Healthy Body Wellness Center
Case Study
Healthy Body Wellness Center (HBWC) Mission and Vision
The Healthy Body Wellness Center’s mission is to help patients take responsibility for their
overall wellbeing and educate members of the local community in the practice of wellness.
The HBWC includes an Office of Grants Giveaway (OGG), responsible for distributing a
variety of medical grants designed to investigate multiple facets of community wellness,
with the majority of grants disbursed to small hospitals, defined as having 250 beds or less.
HBWC is planning to modernize employee payroll and benefits management across the
company through the use of an outsourced provider, such as Workday, ADP, or Peoplesoft.
HBWC is also planning to upgrade its research database and develop a cloud-based grant
tracking system. The company wants an analysis of the feasibility and planning for
conversion to be added for consideration to the overall design for HBWC’s future
infrastructure and services.
Office of Grants Giveaway (OGG) Mission and Vision
The mission of the HBWC’s OGG is to promote improvements in the quality and usefulness
of medical grants through federally supported National Institutes of Health (NIH) research,
evaluation, and sharing of information. The Small Hospital Grant Tracking System (SHGTS)
is the primary application used to manage this data. Grant funding takes place using
automated clearing house (ACH) processing. The SHGTS contains the hospital-specific
banking data needed to process ACH payments.
The SHGTS assists in the assignment and tracking of small hospital grants and is a single-
user system running on a desktop computer. The OGG assigns a grant to one hospital for
one month and then any unused grant funds are rotated to another hospital for the next
month. The SHGTS tracks the initial delivery of the grant funds, stores pertinent
information, and then follows the grant through the next five hospital facilities.
Only executive OGG staff can assign grant funds, but all principal investigators must
complete their grant evaluations in the application. With the Paper Reduction Act, the
federal government is moving their application from paper-based to an online submission
system. Each week the OGG executive officer receives a grant status report. Each month,
each principal investigator is briefed on the status of their current grants via reports
generated by the SHGTS.
The OGG is expecting to receive more medical grants from the NIH and needs a way to
grow the office’s staff while upgrading the infrastructure to support the current workforce,
which consists of part-time workers, work-from-home employees, and contractors. As the
OGG expands granting and resources for grant seekers, the creation of remote office
branches to meet those needs is also being considered.
OGG is also collecting the requirements for a new, web-based portal for use by recipients of
grants and researchers. This portal will contain patient-sensitive and other nonpublic
information (NPI) that must be adequately protected during processing, storage, and
transmission. Access to this resource will be managed by OGG staff with the appropriate
privileged access.
HBWC’s current LAN administrator and security manager, who is responsible for most of the
technology that is presently in place at OGG, is retiring next month. You have been
promoted to assume this role upon the manager’s departure. Endothon Security Consulting
completed a security assessment report (SAR) on behalf of the HBWC, therefore in your
new position, you will be responsible for the following tasks
conducting a thorough analysis of what’s in place technology—and applications-wise
finding out which elements already in place are no longer able to support the
operations
synthesizing business, technical, security, and regulatory requirements for fitness in
ongoing operations
conducting a threat analysis of the applications and infrastructure to understand
network and application security needs
designing a replacement network to the existing LAN to support secure employee
remote access, secure ACH data transmissions, secure NPI and patient data to the
required levels and to support third-party extranet connections to cloud-based SaaS
providers of services to OGG
HBWC is primarily Microsoft-based and wishes to preserve their relationship with Microsoft
to ease migration from older-MS products to the newer suites of tools they offer (e.g., Office
365, SQL Server, ASP.NET). HBWC has a small staff of programmers needed to maintain
existing applications and is fluent in C# and VB.NET. HBWC’s internet service provider (ISP)
is Pogtech Communications, which provides broadband access for internal and planned
external users of their resources and services.
System Overview
The SHGTS is a Microsoft Access 2010 database that resides on the Windows 2008 R2
application server. The SHGTS application and its data are protected by built-in security
mechanisms supported by the hardened Windows 2008 R2 platform. Microsoft will stop
supporting Windows 2008 in January 2020 and then Access 2010 in October 2020. This
means that Microsoft will no longer supply patches for the software after 2020. MS Access is
unsuitable for use by multiple simultaneous users and will need to be migrated to a MS SQL
server with a new infrastructure. New access via the internet will also be required for
sharing data among NIH, HBWC, and the hospitals they serve. A persistent link to NIH may
be required to exchange data among multiple users and potentially multiple sites that might
be needed for processing grants.
To segregate functions in support of SHGTS, three technical support personnel (members of
the administrator group) have administrative rights to manage the Windows 2008 R2
server. The SHGTS database administrator (DBA) does not have administrative privileges to
the Windows 2008 R2 operating system (OS).
The SHGTS database has been customized for group security to protect the application from
design changes such as altering the visual basic for applications (VBA) code or modifying
database objects. There are three categories of users for the SHGTS:
Administrative: full control of the application, including the ability to alter code and
modify database objects
Executive: access to all reports and the ability to update key fields dealing with the
assignment of grants
Basic: access to most forms and the ability to update key fields relating to
information about assigned grants
A virtual private network (VPN) firewall appliance is in place for users that require remote
access to the SHGTS. Knowledge of the VPN is limited to users with a mission-essential
need. Users access the VPN via Pulse Secure software using a token or a personal identity
verification (PIV) badge.
