Warning You are already logged in. Click here to return to login or Log out Log out

MANAGEBGL DATA SECURITY POLICY

DATA SECURITY POLICY IN BRIEF

ManageBGL focuses on security from the ground up. Our Data Center (managed by Amazon Web Services, AWS) is compliant with

  • HIPAA

  • SOC 1/SSAE 16/ISAE 3402 (formerly SAS70)

  • SOC 2

  • SOC 3

  • PCI DSS Level 1

  • ISO 27001

  • FedRAMP(SM)

  • DIACAP and FISMA

  • ITAR

  • FIPS 140-2

  • CSA

  • MPAA

and features proximity security badge access and digital security video surveillance. Our server network can only be accessed via SSL VPN with public key authentication or via Two-factor Authentication over SSL. Additionally, our network can only be accessed via SSL VPN or multi-factor authentication, and all access to our web portal is secured over HTTPS using SSL 256-bit encryption. Additionally, all staff members with access to Client Data receive certification as a HIPAA Privacy Associate.

For further information, please read Amazon Web Services Compliance, and HIPAA/PHI policy.

DEFINITION OF TERMS & SYSTEM USERS

Client — A customer of ManageBGL.

User — An individual with access to a ManageBGL Application..

Admin — A Client User with the capability of viewing and managing certain aspect of Client’s ManageBGL Account.

Member — A Client User whose account is provisioned through Client’s Web Portal. A Member cannot login or otherwise access any ManageBGL Application directly. All Member Data stored in our system is de-identified in compliance with the HIPAA “Safe Harbor” de-identification standard.

Developer — A User that can create vendor applications in ManageBGL for the purpose of integrating mobile health apps and/or devices.

ManageBGL Admin — A ManageBGL employee with access to managing a Client’s account.

DATA CENTER AND HARDWARE

All ManageBGL application and database servers are physically managed by Amazon Web Services in secure data centers. Our Primary Data Center is located  in US East (Northern Virginia) Region and our Redundant Data Center is located in US West (Northern California) Region. Our security procedures utilize industry best practices. All data center facilities are certified SSAE 16 (SOC 1) Compliant and have 24/7 physical security of data centers and Network Operations Center monitoring. Our servers feature a Hardware Firewall and receive integrated server hardening, regular full-system virus scanning and systems patching, and regular security profile reviews and upgrades.

Physical Security

All servers are located in a Data Center managed by Amazon Web Services that features proximity security badge access and digital security video surveillance. ManageBGL employees do not have access to physical server hardware.

Data Access and Server Management Security

ManageBGL has SSL and PPTP VPN as well as dedicated VLAN connections to our hosting environment. Only select ManageBGL employees are able to access the server network.

For details on 99.95% Availability (less than 5 minutes of downtime per year), Fire Detection and Suppression, Power, Climate and Temperature, read here

DATA STORAGE AND BACKUPS

All Member Data stored in our system is de-identified in compliance with the HIPAA “Safe Harbor” de-identification standard, and all data is encrypted at rest using 256-bit AES. ManageBGL production database servers are partitioned using RAID 1 with 24-hour disk backup of all data files. Database backups use a fully disk-based solution (disk-to-disk) and full system backups, are performed daily and weekly. Daily backups are retained for a minimum of 7 days, weekly backups are retained for a minimum of 52 weeks. Backup services are provided by and hosted by Amazon Web Services.

Destruction of Server Data

In order to maintain system integrity, Client Data that has outlived its use is retained up to 60 days before it is destroyed. The data may remain in our backup files for up to 14 months, as it is our policy to maintain weekly backups for a minimum of 52 weeks before those backups are destroyed. De-identified activity data from Members may be stored in perpetuity for future analysis.

Storage Device Decommissioning

Old computers and servers used to store or access client information receive a 7-pass erase that meets the U.S. Department of Defense 5220-22 M standard for erasing magnetic media. More.

Paper information in the office is discarded using a document shredder or a commercial secure document shredding service.

INTRUSION DETECTION AND INCIDENT RESPONSE

Our servers run OSSEC to actively monitor for intrusions. OSSEC uses HIDS (Host-Based Intrusion Detection), log monitoring and SIEM (Security Information and Event Management).

Incident Response

ManageBGL security administrators will be immediately and automatically notified via email if OSSEC or other implemented security protocols detect an incident. All other suspected intrusions, suspicious activity, or system unexplained erratic behavior discovered by administrators, users, or computer security personnel must be reported to a security administrator within 1 hour.

Once an incidence is reported, security administrators will immediately begin verifying that an incident occurred and the nature of the incident with the following goals::

  1. Maintain or restore business continuity
  2. Reduce the incident impact
  3. Determine how the attack was performed or the incident happened
  4. Develop a plan to improve security and prevent future attacks or incidents
  5. Keep management informed of the situation and prosecute any illegal activity

Determining the Extent of an Incident

Security administrators will use forensic techniques including reviewing system logs, looking for gaps in logs, reviewing intrusion detection logs, interviewing witnesses and the incident victim to determine how the incident was caused. Only authorized personnel will perform interviews or examine evidence, and the authorized personnel may vary by situation.

Notifying Clients of an Incident

Clients will be notified via email within one hour upon detection of any incident that compromises access to the service, compromises data, or otherwise effects users. Clients will receive a status update every 4 hours and upon incident resolution.

APPLICATION SECURITY

All data transfer and access to ManageBGL applications will occur only on Port 443 over an HTTPS encrypted connection with 256-bit SSL encryption.

System Updates and Security Patches

As a hosted solution, we regularly improve our system and update security patches. No client resources are needed to perform these updates. Non-critical system updates will be installed at predetermined times (typically 6:00 a.m. Eastern on Tuesdays). Critical application updates are performed ad hoc using rolling deployment to maximize system performance and minimize disruption. All updates and patches will be evaluated in a virtual production environment before implementing.

User Login and Session Security

Members are not able to directly login to ManageBGL’s Applications. All Member logins and sessions are authenticated via secure access tokens.

Application Password Management

Admin passwords must have at least 8 characters with at least one number and one letter.

ManageBGL Admin passwords must have at least 8 characters with at least one number and one letter, and at minimum either one capital letter and/or one special character.

DISASTER RECOVERY

The entire ManageBGL server stack is replicated in real time between the Primary Data Center in US East (Northern Virginia) Region and Recovery Data Center in US West (Northern California) Region using global load balancing and geographically diverse DNS routing. These systems are on two separate power grids, which ensures that if one location is taken offline for any reason, the other system is fully isolated and will be able to maintain operations. Recovery of the lost system is evaluated at the time of incident. If the disaster situation is likely to be resolved within 24 hours, ManageBGL will run solely on the reserve system until the reciprocal setup can be replicated and restored. If it is unlikely that the datacenter will be fully operational within 24 hours, we will work quickly to setup a new redundant server stack in US West (Oregon) Region. Additionally, full system backups are located in a Data Center in US West (Oregon) Region, which is on the third U.S. power grid. The disaster recovery servers and failover mechanisms are tested on the first Sunday of each month.

ManageBGL conducts periodic internal audits on compliance with this policy.

 

Last Modified: 4-Feb-20144