Private Cloud Hosting

• 256-bit encryption | password encryption
• high-performance firewall protection and monitoring
• all changes to data are tracked with full audit records (user, change type, time/date of change)
• individual field level encryption done at platform level (ensures confidentiality of the most sensitive data – e.g., AIDS tracking)

The architecture uses https protocol (built into IIS).  The data servers are separate from the web servers. This means all data access from browsers must go through the application platform, effectively disconnecting your data server directly from the Internet.

The Visions Server utilizes a multi-dimensional security model that is extremely flexible. Users are assigned to groups that define functional duties, including levels of access for each form in the system. Users are also assigned to logical “organizations” that define access roles for individual cases. This is a hierarchical structure that the Visions Server automatically maintains to ensure users can only access cases they are allowed to.

GVT maintains strategic partnerships with two, high performance hosting facilities.  The collocated facilities help GVT to provide dynamic management of hosting services across geographically disparate locations.  Our “prime” hosting facility, provides enterprise level hosting and is a SSAE18 – Type II audited organization.  The facility is also ISO/IEC 27001:2013, HIPAA/HITECH, and PCI DSS 3.1 compliant.   Both our primary and secondary data centers provide state of the art hosting services that include camera and escort monitoring, locked cabinets and biometric scanning.  Both locations are SOC2 certified.

GVT’s technology allows for the encryption of PHI as requested by a customer.  Data points such as first name, middle initial, last name, date of birth, gender, and zip code, can be encrypted at the customer’s request and all encryption can be done at the database level.  Encryption and decryption is accomplished in the Visions Server by creating a binary field for each encrypted field, and then using a common protected symmetric key to encrypt and decrypt the data to/from this field.

Because of the architecture of the servers, it would take several breaches to reach all of the necessary servers to both get the actual database and then the key for encryption/decryption.

The established pw protocol is 8 characters – which includes 2 capital letters and 2 numbers.  GVT does force password changes every 90 days.   We use custom encryption for database fields that need to be encrypted and incorporate SSL certificates to encrypt transport from the user to the server.  The system has a built-in tool that can be set for varying degrees of timeout sessions.  Each client site is set to their own preference.

• Full audit recording
  • Indicating when a record was signed, altered or modified
  • When a record is updated, a full audit trail of the change, who it was made by, the reason for the change, and the date and time of the change.
  • The system maintains an “audit mode” tied to form specific information, accessible at any time.
• Electronic signature capture
• Full logging of every interaction by a user and location (IP/GPS tracking)