Security

Security Framework

Our security program is built on industry best practices and compliance frameworks:

For HIPAA-specific compliance information, see our HIPAA Compliance page.

Data Encryption

All data is protected with industry-standard encryption at every stage:

Encryption in Transit

• TLS 1.3: All data transmitted over the internet uses the latest TLS protocol
• Perfect Forward Secrecy: Each session uses unique encryption keys
• Certificate Pinning: Mobile apps use certificate pinning to prevent interception
• Secure APIs: All API communications require authentication and encryption
• VPN Access: Administrative access requires VPN with multi-factor authentication

Encryption at Rest

• AES-256: All stored data encrypted with AES-256 encryption
• Database Encryption: Full database encryption with encrypted backups
• File Storage: Encrypted object storage for all uploaded files
• Key Management: Hardware security modules (HSMs) protect encryption keys
• Secure Backups: All backups encrypted and stored in geographically diverse locations

Access Control and Authentication

User Authentication

• Multi-Factor Authentication (MFA): Required for all user accounts
• Strong Password Requirements: Minimum complexity and regular rotation
• Session Management: Secure session tokens with automatic timeout
• Device Fingerprinting: Detection of suspicious login patterns
• Single Sign-On (SSO): SAML 2.0 support for enterprise customers

Role-Based Access Control (RBAC)

• Least Privilege: Users granted only necessary permissions for their role
• Separation of Duties: Critical operations require multiple approvals
• Granular Permissions: Fine-grained control over data and feature access
• Regular Reviews: Quarterly access reviews and certification
• Automated Provisioning: Automated user lifecycle management

Administrative Access

• Privileged Access Management: Strict controls on administrative accounts
• Just-In-Time Access: Temporary elevated privileges for specific tasks
• Audit Logging: All administrative actions logged and monitored
• Secure Workstations: Hardened systems for administrative access

Infrastructure Security

Cloud Infrastructure

• Tier III+ Data Centers: Enterprise-grade hosting with 99.99% uptime SLA
• Geographic Redundancy: Multi-region deployment for disaster recovery
• Network Segmentation: Isolated networks for different security zones
• DDoS Protection: Advanced protection against distributed denial-of-service attacks
• Web Application Firewall: Protection against common web vulnerabilities

Network Security

• Firewalls: Next-generation firewalls with intrusion prevention
• Network Monitoring: Real-time traffic analysis and anomaly detection
• Private Networks: VPC isolation for production environments
• Security Groups: Strict firewall rules limiting network access
• Load Balancers: SSL termination and traffic distribution

Application Security

• Secure Development: Security integrated throughout development lifecycle
• Code Reviews: Mandatory security reviews before deployment
• Static Analysis: Automated scanning for security vulnerabilities
• Dependency Scanning: Continuous monitoring of third-party libraries
• Container Security: Hardened containers with minimal attack surface

Data Protection and Privacy

Data Minimization

We collect only the data necessary for our services and retain it only as long as required by law or business needs. Medical records are retained for 30 years per OSHA requirements, then securely deleted.

Data Segregation

• Logical Isolation: Customer data isolated in separate database schemas
• Tenant Isolation: Multi-tenant architecture with strong isolation guarantees
• PHI Separation: Protected health information stored in dedicated encrypted storage

Backup and Recovery

• Automated Backups: Continuous backups with point-in-time recovery
• Encrypted Backups: All backups encrypted at rest
• Geo-Redundant Storage: Backups replicated across multiple regions
• Tested Recovery: Regular disaster recovery drills and testing
• Retention Policy: Backups retained per regulatory requirements

Secure Data Disposal

When data reaches end of retention period, it is securely deleted using cryptographic erasure and multi-pass overwriting to ensure it cannot be recovered.

