Security is a key part of Foundry Health infrastructure design, application development processes and support. This document provides an overview of Foundry Health security measures and processes.
Data Protection and Privacy
Encryption in Transit and at Rest
Production instances are configured to exclusively use TLS 1.2 SSL security for data in flight. This leverages AWS infrastructure capabilities at the load balancer.
All customer data resides in AWS RDS Aurora configured with AES-256 encryption, with keys managed by AWS KMS. Extensive documentation of RDS encryption at rest can be found on AWS Documentation.
Data Location
All customer data is stored within AWS RDS Aurora Multiple Availability Zone instances in the region hosting the customer instance. Currently supported customer AWS Regions are Virginia and Ireland. Real-time offsite backups are in place, and extensive documentation about this is available via AWS RDS Documentation.
Note that AWS RDS policies and mechanisms for physical and environmental security, media disposal and backup procedures are audited on a periodic basis. SOC audit reports are available for customer review upon request.
Access Controls
Starting with ClinSpark 1.5, all customer PROD Main superadmin support accounts are protected via MFA.
Engineering access to hosting infrastructure requires MFA.
Security Testing
Application Security Scanning
We use Detectify to perform OWASP 10 security scanning for each ClinSpark release. The results are available in the Technical File.
Manual Penetration Testing
On a yearly basis ClinSpark is subjected to manual penetration testing. We use industry leading Cobolt.io for this service. A summary of findings is available for customer review upon request.
Security Code Reviews - SDLC
ClinSpark enhancement tickets are categorized by security risk, and appropriate reviews are conducted as part of our SDLC process. Evidence of this is provided in the Technical File.
Secure Coding Practices Best Practices
Foundry Health engineers adhere to actively maintained best practices for secure coding. Details of our standards and our internal review process are available upon request.
Security Incident Response
Infrastructure has been configured to enable automated incident alerting and rapid tool-assisted investigation. A formal policy and set of procedures is in development.
Security Incident Customer Notification Policy
In the event of a security breach, Foundry Health will take prompt corrective action to cure any such deficiencies, and any action pertaining to such unauthorized PHI disclosure required by applicable laws and regulations. We will notify the customer within one business day of our becoming aware of the event.
AWS Hosting Infrastructure
All ClinSpark instances are hosted within Foundry Health’s AWS account.
Infrastructure as Code
Infrastructure as Code is used for build-outs of PROD Main ClinSpark instances. This ensures that key configurations such as TLS levels, load balancer settings, patching configurations and other security-related configurations are applied in a repeatable and secure fashion.
Centralized Security Infrastructure Monitoring
AWS Security Hub is configured to monitor and alert upon a wide variety of infrastructure security aspects. AWS Guard Duty provides active AI-driven real-time intrusion detection. AWS Macie constantly monitors the environment for PHI leaks or unusual privileged activity in AWS CloudTrail, which audits all AWS user activity. AWS Detective provides tool-assisted investigation capabilities for rapid root-cause analysis of potential security issues.
Alerting is configured to the Foundry Health Slack channel for real-time notifications of security events.
Standard Managed Web Application Firewall
Customer PROD Main instances are protected by the AWS Managed Ruleset provided by Fortinet and include the ‘Complete OWASP Top 10’ by default.
Automated Security Patching
All server instances receive regular and automated security and bugfix patching. This is done using AWS Patch Manager.
Logging
Application Logs are centrally stored in AWS CloudWatch. VPC Flow Logs are stored in S3 to support investigation of security incidents as required.
Foundry Health Staff
User Workstations
User workstations are provided by our parent company, IQVIA. These machines are fully managed and monitored and equipped with modern anti-malware measures.
BYOD Policy
Some Bring Your Own Device (BYOD) workstations may be used for development and support purposes and are monitored by Kolide for endpoint security. This provides visibility into our requirements for security patching, anti-malware measures, use of an approved password manager, hard drive encryption and other security configurations appropriate for the specific workstation. Violation notifications and a review process are in place.
Periodic Review of Access Privileges
Engineering access to the hosting infrastructure is reviewed periodically by management. Support access to customer environments is managed periodically by management as well.
Periodic Security Training
All staff is periodically trained on security policies including data handling, and security topics such as recognizing social engineering. Evidence is available for review upon request.
Corporate Network
Foundry Health’s core business systems are externally hosted SaaS applications, managed by the respective vendor. Our corporate network, mail and file services are provided by our parent company, IQVIA, and require VPN access when remote working.