Security Overview
Secure by Design
CareLaunch's product is built using a secure development process that includes:
- Open Source Security Code Scanning: Automated analysis of code to detect vulnerabilities.
- Automated Code Deployment and Infrastructure Provisioning: Ensures consistent and secure application updates.
- Continuous Monitoring: Tracks environment changes and versions to identify potential risks.
CareLaunch leverages industry-leading tools to ensure HIPAA/GDPR compliance and implements robust controls to reduce risk and protect sensitive data.
PHI Overview
Protected Health Information (PHI) is securely stored using the Google Cloud Platform (GCP) Healthcare API, which offers:
- Comprehensive security controls, monitoring, and review.
- Segregation from other resources using:
- Identity and Access Management (IAM).
- Network-level filtering.
- Certificate-based authentication.
Compliance Certifications
Google undergoes regular independent third-party audits, providing external verification. Key certifications include:
- SSAE16 / ISAE 3402 Type II
- Here is the associated Public SOC 3 Report.
- SOC 2 report available under NDA.
- ISO 27001
- For systems, applications, people, technology, processes, and data centers.
- ISO 27001 Certification
- ISO 27017 (Cloud Security)
- Best practices for cloud service security controls.
- ISO 27017 Certificate.
- ISO 27018 (Cloud Privacy)
- Standards for protecting personally identifiable information (PII) in cloud services.
- ISO 27018 Certificate.
- FedRAMP ATO
- PCI DSS v3.2.1
Access Control
Authentication
- Strong Passwords: Required for all user accounts.
- Multi-Factor Authentication (MFA): Optional but recommended for additional security.
- Login Protections:
- Failed attempts logged.
- Account lock after 5 failed attempts within 5 minutes.
- Session Management:
- Sessions expire after 30 minutes of inactivity, requiring re-authentication.
- Advanced Security: Risk-based adaptive authentication and compromised credential detection.
User Provisioning
- Administrators can:
- Provision and revoke access.
- Revoke patient access and delete patient data.
- Principle of Least Privilege: Access granted based on role-specific needs.
- Role-Based Access Control: Includes roles with varying permissions (e.g., read-only, update restrictions).
Endpoint Security
- Web Application Firewalls (WAFs):
- Filter malicious requests.
- Block known bad actor IPs.
- Enable geographic filtering.
- Internal System Protections:
- Accessible only within a secure internal network.
- Route access restricted to approved application instances.
- Multi-Layer Security:
- Limited permissions and separation of responsibilities.
- Private virtual network with whitelist-only load balancer access.
- Infrastructure Updates:
- Monitored and automatically updated.
- Changes require approval and generate alerts.
Monitoring, Logging, and Alerting
- Monitoring:
- Infiltration attempts, system errors, and performance issues are actively monitored.
- Alerting:
- Alerts sent for configuration changes, failed logins, and system degradations.
- Logs:
- PHI/PII access logged via database, application rolling logs, and GCP audit logs.
- Backups:
- Regularly scheduled.
- Redundant copies for data loss prevention.
Encryption
Encryption is implemented at multiple levels to secure data.
- Data at Rest:
- Stored using AES-256 encryption in GCP Healthcare API.
- Data is chunked, each with a unique encryption key.
- Details on GCP's encryption.
- Data in Transit:
- Encrypted using TLS 1.2, ensuring secure user-to-platform and system-to-system communication.
Data Retention and Disposal
- Data Retention:
- Access logs retained for 7 years as required.
- Other data retained until designated for deletion by the customer.
- Deletion Process:
- Upon request, all data (except access logs) is deleted, including:
- Demographics.
- User information.
- Attachments/file uploads.
- Messaging/conversations.
- Upon request, all data (except access logs) is deleted, including:
Conclusion
CareLaunch prioritizes security through:
- Secure development practices.
- Active vulnerability scanning.
- Encryption for data in transit and at rest.
- Endpoint protections and proactive monitoring.
These measures ensure sensitive data remains secure while enabling a reliable and compliant platform.