Skip to main content

Security Overview

Secure by Design​

CareLaunch's product is built using a secure development process that includes:

  • Open Source Security Code Scanning: Automated analysis of code to detect vulnerabilities.
  • Automated Code Deployment and Infrastructure Provisioning: Ensures consistent and secure application updates.
  • Continuous Monitoring: Tracks environment changes and versions to identify potential risks.

CareLaunch leverages industry-leading tools to ensure HIPAA/GDPR compliance and implements robust controls to reduce risk and protect sensitive data.

PHI Overview​

Protected Health Information (PHI) is securely stored using the Google Cloud Platform (GCP) Healthcare API, which offers:

  • Comprehensive security controls, monitoring, and review.
  • Segregation from other resources using:
    • Identity and Access Management (IAM).
    • Network-level filtering.
    • Certificate-based authentication.

Compliance Certifications​

Google undergoes regular independent third-party audits, providing external verification. Key certifications include:

Access Control​

Authentication​

  • Strong Passwords: Required for all user accounts.
  • Multi-Factor Authentication (MFA): Optional but recommended for additional security.
  • Login Protections:
    • Failed attempts logged.
    • Account lock after 5 failed attempts within 5 minutes.
  • Session Management:
    • Sessions expire after 30 minutes of inactivity, requiring re-authentication.
  • Advanced Security: Risk-based adaptive authentication and compromised credential detection.

User Provisioning​

  • Administrators can:
    • Provision and revoke access.
    • Revoke patient access and delete patient data.
  • Principle of Least Privilege: Access granted based on role-specific needs.
  • Role-Based Access Control: Includes roles with varying permissions (e.g., read-only, update restrictions).

Endpoint Security​

  • Web Application Firewalls (WAFs):
    • Filter malicious requests.
    • Block known bad actor IPs.
    • Enable geographic filtering.
  • Internal System Protections:
    • Accessible only within a secure internal network.
    • Route access restricted to approved application instances.
  • Multi-Layer Security:
    • Limited permissions and separation of responsibilities.
    • Private virtual network with whitelist-only load balancer access.
  • Infrastructure Updates:
    • Monitored and automatically updated.
    • Changes require approval and generate alerts.

Monitoring, Logging, and Alerting​

  • Monitoring:
    • Infiltration attempts, system errors, and performance issues are actively monitored.
  • Alerting:
    • Alerts sent for configuration changes, failed logins, and system degradations.
  • Logs:
    • PHI/PII access logged via database, application rolling logs, and GCP audit logs.
  • Backups:
    • Regularly scheduled.
    • Redundant copies for data loss prevention.

Encryption​

Encryption is implemented at multiple levels to secure data.

  • Data at Rest:
    • Stored using AES-256 encryption in GCP Healthcare API.
    • Data is chunked, each with a unique encryption key.
    • Details on GCP's encryption.
  • Data in Transit:
    • Encrypted using TLS 1.2, ensuring secure user-to-platform and system-to-system communication.

Data Retention and Disposal​

  • Data Retention:
    • Access logs retained for 7 years as required.
    • Other data retained until designated for deletion by the customer.
  • Deletion Process:
    • Upon request, all data (except access logs) is deleted, including:
      • Demographics.
      • User information.
      • Attachments/file uploads.
      • Messaging/conversations.

Conclusion​

CareLaunch prioritizes security through:

  • Secure development practices.
  • Active vulnerability scanning.
  • Encryption for data in transit and at rest.
  • Endpoint protections and proactive monitoring.

These measures ensure sensitive data remains secure while enabling a reliable and compliant platform.