Monitoring and Detection

Security Monitoring

• 24/7 SOC: Security Operations Center monitors threats around the clock
• SIEM: Security Information and Event Management system aggregates logs
• Intrusion Detection: Advanced IDS/IPS systems detect anomalies
• Behavioral Analysis: Machine learning detects unusual patterns
• Real-Time Alerts: Immediate notification of security events

Audit Logging

• Comprehensive Logging: All system and user activities logged
• Tamper-Proof Logs: Logs stored in immutable, encrypted storage
• Log Retention: Logs retained for minimum 1 year for investigation
• Access Auditing: Every PHI access logged with user, time, and purpose
• Regular Reviews: Automated and manual review of audit logs

Threat Intelligence

We subscribe to multiple threat intelligence feeds and maintain relationships with security researchers to stay ahead of emerging threats.

Incident Response

We maintain a comprehensive incident response plan to quickly contain and remediate security incidents:

Response Capabilities

• Incident Response Team: Dedicated team on-call 24/7 for security incidents
• Response Procedures: Documented procedures for various incident types
• Containment: Rapid isolation of affected systems
• Forensics: Preservation of evidence and root cause analysis
• Recovery: Secure restoration of services and data
• Lessons Learned: Post-incident review and improvements

Communication

• Timely Notification: Affected users notified within 60 days of discovery
• Transparent Updates: Regular status updates during major incidents
• Regulatory Reporting: Compliance with breach notification requirements
• Support Resources: Dedicated support for affected users

Vulnerability Management

Proactive Security Testing

• Penetration Testing: Annual third-party penetration tests
• Vulnerability Scanning: Weekly automated vulnerability scans
• Bug Bounty Program: Rewards for responsible disclosure of vulnerabilities
• Security Assessments: Regular application security assessments

Patch Management

• Critical Patches: Critical vulnerabilities patched within 24 hours
• Regular Updates: Systems kept up-to-date with latest security patches
• Testing: Patches tested in staging before production deployment
• Emergency Response: Procedures for zero-day vulnerabilities

Personnel Security

Hiring and Onboarding

• Background Checks: Criminal background checks for all employees
• Reference Verification: Employment and reference verification
• Security Training: Comprehensive security training during onboarding
• Confidentiality Agreements: All employees sign NDAs

Ongoing Training

• Annual Security Training: Required for all staff members
• HIPAA Training: Specialized training on privacy and security rules
• Phishing Simulations: Regular testing of security awareness
• Security Champions: Embedded security advocates in each team

Offboarding

Access is immediately revoked upon termination. All devices and credentials are recovered, and exit interviews emphasize ongoing confidentiality obligations.

Physical and Device Security

Office Security

• Access Control: Badge access and visitor management
• Surveillance: 24/7 video monitoring of facilities
• Secure Areas: Restricted access to server rooms and sensitive areas
• Clean Desk Policy: No PHI left unattended

Device Management

• Full Disk Encryption: All company devices encrypted
• Mobile Device Management: Centralized control of mobile devices
• Remote Wipe: Capability to remotely wipe lost or stolen devices
• Antivirus/EDR: Endpoint detection and response on all devices
• Automatic Updates: Mandatory security updates

Third-Party Security

Vendor Management

• Security Assessments: All vendors undergo security review
• Business Associate Agreements: Required for any vendor handling PHI
• Security Standards: Critical vendors must maintain industry security certifications
• Regular Reviews: Annual reassessment of vendor security
• Incident Notification: Vendors required to report security incidents

API Security

• Authentication: OAuth 2.0 and API keys for third-party integrations
• Rate Limiting: Protection against abuse and DDoS
• Input Validation: Strict validation of all API inputs
• Audit Logging: All API calls logged for security review

Security Best Practices for Users

While we implement comprehensive security controls, you can help protect your account:

• Strong Passwords: Use unique, complex passwords for your account
• Enable MFA: Turn on multi-factor authentication in your account settings
• Secure Devices: Keep your devices updated and use antivirus software
• Beware Phishing: Verify emails claiming to be from VestMed before clicking links
• Secure Networks: Avoid public Wi-Fi for accessing medical information
• Log Out: Always log out on shared or public computers
• Report Suspicious Activity: Contact us immediately if you notice anything unusual

Reporting Security Issues

If you discover a security vulnerability or have concerns about our security practices, please contact us immediately:

We take all security reports seriously and will respond promptly to investigate and address issues.