Payroll is currently handled on HBWC’s premise using QuickBooks with paper checks. Direct
deposit has not been implemented. Grant money is also provided by paper checks. Checks
can be obtained from the office manager or sent through the mail.
HBWC’s patient information and other research data are kept in Excel spreadsheets.
Patients have a patient number assigned to them throughout the research period and a
conversion sheet between the patients and their associated numbers are also listed in Excel
to maintain patient confidentiality. Principal investigators at each hospital are allowed to
keep their data proprietary for one year while they are writing their research report. The
NIH then becomes proprietor of all data. A hard copy of the research report is then saved in
a file cabinet at the OGG and stored on the server. This makes it difficult for potential
principal investigators to mine the data for information that could be used in future
research.
System Interfaces
The SHGTS exchanges data with the NIH but does not give or receive any data to or from
any other major application (MA) or a group system support (GSS). The SHGTS resides on
Windows 2008 R2, but otherwise does not interface with any other system. It is accessed
from local application running on HBWC workstations connected to the LAN. HBWC staff
may access this database when they connect remotely through the VPN connection.
The HBWC uses a QuickBooks database for employee payroll, which is housed on the
Windows 2008 R2 server and is a standalone database that can be accessed from the client
workstations similar to the SHGTS.
The research raw data and reports are housed on the HBWC’s server in a fileshare.
Data
The SHGTS database contains private health information (PHI), other healthcare
information, and proprietary data in its tables. Data stored in the SHGTS includes specific
attributes about the grants such as control number, grant category, amount, distribution
schedule, and sunset date. Information detailing grant distribution particulars, such as
sponsoring staff, the directing official, and date assigned, is also stored in the system. The
research data is only attributable to an individual if the conversion table is viewed along
with the raw data.
QuickBooks contains personally identifiable information (PII) data on HBWC employees
including social security numbers, salaries, home addresses, emergency contacts, phone
numbers, and next of kin.
Criticality
The HBWC’s Information Systems Criticality Definition Process defines automated
information resources whose failure would not preclude HBWC from accomplishing core
business operations in the short to long term (a few hours to a few weeks) but would have
an impact on the effectiveness and efficiency of day-to-day operations being needed for
daily processing of grants. The SHGTS also includes the research data, and the failure of the
SHGTS would not preclude the HBWC from accomplishing core business operations in the
short to long term (a few hours to a few weeks), but loss of the research data would require
notification to NIH that the results of the research they funded is not available. However,
failure of the system would have not an impact on the effectiveness or efficiency of day-to-
day operations. Consequently, the SHGTS database is considered mission supportive.
Failure of the QuickBooks database could prevent employees from getting paid. A paper
backup is maintained in case the server goes down, but the data may be a day old at
minimum.
Sensitivity
The criteria used to measure a system’s sensitivity include confidentiality, integrity, and
availability. The sensitivity areas for the SHGTS and QuickBooks are described below:
Confidentiality
SHGTS: Low
There is no Privacy Act or proprietary data to protect. No awardee information is tracked on
the grants; the system only tracks grant-specific data. If unauthorized personnel read data
that they are not authorized to see, administrative action (such as grant suspension or a
letter of reprimand) would be the most severe consequence. If competing grant candidates
discovered the grant rating system, the financial impact would be under $100,000.
Research data: High
The research data contains medical information on research subjects and needs to be
compliant with HIPAA regulations and protected from employees that do not have a need to
know. The research data also needs to be protected so that only the principle investigator
can have access to it for the first year.
QuickBooks: Medium
There is Privacy Act data included in the QuickBooks database and the information should
not be shared outside the payroll office.
Integrity
SHGTS: Medium
The data maintained on the grant ratings does affect recommendations for particular grants.
Since entire medical research establishments use these recommendations, the financial
impact of manipulated ratings could be between $150,000 and $300,000, but less than
$1,000,000. Anyone involved with such data manipulation would possibly be sued but not
sent to jail.
Research Data: High
The integrity of the research data must be paramount since the loss of data or any change
in the data may show incorrect results of the research.
QuickBooks: High
The integrity of the data for salaries and other information regarding employees needs to be
accurate to make sure that everyone receives the appropriate salary, based on job title and
length of service.
Availability
SHGTS: Low
The reports are much easier to prepare with the database and it would be inconvenient if
the database were unavailable to locate specific grants. However, manual inspection of
invoices (for receipt information) and filed hard copies (to locate grants) could be used. The
consequences of the database being unavailable would be viewed as an inconvenience but
does not require a robust business continuity plan for continued access. The extra
manpower required to manually prepare the reports would be less than $100,000 since, at
worst, a contractor could be hired to prepare the most important reports for less than that
amount.
Research Data: Medium
The research data does not need to be available 24 hours, but the information should be
available when the principal investigator is preparing the final research report. A service-
level agreement (SLA) and uptime schedule will be provided to researchers upon gaining
approval to use the application.
QuickBooks: Medium
The information in the QuickBooks database needs to be available on paydays (every
Friday). Hard copies are made of the information and stored in a filing cabinet, but that
information may be dated.
