Critical Issues for ISVs
Download the white paper "Healthcare ISVs: Critical Issues in Meeting HITECH Data Protection Regulations." |
As we move closer to the finalized rules for HITECH data protection, some things are now becoming very clear. The government wants ISVs and service providers to offer encryption of data at rest to their customers, and they want covered entities to use it! While a careful read of the regulations reveals that they do not mandate encryption, the guidance makes clear that encryption is the ONLY safe harbor from breach notification. Your customers will interpret this as a mandate, and will start demanding encryption in your products and service solutions. We are already starting to see this happen.
Healthcare ISVs face some really big challenges as they start to move into the unfamiliar territory of encryption and key management. Here are four critical issues you will face as you start down the path to securing your data at rest with strong encryption:
1) The Big Challenge is Encryption Key Management
Encryption itself is not really the biggest technical challenge facing ISVs as they start to encrypt data in their application databases. Most operating systems, databases, and programming languages offer encryption libraries that you can use right off the shelf. For example, Microsoft provides encryption libraries in SQL server and the .NET language. Oracle offers similar support for encryption in their database. The really big challenge is encryption key management. Encryption keys are the secrets that must be protected. Key management systems create, store, and protect keys from loss, and this will be the hardest thing to get right.
2) NIST & FIPS Certification
The HITECH guidance is full of references to the National Institute of standards and Technology (NIST) for encryption standards and best practices. Advanced Encryption standard (AES) is the recommended technology for encryption. And the NIST recommendations for key management are the gold standard for key management solutions. Serious key management vendors submit their solutions to NIST for certification under the FIPS 140 protocol, and these vendors are easy to locate on the NIST web site.
3) Getting Encryption and Key Management Right
You will be tempted to push the responsibility for encryption and key management to an outside vendor. If it is really hard to do, why not let someone else do the job? You can refer your customers to the vendor for the solution, and the vendor can do the work of getting the database encrypted. It seems easy. Until you discover that your customers are not going to distinguish between your vendor and you when problems happen! You will be ultimately responsible for any problems with data protection.
4) The Right Partnership
Many ISVs discover that finding the right partner for encryption key management solutions is the biggest hidden challenge in their projects. Not only is the technology very specialized, there are a small number of vendors who offer FIPS 140 certified solutions. You have to offer solutions to your customers that are easy to deploy and meet your product pricing objectives. What if you need a customized key management solution? Are there any vendors who are willing to help you with these requirements? Finding the right partner is as important as finding the right technology.
Visit our ISV Partner Program page for more information on becoming a partner or download our white paper titled Healthcare ISVs: Critical Issues in Meeting HITECH Data Protection Regulations.