Wi-Fi routers. But 2019 also underscored the risk of firmware and trusted security tools harboring dangerous holes that cybercriminals and nation-state hackers could readily abuse. Read more.
Flash Poll
How Enterprises are Attacking the Cybersecurity Problem
How Enterprises are Attacking the Cybersecurity Problem
Organizations have invested in a sweeping array of security technologies to address challenges associated with the growing number of cybersecurity attacks. However, the complexity involved in managing these technologies is emerging as a major problem. Read this report to find out what your peers biggest security challenges are and the technologies they are using to address them.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2011-3595
PUBLISHED: 2020-01-22
Multiple Cross-site Scripting (XSS) vulnerabilities exist in Joomla! through 1.7.0 in index.php in the search word, extension, asset, and author parameters.
CVE-2011-3610
PUBLISHED: 2020-01-22
A Cross-site Scripting (XSS) vulnerability exists in the Serendipity freetag plugin before 3.30 in the tagcloud parameter to plugins/serendipity_event_freetag/tagcloud.swf.
CVE-2019-18583
PUBLISHED: 2020-01-22
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2019. Notes: none.
CVE-2019-18584
PUBLISHED: 2020-01-22
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2019. Notes: none.
CVE-2019-18585
PUBLISHED: 2020-01-22
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2019. Notes: none.