Tennessee BlueCross BlueShield Encrypts All Its Data

Healthcare IT Vendor Directory

BlueCross BlueShield of Tennessee (BCBST) claims to be the first private company in the healthcare industry--and possibly in any industry--to encrypt all at-rest data across its entire enterprise, the culmination of a project accelerated by a high-profile data theft nearly two years ago.

Tennessee Blues last week announced the completion of its $6 million encryption effort that included the securing of 885 terabytes of mass data storage, the equivalent of 35,000 single-layer Blu-ray discs, the locking down of 1,000 Windows, AIX, SQL, VMWare, and Xen server hard drives, 6,000 additional workstation and removable hard drives, and 136,000 volumes of backup tape, according to the Chattanooga, Tenn.-based company. BlueCross BlueShield of Tennessee also is securing recordings of 25,000 voice calls per day.

In all, the project took 5,000 hours of work, the company said. "The piece that we think is unique is that we have done all at-rest data in the enterprise," Michael Lawley, BlueCross' VP of technology shared services, told InformationWeek Healthcare. He defined "at-rest" data as anything that can be placed on a storage device. "We searched the country and were unable to find another company that has achieved this level of data encryption."

The company, the largest commercial health insurer in the state, was planning to encrypt many of its data stores, but accelerated and augmented its plan after an October 2009 theft of 57 hard drives from a training facility in Chattanooga. The drives held audio and video recordings of provider and member calls to Blues customer-service representatives, and included personal information on about 1 million insured people, according to the Blues.

"At this point, we have no evidence that any of the data was accessed," said Lawley, who believes that some of his own personal information was on the stolen drives. But the company did take a pounding in the court of public opinion. "Our business is built off trust," Lawley said. Plus, any data loss today would open the company up to greater liability under the tougher HIPAA provisions called for in the 2009 American Recovery and Reinvestment Act.

"What this [theft] did is it sped up a program that we had already started," Lawley said. "We thought it would take three to five years. It took just under two years."

According to Lawley, the encryption encompasses off-the-shelf technology from multiple vendors, with custom engineering by BCBST to assure that there would be little or no performance loss. "When going to encryption," Lawley said, "there's the possibility of performance hits."

He said that the company engineered methods to access the encrypted data in ways that would not slow down authorized users.

"Data encryption is achieved through the use of algorithms, which convert normal, readable information into an indecipherable format, and secure keys, which allow only authorized users to convert the information back into a format they can use. This means that even in the event of a theft or some other security breach, no one would be able to read the data contained on BlueCross hardware, whether it was a computer, server or flash drive," the company said in a press release.

BCBST has posted more information for the public, including a video, at http://www.bcbst.com/data.

Find out how health IT leaders are dealing with the industry's pain points, from allowing unfettered patient data access to sharing electronic records. Also in the new, all-digital issue of InformationWeek Healthcare: There needs to be better e-communication between technologists and clinicians. Download the issue now. (Free registration required.)