STATEMENT ON SECURITY
Web & Mobile Encryption
PAPA Healthcare, Inc. (“PAPA”) is dedicated to protecting all customer data using industry best standards. This Statement on Security provides an overview of some of the security measures integrated into the PAPA Web/Mobile product line.
The PAPA Web/Mobile product line employs the HTTPs protocol using SHA-256 (Secure Hash Algorithm) with RSA encryption to secure communications among authorized mobile devices, web clients and servers.
Phone or Tablet Authentication:
Phone or tablet authentication can be accomplished with one of two methods, authorized password or via an iOS finger ring.
The PAPA app requires authentication by one of two methods, authorized password or via, for iPhones, an iOS finger ring. The password is the baseline option, always available, and the most secure. The iOS finger ring is an optional method that may speed productivity; however, it can only be used if the app is already running and the user is re-entering the app. Upon the first launch or re-launch of the app, the password method must be used. That password is then stored in local storage in the protected app space and made available to the iOS finger ring for authentication while the app continues to run. If the phone were to be tampered with, the app space is protected and the cache containing the password would be wiped clean, rendering it unavailable to an unauthorized user.
The window of time for the app to remain dormant before becoming locked is an administrative level setting that can vary by institution. To unlock the app, simply re-authenticate with the password or an iOS finger ring. If the app had been closed, it will require the password method to re-authenticate and re-open the app.
Most of the data transfer transactions occur in real-time, but the app offers encrypted storage for temporary caching of the database and files until they are synced with the server. This ensures that that any drops in network access do not lead to uploaded information being lost before the app is synced to the server. Our encrypted storage employs a 256-bit key using the Chacha20-Poly1305 algorithm before writing to local storage. Once the data or files have been synced to the server, they are cleared from the cache and no longer available on local storage.
Logging / Defining the Window of Vulnerability:
If a customer’s user’s phone were to become lost or stolen, we would remotely lock the phone, disable it, wipe the phone, or selectively wipe the phone using an enterprise mobility management solution such as IBM® MaaS360®, which should installed on all user devices. User devices from business partners of the customer may also be protected by mobile management software installed by that user’s employer (e.g. a hospital).
Our service team has the ability to review the activity associated with each user to determine what has been accessed during any window of concern. Accordingly, in the event of a misplaced device, the scope of risk would be well understood.
The following examples illustrate how our security features perform in specific scenarios:
- Patient Facts are being updated from PAPA mobile to the server:
- While editing Patient Facts, the edits are stored in PAPA mobile encrypted storage.
- When the submit button is pressed, the app begins the submission of data to the server using Transport Layer Security (TLS) encryption.
- When the data submission has been completed, the information that was submitted is erased from local encrypted storage.
- Document Capture on PAPA mobile to the server:
- A document (e.g. Facesheet) is captured for either a new patient / referral or a new referral.
- The document is stored in encrypted storage until it is successfully submitted to the server.
- After the document is submitted, it is erased from local encrypted storage.
- Patient Query from the server to PAPA mobile:
- A list of patients is queried and stored in local app memory that is isolated from access by any other app running on the device by iOS or Android.
- The local data is erased upon closing of the app or a device reboot.
- Changing Apps:
- Upon changing to another app, if the Home button were to be pressed so that the various open windows are visible, the PAPA mobile app will display a coversheet with a logo. Protected Health Information (PHI) is not visible.
- Upon returning to the PAPA mobile app, the user is required to authenticate via TouchID (iOS) or a user name / password depending upon the amount of time that had elapsed.
- Document View pulled from the server to PAPA mobile:
- The document is viewable and, after a period, will be placed in the app memory that is isolated from access by other app running on the device
- The document it will not be saved in unencrypted local storage and will not be cached in the browser cache.