Healthcare organizations face unique challenges in managing and processing vast amounts of personal information, such as medical records, insurance information, Social Security numbers, and more. To accelerate patient care, these organizations are under pressure to rapidly share this information among providers, insurers, and patients—all within the landscape of a rapidly evolving cloud environment. These efforts can introduce numerous points of vulnerability, as sensitive data can easily leak into external systems and applications, including those used for monitoring telemetry data.
To protect patient data, the Health Insurance Portability and Accountability Act (HIPAA) establishes requirements for the protection and confidential handling of protected health information (PHI). Many entities must adhere to HIPAA, including healthcare providers and insurance organizations, as well as vendors of products and services that work with these organizations. Noncompliance with HIPAA can lead to substantial legal, financial, reputational, and operational consequences.
In this post, we’ll show you how Datadog customers subject to HIPAA can use Sensitive Data Scanner to:
- Discover PII at scale, including patient and insurance information
- Classify sensitive healthcare data using granular rules
- Redact results to help prevent HIPAA-protected data from leaking into Datadog
Discover PII at scale, including patient and insurance information
Complex healthcare applications typically consist of numerous services where even a single console log can emit PII, such as that contained in electronic health records (EHR) and medical record numbers (MRN)—potentially leading to a widespread leak. Because of the large amount of personal information that EHRs and MRNs can be associated with, it’s crucial to make sure they can be detected in your telemetry data.
For example, a large hospital may use a portal to collect and organize information for thousands of its patients, store and deliver test results, and communicate with patients via a chat app service. If the chat app service experiences a performance issue, the hospital’s observability teams will investigate by analyzing the error logs. These logs may contain sensitive information such as EHRs, MRNs, insurance information, and more, leaving the hospital at risk of noncompliance with HIPAA. In addition, since different services are often managed independently, security and compliance teams may find it challenging to enforce HIPAA compliance requirements uniformly across the entire organization.
Many of our customers subject to HIPAA use Sensitive Data Scanner to quickly discover and redact such sensitive healthcare information across their telemetry data by defining scanning groups. To do this, specify a query filter for your scanning group and select which Datadog products (e.g., APM, RUM, logs, and events) you would like to scan. Defining your scanning groups and the telemetry data you want to scan gives you the flexibility to create specific scanners for different services, hosts, and environments. Alternatively, many Datadog users choose to scan all of their incoming data for sensitive information as a way to unify governance policies organization-wide.
Classify sensitive healthcare data using granular rules
Because sensitive healthcare data appears in many forms, it may require unique detection, protection, and remediation strategies depending on its type and severity. Within Datadog Sensitive Data Scanner, you can easily create scanning rules that define what types of data need to be flagged and scrubbed.
Datadog provides out-of-the-box rules for detecting common instances of sensitive healthcare data (e.g., patient email addresses, Social Security numbers, and more) that you can easily apply to any scanning group. These detection rules are grouped by popular compliance standards, including HIPAA, so compliance and security teams can easily identify and activate rules in just a few clicks.
Alternatively, your application may require custom rules to fit more specific needs. For example, a hospital may want to create a custom rule that scans for MRNs. Custom rules are simple to create using regex:
Redact results to prevent sensitive data from leaking into Datadog
When a sensitive data leak occurs, governance, risk, and compliance (GRC) teams concerned with data loss prevention may need to act fast to plug it and contain the fallout. Capturing details along the way may also be important, especially when it comes to providing HIPAA auditors with incident reports.
To streamline investigations and reporting, Sensitive Data Scanner automatically tags any sensitive data matches with the name of the rule (e.g., sensitive_data:medical_record_number) to make it easily searchable in Datadog. Additionally, this tagging structure allows teams to configure real-time alerts and build dashboards that accelerate the investigation and remediation process.
As you perform regularly scheduled compliance audits for HIPAA, you can take advantage of this tagging structure to easily discover which services may be leaking sensitive data. For example, to check if any of your applications may be leaking sensitive data from development to production environments, you could filter your application logs and traces to show only those with the sensitive_data:true tag. Now you can easily take action to manage the potential sensitive data leak.
To help manage the influx of sensitive data issues, the Sensitive Data Scanner Summary page consolidates all of the issues detected by your scanning rules in one place, as well as the associated scanning groups and number of events. Issues are sorted by priority level to help you decide what to act on first, enabling you to take informed action based on the severity of the event.
You can dig deeper into each issue to get an expanded view of a timeline of the potential sensitive data leak, with different views across Datadog Log Management, APM, RUM, and Event Management. By correlating all impacted telemetry, hosts, and environments in one place, you can easily pinpoint how and where sensitive data may have been compromised and what may have led to the event, so you can quickly plug the leak and prevent any further damage.
As you are investigating a leak, it can be helpful to see who may have been involved in the incident and who was given access to sensitive data. Datadog Audit Trail provides a breakdown of associated user activity, such as who configured a scanning rule or group or queried for sensitive data. You can also pivot to Datadog Service Catalog, where you can identify the teams that own any services involved in a leak.
If you determine that the issue should be reported, you can easily create a case using Case Management and Incident Management to quickly coordinate responses. Directly from the Sensitive Data Scanner Summary page, you can create a case or incident, delegate teams or individuals to respond, and orient responses around the corresponding sensitive data issue or exposure. The native integration with Case Management gives security and compliance analysts a record of each issue—including its causes and remediation, which they can use to show auditors the actions taken to resolve the issue.
For example, let’s say you’re a security analyst and Sensitive Data Scanner detects patient Social Security numbers in your organization’s logs, APM traces, or RUM events. Because you have preconfigured alerts based on the tags associated with your Sensitive Data Scanner SSN rules, you immediately receive a notification from Datadog that this data has been detected. By looking at the Sensitive Data Scanner summary page, you can quickly understand the blast radius of the leak and contact the owners of the affected services. If the leak is severe, you can create a new case or declare an incident to remediate the situation.
Help improve your HIPAA posture with Sensitive Data Scanner today
To protect sensitive electronic health records and address your HIPAA obligations as you scale, it’s beneficial to continuously monitor for potential sensitive data leaks so your teams can quickly detect, review, and remediate them. With Datadog Sensitive Data Scanner, you can help ensure that the sensitive data across the entire Datadog platform is managed securely, making it easier to comply with your HIPAA obligations.
To get started, see our documentation. If you’re new to Datadog, you can sign up for a 14-day free trial.