Encryption alone stands as a vital layer of protection for your sensitive data, but encryption that is FIPS validated brings a whole new level of government-approved security. Federal Information Processing Standards (FIPS) are standards set forth by the U.S. government in regards to implementing not just encryption, but also crypto algorithms, data handling, and operating systems that must protect valuable data. Adhering to these standards is beneficial to any industry with confidential data, but especially for healthcare.
What Is FIPS Compliance?
FIPS standards are set forth by the National Institute of Standards and Technology (NIST) to create security requirements for cryptographic modules. These modules are necessary to keep sensitive information secure in a variety of industries.
The hardware or software in question is tested under the Cryptographic Module Validation Program (CMVP) in NIST-accredited labs to determine if it is capable of protecting sensitive electronic information. The validation standard itself is known as FIPS 140-2 and is broken down into four levels that apply to different products depending on what level of security is needed.
Our SecureDrive products are FIPS 140-2 Level 3 Validated. This level is described as requiring a tamper-proof container to protect unauthorized parties from gaining access to the critical security parameters (CSP) within the module. The products must also have the ability to detect and respond to attempts to physically access the drive, and attempts to use or modify the cryptographic module.
Why Healthcare Data Needs FIPS-Level Protection
The point of having a product or module FIPS Validated is so private sector vendors can have their security products certified for use in government departments and regulated industries. FIPS is required for all U.S. government agencies that collect, store, transfer, share and disseminate information that is sensitive but unclassified.
Protected Health Information (PHI) deserves the highest level of protection to maintain the integrity of the data and a patient’s privacy. Some healthcare organizations that would benefit from FIPS-validated storage solutions are Veterans Affairs hospitals and Military Health Systems. They, like many other industries, use medical devices and software that transmits data using wireless technology.
The Veterans Health Administration is the largest integrated health care system in the United States. With the size of these facilities nationwide, hospital administrators and IT directors would do well to follow the FIPS requirements as well as implement encryption. Providing the highest security measures helps them to retain relationships with these important and growing organizations. Even healthcare systems that are not involved with the military need the highest level of security certification available for their patient information and internal data.
Hipaajournal.com shows that over 37 million healthcare records were breached in just the first nine months of 2019. The healthcare industry also fell victim to 88% of ransomware attacks in 2016. The value of patient data makes it a prime target for hackers and cybercriminals and having government-certified defenses can help lower those negative statistics.
Requirements for FIPS
A company seeking FIPS validation for their product or interface may have to wait for 12 to 14 months to receive their certification. Our entire SecureDrive product line is FIPS 140-2 Level 3 Validated and the devices are ready to plug and play right out of the box. As a company, we put time and effort into making sure our devices were FIPS validated to offer the highest security for our client’s data.
During the testing process, products or interfaces in question are rated in the following categories:
- Design and Implementation of a Cryptographic Module
- Module Ports and Interfaces
- Authentication Methods
- Physical Security
- Cryptographic Key Management
- Mitigation of Other Attacks
These are only some of the 11 total areas that are addressed during FIPS validation testing. All of those areas must be addressed before testing can be identified as complete. You can see which products or modules have been validated or are in the testing process here.
A Validated Solution for PHI Protection
Our SecureDrive product line meets all of the FIPS criteria with its various security features. One of the requirements under FIPS is that sensitive data must be encrypted with an approved algorithm and the encryption key must be generated in an approved manner. The key must also be strong enough with a random and lengthy password to satisfy the requirement.
The SecureDrives and SecureUSBs require authentication through a complex PIN or a mobile device with the option of authenticating through fingerprints or facial recognition. The devices themselves are hardware encrypted and are built with an epoxy coating, bolstering their physical security.
They are also designed with brute force anti-hacking technology to wipe data after 10 consecutive failed entry attempts, keeping unauthorized parties from accessing sensitive files. With FIPS 140-2 Level 3 Validation and HIPAA compliance, our SecureDrive products allow healthcare institutions to easily comply with the FIPS requirement for their daily operations.
.png){kind=small}
