Adventist Health
Executive Summary
When Adventist Health's email security software was up for renewal, the organization decided to consider other privacy and protection solutions. While performing due diligence, Adventist Health reviewed the Gartner Magic Quadrant and consulted other resources, narrowing the list to four key players. When evaluating options, key criteria included minimizing false positives, better data loss prevention for personal health information (PHI), credit card and social security numbers, and top-of-the-line encryption, spam and malware protection.
Other top priorities included educating users about the hazards of sending sensitive information via unencrypted email. Proofpoint offered the best combination of features, ease of use, and price. Furthermore, Proofpoint had proven cloud solutions and expertise, which gave Adventist Health the confidence to move email security to the cloud, without worrying about compromising their information.
Requirements
After evaluating several email security and data loss prevention solutions, the IT department at Adventist Health was clear about its criteria. The organization wanted to test email security in the cloud and was comfortable doing so since Proofpoint also offers the option of having an onpremises solution. But, besides having an easy to use and cost-effective
hosted cloud solution, Proofpoint has the following capabilities that the organization considers critical for a new email security deployment:
- Email encryption between e-mail servers and users
- Ability to identify trusted partners
- Content triggered data loss prevention
- User release of quarantine messages
- Reporting capabilities
- High availability
- Mail filtering, spam, and virus efficiency
- Little or no impact to the end user
Compliance
As a healthcare provider in an industry rife with regulations and privacy mandates, Adventist Health is understandably concerned about data loss prevention and meeting HIPAA and other regulatory compliance criteria. The organization has been successful using Proofpoint's preset rules for social security numbers and PCI credit card information, and is impressed with the solution's flexibility to customize rules in order to handle regulatory compliance. Specifically, Proofpoint enables Adventist Health to provide different levels of severity on rules and act on each situation independently, depending on the infraction. Adventist Health is also delighted with Proofpoint's Smart Send technology, which is included in Proofpoint Enterprise Protection and Proofpoint Enterprise Privacy Suites. Proofpoint Smart Send allows administrators to enable end user self-remediation of common outbound email policy violations. For example, if the user forgets to encrypt a reply to an unencrypted email message containing sensitive content, the outgoing message is quarantined, and the user is notified. The user then has the option to remediate the violation sending an unencrypted or encrypted email or release the outbound false positive, enabling the organization to meet privacy violations and saving time for the IT department and the organization's compliance resources.
"Enabling users to release their own quarantined messages, when necessary, gives them control, and helps us get the job done faster. Educating users about our organization's outbound email policies and common errors saves significant IT resources and time. Proofpoint just offers a much better way of getting all of these things done," said Alain Bouit, information security officer at Adventist Health.
In terms of patient's records and information, the organization looks for specific content that's HIPAA definitive, or contains particular information like ICD-9 codes and other medical terms. With Proofpoint's fine granularity, Adventist Health has the capability to fingerprint medical
record numbers and hush their master patient index in order to more accurately identify very specific data. From a business perspective, Adventist Health realizes the benefits inherent
in cloud computing such as high availability, increased resource capacity and performance. Proofpoint also significantly reduces false positives. For example, Proofpoint can be configured
not to encrypt a sales brochure, but to encrypt sensitive information.
"Our primary strategy is to protect patient information. If the patient feels we are taking care of their information properly, that is one of the factors that ties into a positive patient experience. The investments that Adventist Health has made in security and securing patient data have been done to improve the patient experience, so when patients need to come back or choose a hospital or service, they will choose Adventist Health," said Bouit. "Proofpoint's solutions are helping us gain our patient's trust."
ABOUT Adventist Health
Adventist Health is a faith-based, not-for-profit integrated health care delivery system with nearly 20,000 employees serving communities in California, Hawaii, Oregon and Washington. Founded on Seventh-day Adventist health care heritage, Adventist Health provides compassionate care in 17 hospitals, more than 130 physician and rural health clinics, 14 home care agencies and four joint-venture retirement centers.
Proofpoint, Proofpoint Enterprise Privacy and Proofpoint Enterprise Protection are trademarks of Proofpoint, Inc. in the US and/or other jurisdictions. All other brands and product names are the property of their respective owners. Proofpoint case studies are presented for information purposes only and contain no warranties, express, implied or statutory, regarding the products or services described herein. Results from using Proofpoint products will vary. For questions on how Proofpoint's products and services might work best for your organization, please contact your local Proofpoint office for more information.