Secure Data Hosting. Your data is our top priority.

Transcription

1 Secure Data Hosting Your data is our top priority.

2 ESO s world-class security infrastructure is designed to provide data redundancy, security and availability while keeping sensitive HIPAA and PHI information protected and private at all times.

3 System Architecture / Redundancy ESO offers a Software-as-a-Service solution that uses the Microsoft technology stack. Its multi-tier architecture consists of a client tier, a Web Service tier, and application and database tiers. User requests are load balanced in the web tier across a farm of web servers. In the client tier, ESO offers two types of user interfaces: a.net-based WPF smart client and a browser-based client. The smart client runs on MS Windows XP, Windows Vista, Windows 7 and Windows 8 operating systems, and the web client runs on Internet Explorer and Mozilla Firefox. Web Services, the application, and the tiers include IIS, ASP. NET,.NET Framework 4.0, WCF, MS SQL Server 2005/2008, MS SSRS, SSIS, and Windows Server The database back end of ESO Solutions consists of primary servers and standby servers. The primary and standby servers are kept in sync using a high availability database mirroring configuration with a witness server. ESO Solutions closely monitors the utilization of the servers, adding new servers when there is additional load. We use application level partitioning to balance the load among the database servers. ESO Solutions uses a professional co-location facility to host its server infrastructure. Our environment includes redundant power generators and multiple connections to Internet backbones. The entire infrastructure is protected using hardware firewalls. In addition, we have local software firewalls on the servers themselves.

4 Data Hosting Facilities ESO s SaaS platform is scaled behind the scenes in order to meet customer demands as a matter of course in the day-to-day application of our monitoring and systems operation processes. ESO s data hosting facilities are SAS 70, Type II, PCI compliant and meet a number of rigorous requirements that help ensure the security of customer data at all times: High Availability Standards Each data center location offers 24 x 7 x 365 onsite staffing, plus a robust backbone network, redundant power and environmental controls, and other backup equipment designed to keep servers continuously up and running. Disaster Recovery ESO s disaster recovery measures include built-in redundancy for each component of the hardware infrastructure, including multiple database servers in redundant pairs for high availability. Unsurpassed Physical Security ESO s state-of-the-art data centers are equipped with video surveillance systems and intercoms and require dual-token authentication for access. Reliability & Backup ESO schedules near line, automatic client data backups nightly, up to the last committed transaction.

5 Data Encryption ESO SaaS employs the strongest encryption products to protect client data and communications, including 256-bit SSL Certification and 1024-bit RSA public keys the lock icon in the browser indicates that data is fully shielded from access while in transit. All HIPAA-sensitive data that is stored on the field device is encrypted, and data is encrypted over HTTPS when it is transmitted to the central database.

6 HIPAA Compliance With ESO your data remains secure and accessible only by authorized parties: -The software can be accessed only with a valid username and password combination, which is encrypted via SSL while in transmission. -The security level a user is assigned by his/her system administrator will determine the access level that user has to the various software modules and the features within each module. -By default, users are automatically logged off the system after a period of inactivity. -Administrators can define the number of permissible login failures using a password policy administration module. When a user exceeds a maximum number of login attempts, the account is automatically disabled. -All HIPAA-sensitive data that is stored on the field device is encrypted. -Any data that is transmitted over HTTPS protocol to the central database is encrypted. - addresses and/or fax numbers are assigned to specific incident locations so that if a user wishes to or fax a record, the record can be sent only to the address or fax number associated with that facility. -Hospital administrators who are given login access can view only the records for patients transferred to their particular hospital. -A robust application security model prevents one ESO Solutions client from accessing another s data this is reapplied with every request and enforced for the entire duration of a user session.