Article
By healthcare analytics and tech standards, Socially Determined’s implementation process is incredibly fast. A large part of this is due to our customer success team, stepping in early during the sales process and staying close with every client. (You can read more about them here). But there’s much more to the story. The nature of the social and health data we work with demands a dedication to security far beyond HIPAA and HITRUST standards.
Today we’re going to discuss our approach and how good security delivers fast implementations.
From our inception, we knew that in pioneering the applied science of SDOH risk, we would be working with a lot of sensitive data,especially as clients trusted us to combine it with theirs to deliverindividual-level insights. That meant we had to be a security-first organization, from technology to training.
The first step was finding the right CSP (cloud services provider). The right pick (Amazon, in our case), needed to be a secure,versatile foundation. Our choice also meant we could adopt a serverless framework (as opposed to self-hosting) letting us deploy for our clients very quickly.
The next step was building infrastructure as code (IAC),bypassing the backplane of AWS by using a language called Terraform. Once the base services are up and running, we use this to control configuration and protection. It lets us securely integrate in a controlled way with any external services not in our core.
For payers and providers in particular, it allows us to do what’s called a “cloud native data transfer.” For any other client that also uses AWSas a primary computing environment, we carry out a secure AWS S3-to-S3 secure data transfer. This prevents any data from ever going into the open web. It just never leaves the AWS backbone network. It’s one of the layers of our defense-in-depth because it reduces “threat surface,” meaning fewer (or no)external access points.
Back to the point of rapid implementation of our SDOH analytics and platform, our architecture ties directly into our core mission:use our social risk data to improve outcomes and reduce avoidable costs ofcare.
We’re natively set up for providers to do an API call at patient intake. That means we can deliver social risk scores for patients at point-of-care.
Of course, we’re also capable of working with SOAP, a more transactional, rigid language ideal for healthcare, and its newer counterpart,REST. It can be anything a client needs even in 100,000 patient or member batches to provide much higher-level analytics.
From the outset, we knew our security posture had to be more than our tech stack. It had to be procedural and cultural. We take our HITRUST compliance very seriously, as every new hire can tell you. Everyone reads, is tested on, and signs our entire 300+ page policy document and does so again every year. (Ed note: yes, even marketing, including the author of this post).
Those policies include that anything even related to PHI only lives in our protected cloud environment, never traveling to any devices,no matter how secure. We use cloud-hosted desktops exclusively to work with PHI,not our laptops. This creates an entire second level of protection in an industry where it’s shockingly common to rely on device security alone.
That approach to security once again ties directly to our rapid implementation: when customers give us security assessments with 200+detailed questions, we don’t just answer them, we provide “chapter and verse”from our security documentation, down to the subsection and paragraph.
When onboarding a client, we turn around new security assessments in 2-3 days. And on the outside chance we get a question we don’t already have in our policy document, it typically gets added.That transparency helps build an incredible amount of trust. We often even find ourselves answering questions that help them evolve their own security posture,rising the tide across healthcare as we go.
Traditionally, HITRUST has not contemplated AI, but we adopted the NIST AI Risk Management Framework and documented our enterprise AI use strategy, covering both tool and data usage and their control. At a point where AI is rapidly evolving every aspect of healthcare technology and analytics, we don’t implement anything internally, AI or otherwise, without clearly defining all allowed and approved use-cases alongside training.
As far as we’re concerned here at Socially Determined,impeccable (and evolving) security is table stakes in healthcare. It goes beyond practical, becoming about understanding and prioritizing data securityfor our clients as well as the millions of people they represent. Privacy is intrinsic to the system and failing to stay at the absolute best possible standard for yourself simply isn’t an option.
In doing so, we can rapidly deliver pretty much any possible client implementation, helping them take action on their unique social risk configuration. The faster we’re ready for them, the faster they can use socialrisk data to reduce costs of care, improve outcomes, and provide a better quality of life for the individuals and communities they serve.