...
| Expand | ||
|---|---|---|
| ||
Acceptable use policy: Patients Know Best’s Acceptable Use Policy outlines the expected standards of all who have access to PKB systems and information ensuring that services are used responsibly and in compliance with legal and ethical standards. It prohibits any misuse, abuse, or unauthorised activities, safeguarding the integrity and security of the platform. Business continuity policy: Patients Know Best has implemented a comprehensive Business Continuity and Disaster Recovery plan with measures to ensure data resilience, disaster recovery, and service continuity which is reviewed and approved annually. Data retention and disposal policy: Patients Know Best maintain a Data Retention and Disposal Policy to ensure data is retained only for the required duration, as per the Data Controller’s instruction, to support patient care and meet legal obligations. Secure disposal methods are employed when records reach the end of their retention period. These policies are reviewed at least annually. Incident response policy: Patients Know Best maintains an Incident Response Plan policy that describes the process for identifying and addressing potential security incidents. The policy details steps to take if an incident is suspected. Plans for detecting, responding to, and recovering from incidents are included in the policy and post-incident activity requirements are defined. Information security policy: Patients Know Best have a documented Information Security Policy to help ensure that employees understand their roles and responsibilities related to security. This includes security procedures to ensure that employee workstations have proper virus protection software, the most recent operating system and security patches installed. Risk management policy: Patients Know Best has established a risk assessment process to identify, analyse, mitigate, and manage risks relevant to its services and organisation. Various types of risks are considered, including, but not limited to, operational, strategic, technological, compliance, security, and vendor risks. |
| Expand | ||
|---|---|---|
| ||
Patients Know Best Incident incident response plan is intended to establish controls to ensure detection of security vulnerabilities and incidents, as well as quick reaction and response to security breaches. The plan also provides implementing instructions for security incident response, to include definitions, procedures, responsibilities, and performance measures (metrics and reporting mechanisms). |
...
| Expand | ||
|---|---|---|
| ||
Access to the Patients Know Best portal is over a secure link (https/TLS). There are multiple layers of intrusion protection, intrusion detection and firewalls between the internet, our application servers and the databases. Our production infrastructure is has no direct access from the internet. Networks are protected by enterprise-class firewalls and appropriate virus protection is in place. PKB restrict direct access to Google Cloud Platform’s servers i.e PKB’s production environment, to specified IP addresses and security groups to prohibit unauthorised access to confidential data. |
| Expand | ||
|---|---|---|
| ||
Multiple controls are installed to monitor traffic that could contain and patterns to identify malicious programs or code. Penetration tests are performed annually by a third-party vendor to measure the security posture of target systems and environments and to expose potential vulnerabilities to the production environment and data. Request access to our latest public-facing Penetration TestPatients Know Best utilise Lacework , a threat detection service with anomaly detection for cloud activity, containers, inbound/outbound connections that continuously monitors for malicious activity and delivers detailed security findings for visibility and remediation. |
| Expand | ||
|---|---|---|
| ||
Patients Know Best (PKB) uses UK Google Cloud Platform (GCP) instances for all UK customer and patient data. All data stored with GCP, including the database, are is encrypted at rest and in transit using industry-standard AES-256 -bit encryption algorithms and up to TLS 1.3 or higher.Patients Know Best’s HTTPS certificate is a SHA2 certificate using a full 2048 bit key, issued by GoDaddy and renewed every 2 years. The current status of PKB’s TLS configuration can be verified here. |
| Expand | ||
|---|---|---|
| ||
Access to data is highly restricted, PKB use Role-Based Access Control and strictly monitor access to customer data and only permit it on an as-needed basis. PKB maintain very strict policies, security and procedures governing any data access and only authorised employees can access the application and database servers. Access by healthcare organisation customers is also are monitored and events are stored in the Access Log of individual patient records. PKB additionally maintain a forensic-level audit of metadata pertaining to datapoints. |
| Expand | ||
|---|---|---|
| ||
Patients Know Best have a strong internal password policy that includes a requirement for MFA for accounts that do not support SSO. Passwords are stored in a company managed password manager. |
| Expand | ||
|---|---|---|
| ||
Patient Knows Best’s patch management process pushes security updates fast and consistently. Upon finding an issue in the production environment PKB evaluate to determine the impact. If an issue highlights a significant disruption to functionality or performance of the system or is considered a potential clinical/IG risk then a patch/release is scheduled as soon as a fix is ready. For critical issues downtime may occur during the day otherwise the fix will be scheduled in the evening when usage is lower. |
...
| Expand | ||
|---|---|---|
| ||
The Patients Know Best platform is is deployed as a multi-tenant, Software as a Service architecture run on fault-tolerant servers at Google Cloud Platform (GCP). In addition to managed services for Patient Knows Best infrastructure, GCP provides physical security and environmental protection controls, including the use of secure perimeter defence systems, comprehensive camera coverage, biometric authentication, and a 24/7 guard staff. In addition, they enforce a strict access and security policy at data centres, ensuring all staff are trained to be security minded. For more information see here |
| Expand | ||
|---|---|---|
| ||
Patient Knows Best's Business Continuity and Disaster Recovery (BCDR) strategy is a proactive and comprehensive plan designed to ensure uninterrupted operations and data protection. Data security is a top priority, with encryption and access controls in place. Regular testing and validation are performed and reviewed and approved annually. |