myhealthkey Service Information
Security and Compliance is a shared responsibility between Bright Health, Microsoft Azure, and the customer. This shared model can help relieve the customer’s operational burden as Bright Health operates, manages and controls the components from the application to the infrastructure configuration, while Microsoft Azure manages and controls the virtualization layer down to the physical security of the facilities in which the service operates. The customer assumes responsibility and management of the customer / patient data as well as aspects of the myhealthkey application configuration. Bright Health assumes responsibility and management of the guest operating system (including updates and security patches), other associated application software as well as the configuration of the Azure provided infrastructure services. Please refer to the chart below for a visual representation of responsibilities.
Microsoft Azure responsibility “Security of the Cloud” – Microsoft Azure is responsible for protecting the infrastructure that runs all of the services offered in the Microsoft Azure Cloud. This infrastructure is composed of the hardware, software, networking, and facilities that run Microsoft Azure services.
Bright Health responsibility “Security in the Cloud” – Bright Health leverages various components of Microsoft Azure, including their Infrastructure as a Service (IaaS) offerings and, as such, performs all of the necessary security configuration and management tasks. Bright Health is responsible for management of the guest operating systems (including updates and security patches), any application software or utilities installed by the Bright Health on the instances, and the configuration of the Microsoft Azure provided firewall (called a Network Security Group) on each instance.
Customer responsibility “Security outside of the Cloud” – The Customer also has responsibilities in this model. The myhealthkey user accounts (once provisioned) with access and IT infrastructure (including office networking security, workstation configuration and security, printers, scanners, and other peripherals) set up to connect to myhealthkey are the responsibility of the Customer. The use of shared workstation accounts is discouraged as that practice can lead to information security compromise of customer and patient data.
myhealthkey services are continually monitored for availability. Real-time reports on availability can be found below:
Application event logging
Logging exists within myhealthkey that is not readily available from the front-end, but can be provided for audit purposes with a support ticket.
Data primarily resides in Azure Canada Central and is replicated to Azure Canada East for Disaster Recovery purposes.
Systems are backed up daily in the evening between 10pm and 4am Pacific.
System and application backups are stored encrypted at rest.
System backups are retained between 3 months and 1 year depending on the data resiliency requirements.
System backups are spot tested as need arises for integrity, as well as through an annual Disaster Recovery test.
Time in myhealthkey
Time in myhealthkey is synchronized to ‘ca.pool.ntp.org‘.
Vulnerabilities are scanned for regularly and are investigated and remediated in compliance with Bright Health’s IT Security Policy.
Additional Service Information
Current and prospective customers can engage with Bright Health for further insight into other service aspects including information security capabilities through a support ticket or through their sales contact.