Data Sheet: HealthRules Payer HiTrust
HealthRules® Payer (HRP) employs a comprehensive, risk-based approach to information security. By integrating advanced risk assessment and mitigation strategies, HRP ensures robust network management controls and change governance, making security a core component of both its product and operations lifecycle.
Key Features:
- Business Continuity and Incident Response: HRP has developed policies and procedures, including disaster recovery and incident response, to manage disruptions ranging from software outages to global pandemics.
- Third-Party Risk Management: All external tools, components, and service providers undergo rigorous security scrutiny.
- Workforce Security Training: Role-based security training, background checks, and the Security Awareness for Everyone (SAFE) program ensure all employees follow best security practices.
- Endpoint Protections: Employee workstations feature Endpoint Detection and Response (EDR), application and website blacklisting, and Data Loss Prevention (DLP).
- Multifactor Authentication (MFA) and Annual Penetration Tests are standard to safeguard critical systems.
- Change Management and Vulnerability Management systems ensure all code changes are secure, peer-reviewed, and vulnerabilities are promptly addressed.
- Security-by-Design principles are embedded in product development, proactively assessing risks and incorporating security best practices.
Operational Security:
- Data Encryption: All sensitive data is encrypted at rest using AES-256, with web traffic secured via TLS 1.2. VPN tunnels facilitate secure communication between HRP and customer environments.
- Access Controls: Site-to-site VPN tunnel, SFTP access control, Role-Based Access Control (RBAC), Single Sign-On (SSO), and least-privilege access are implemented to maintain secure access to internal systems.
- Infrastructure Protection: Customer data is hosted on fault-tolerant, redundant infrastructure in dedicated environments to prevent data commingling.
- Web Application Firewall (WAF) and Load Balancer protect the application, while a Security Information and Event Management (SIEM) system ensures internal visibility and response to security events.
Compliance and Privacy:
- HITRUST Certification and a SOC-2 Type 2 audit underscore HRP's commitment to continuous security maturity and data protection.
- Privacy Policy available online reflects HRP’s dedication to respecting user privacy.
By prioritizing security through rigorous standards and innovative practices, HealthRules® Payer not only meets but exceeds conventional security and organizational objectives. For more information on HRP’s commitment to security and privacy, visit their privacy policy.
