Influx MD makes patient data security a priority and follows formal procedures and invests in technology designed to maintain an environment in compliance with the requirements of HIPAA.
The following security statement is an explanation of our security technology and practices to help covered entities determine the appropriateness of this environment for their data.
- Authentication: User data on our database is logically segregated by account-based access rules. User accounts have unique usernames and passwords that must be entered each time a user logs on.
- Passwords: User application passwords have minimum complexity requirements. Passwords are individually encrypted with a one-way hash.
- Single Sign-On: Each user is provided
- Data Encryption: Certain sensitive user data, identified as PHI are stored in encrypted format using cell level encryption.
- Data Residency: All Influx MD user data, is stored on servers located in the United States.
Influx MD application servers are hosted in world-class data centers. These data centers include all the necessary physical security controls you would expect in a data center these days (e.g., 24×7 monitoring, cameras, visitor logs, entry requirements). Influx MD has dedicated servers to separate our equipment from other tenants.
- Connectivity: Fully redundant IP network connections with multiple independent connections to a range of Tier 1 Internet access providers.
- Power: Servers have redundant internal and external power supplies. Data centers have backup power supplies, and are able to draw power from the multiple substations on the grid, several diesel generators, and backup batteries.
- Uptime: Continuous uptime monitoring, with immediate escalation to technical staff for any downtime.
- Failover: Our database is replicated in real-time and can failover in less than an hour.
- Backup Frequency: Backups occur daily on all databases.
- Testing: System functionality and design changes are verified in an isolated test “sandbox” environment and subject to functional and security testing prior to deployment to active production systems.
- Firewalls: Firewalls restrict access to all ports except 80 (http) and 443 (https).
- Access Control: Secure VPN, 2FA (two-factor authentication), and role-based access is enforced for systems management by authorized engineering staff.
- Logging and Auditing: Central logging systems capture and archive all internal systems access including any failed authentication attempts.
- Encryption in Transit: By default, our survey collectors have Transport Layer Security (TLS) enabled to encrypt respondent traffic. All other communications with the .influxmd.com application website are sent over TLS connections, which protects communications by using both server authentication and data encryption. This ensures that user data in transit is safe, secure, and available only to intended recipients.
- Patching: Latest security patches are applied to all operating systems, applications, and network infrastructure to mitigate exposure to vulnerabilities.
- Third Party Scans: Our environments are continuously scanned using best of breed security tools. These tools are configured to perform application and network vulnerability assessments, which test for patch status and basic misconfigurations of systems and sites.
- Penetration Testing: External organizations perform penetration tests at least annually.
Organizational & Administrative Security
- Information Security Policies: We maintain internal information security policies, including incident response plans, and regularly review and update them.
- Employee Screening: We perform background screening on all employees, to the extent possible within local laws.
- Training: We provide security and technology use training for employees.
- Service Providers: We screen our service providers and bind them under contract to appropriate confidentiality and security obligations if they deal with any user data.
- Access: Access controls to sensitive data in our databases, systems, and environments are set on a need-to-know / least privilege necessary basis.
- Audit Logging: We maintain and monitor audit logs on our services and systems.
Software Development Practices
- Stack: We code in PHP, store data in MYSQL and run on Apache and Linux (LAMP).
- Coding Practices: Our engineers use best practices and industry-standard secure coding guidelines.
- Deployment: We deploy code several times each week, giving us the ability to react quickly in the event a bug or vulnerability is discovered within our code.
HIPAA: Influx MD offers enhanced security features that support HIPAA requirements. For
Handling of Security Breaches
Despite best efforts, no method of transmission over the Internet and no method of electronic storage is perfectly secure. We cannot guarantee absolute security. However, if Influx MD learns of a security breach, we will notify affected users so that they can take appropriate protective steps. Our breach notification procedures are consistent with our obligations under various state and federal laws and regulation, as well as any industry rules or standards that we adhere to. Notification procedures include providing email notices or posting a notice on our website if a breach occurs.
Keeping your data secure also depends on you ensuring that you maintain the security of your account by using sufficiently complicated passwords and storing them safely. You should also ensure that you have sufficient security on your own systems, to keep any report data you download to your own computer away from prying eyes. We offer TLS to secure the transmission of form responses, but it is your responsibility to ensure that your forms are configured to use that feature where appropriate.
Last updated: October 1, 2016.