Forward Health On Securing Biometric Data From Breaches

“We collect lots of information on how you live your life and about the choices you make when you’re not in our doctor’s office,” Robert Sebastian, the company’s co-founder, told PYMNTS. “And if that’s the case, security has to be a priority from the very beginning.”

Engineering Healthcare Data Security

Sebastian said the goal was to build something from the ground up that could sustain doctor and patient confidence when protecting client data. Instead of buying an off-the-shelf safety net, the company hired software engineers from Google and Amazon to develop in-house hardware and software. The firm engineered proprietary technology so it did not have to chance a technology partner suffering a data breach.

“We don’t outsource security,” he said. “Our team is the only one I would trust with the security of our members’ data.”

Sebastian did not provide details about how the company’s security system works so as to keep such information from cybercriminals. But he confirmed that Forward Health has not suffered a security breach in the five years it has been in business. He said its approach to protecting valuable data is similar to encrypting and securing email and insisted that security is not separate from building the smart screens or the body scanners that its doctors use.

“It’s a lot of work,” he said. “But if you’re trying to rebuild healthcare correctly from scratch, you have to take those challenges on.”

Deploying Measures

It is clear that a healthy data protection program does more than comply with Health Insurance Portability and Accountability Act of 1996 (HIPAA) rules in the U.S. and the European Union’s General Data Protection Regulation. Failing to meet these strict data protection requirements can lead to significant fines. HIPAA requires that healthcare companies ensure patient information is secure, accessible and used only by authorized staff for medical care purposes. True data security means committing to stronger defenses than the law’s minimum requirements, and regulations do not mandate that healthcare organizations use specific technologies.

It is up to each hospital and healthcare firm to employ select security measures to achieve their objectives. Solutions deployed can include educating healthcare employees, restricting data access and encrypting data. Other options include securing mobile devices, mitigating connected device risks, conducting regular risk assessments and evaluating business associates’ compliance. Patients’ identities and biometric information are deeply personal aspects of their medical lives, and organizations like Forward Health that leverage advanced defense techniques and set their own security standards may just be able to prevent cybercriminals from causing irreversible harm.