Data Privacy, Protection, and Compliance at a Global Medical Equipment and Services Company

Background

This PKWARE customer is based in California. It builds medical equipment and services for diagnosing, treating, and managing lung and breathing disorders.

Its cloud-connected devices change the way people with serious long-term illness are cared for. It also offers ways to manage care outside the hospital, which leads to better health.

Revenues run to $2.6 billion USD. The company employs more than 7,500 people and works across 140 countries.

Challenges

The company takes in huge volumes of patient data. Threaded through it is Protected Health Information (PHI) and Personally Identifiable Information (PII), also known as Personal Information (PI).

That data arrives all day, fed from software on user devices into the company’s own stores. By the end of 2018 the customer needed a way to protect every piece of it, on its own and without a pause.

Until then the work was manual. Staff scanned for sensitive data, masked what they found, and could no longer keep pace with what privacy law asked of them.

The company works in healthcare, so it must guard PHI under the US Health Insurance Portability and Accountability Act (HIPAA). It must guard PII under the EU General Data Protection Regulations (GDPR), in force from 2018.

By the end of 2019 it would also fall under the California Privacy Protection Act (CPPA), which adds further duties around PI.

So the customer had to find a reliable, automated way to find and mask every personal and sensitive element in a data set that keeps growing. The devices its users wear were generating 1-1.5 GB of new data every 10 minutes.

The first challenge was the move itself: a clean path from the company’s own data stores to quarantined S3 buckets. PKWARE had to scan up to 30-TB of data elements, find every piece of PHI and PII/PI, and mask it to the customer’s own policy.

The second challenge was the day-to-day run. PKWARE would have to find and mask sensitive PHI and PI/PI in 1-1.5 GB micro-batches, inside Snappy Parquet files compressed 2.5 to 7 times.

The customer’s limit was 5 minutes, with a minute of tolerance, 24/7/365. Clean data then had to land in protected S3 buckets, ready for other AWS tools such as Redshift to run the analytics the business depends on.

The third challenge sat on top of both: keep the compute bill (EC2, EMR) as low as it could go.

Our Approach

PKWARE finds and masks all PHI and PI/PII in all locations, according to the customer’s data management policies. The data keeps its referential integrity, and its value for use in dev/test, analytics, and business intelligence.

Download PDF

The level of customer obsession and interest in making the solution scale was the reason we were jointly successful. I would recommend working with PKWARE. Nicole Beige, Named Account Manager, AWS

Use Cases

The company was new to AWS and was looking for a data privacy technology provider. It met PKWARE through its own AWS Named Account Manager.

At re:Invent 2018, the ISV Success Manager suggested the Account Manager get in touch with PKWARE. The customer’s need was urgent, so the PKWARE and AWS teams agreed to work together on the floor of re:Invent itself.

PKWARE answered quickly. It met the customer’s technical team, the AWS Account Executive, and the Sales Engineer to draw out the full picture.

In under a month PKWARE documented the requirements, ran the testing, and finished a Proof of Concept (POC). On the strength of it, the customer chose PKWARE as its provider.

To validate the software, the customer downloaded the PKWARE SaaS version through AWS Marketplace and used it. The results on finding and protecting patient data satisfied them.

From there the customer put the full product to work, scanning and de-identifying its whole 30TB of user data. That was done inside the first 30 days.

Since then, between 1-1.5 GB of new data lands in the quarantined S3 buckets every 10 minutes. It is de-identified and passed on for internal use, such as analytics, before the next batch arrives.

Within one business quarter the customer trialled the platform, widened its requirements, ran a successful POC, and closed a production contract.

The company now pushes 1-1.5 GB micro-batches every 10 minutes through PKWARE, which scans, finds, and masks all PHI and PI/PII while keeping referential integrity.

The platform solved the technical problem and met the business one. PKWARE closed the procurement process during the second 30 days, with room in it for privacy features still to come.

With PKWARE, the customer meets its own needs for patient privacy and corporate security across analytics, dev/test, and business intelligence, and it stays within the rules while doing it.

Results

Handles 1-1.5 GB Micro-Batches Every 5 Minutes “PKWARE came highly recommended by AWS. Because PKWARE met the use case for detection and masking of sensitive data in 1-1.5 GB microbatches in less than 10 minutes, we went forward.” —Director of Data Strategy and Engineering

HIPAA, GDPR, and CCPA Confidence The customer realizes 100% compliance. PKWARE finds and masks every piece of PHI and PI/PII, wherever it sits, to the customer’s own data management policies. The data keeps its referential integrity and its value for dev/test, analytics, and business intelligence.

Reliable, Rapid, and Responsive: A Comprehensive End-to-End Business Process Within a single business quarter, PKWARE and AWS found a new customer need and wrote up the requirements. They then ran a successful POC, signed the contract, and put a full production solution in place.