St. Charles Healthcare System - 
Enabling Care Providers While Protecting Patient Data

SCHS discovered that one of their hospital information-system vendors had set up a secure point-to-point FTP channel over which the two companies would communicate. However, the vendor misconfigured the system, as a result, data was being sent out via the Internet instead of over the secure channel. Additionally, various business associates (e.g. coders, insurers) were processing sensitive data and emailing it back to SCHS using unencrypted, clear text messages.

Critical Success Factors 

• Complete security risk assessment 
• Data location and encryption 
• Support multiple use cases 
• Comply with HIPAA and EDI protocols

The Solution

The Fortra™’s Digital Guardian® appliance was initially installed in a monitor-only mode to analyze network transmissions for sensitive data. When Digital Guardian and the consultant co-presented the findings, SCHS’s IT team became aware of two major communication channels that would require immediate attention. 

Digital Guardian’s network appliance is designed for rapid installation and configuration, within minutes of powering it on, SCHS was collecting data. Steve Scott, Infosec Manager, said “Once we saw items that could become major issues for us, we were able to remediate potential problems right away.” This instant visibility meant SCSH could identify issues and correct them before stringent breach notification laws came into effect. “The appliances were easy to setup and configure,” said Steve. “They worked just as advertised. We were up and running in an hour with the basic information in place to begin monitoring our systems.” 

The appliances arrived preloaded with a wide range of HIPAA code set, healthcare EDI protocol identifiers, and preconfigured policies. Integrations with the EHR system meant deeper visibility into sensitive, healthcare databases. After SCHS registered their sensitive data/documents, they activated the preloaded policies and reporting templates to begin detecting sensitive healthcare data movement over the network before it was an external leak.