St. John Health System Selects Preventsys to Ensure HIPAA Security Policy Compliance

Business Wire, August 30, 2004

CARLSBAD, Calif. -- Preventsys Also Assesses Critical Medical Devices for Vulnerabilities and Patch Status, Providing an Unprecedented View into the Security Exposures Caused by Unpatched Systems

Preventsys Inc., a pioneer in enterprise security management, today announced that St. John Health System has selected its Enterprise Security Management system to ensure HIPAA policy compliance and to track the remediation workflow actions across its diverse IT network. Preventsys' system dramatically improves network security and reduces costs by automating the traditionally manual processes of network auditing, policy development and compliance, remediation management and reporting.

"The ability to immediately apply and begin enforcing a ready-made HIPAA security policy guideline was a key reason why St. John chose Preventsys," said Mike Reeves, chief information officer for St. John Health System. "The Preventsys management platform took a time-intensive, inefficient, manual process for tracking remediation and automated it. Now our IT administrators can manage and maintain the remediation process on more than 180 mission-critical patient care and administrative systems with ease."

Based in Tulsa, Okla., St. John Health System is comprised of St. John Medical Center and affiliated physicians' offices, outpatient facilities and medical institutions, connecting thousands of users at dozens of locations. The fact that these facilities are geographically dispersed posed a distinct challenge for the IT security group.

"HIPAA compliance is a top concern for security and IT departments in the healthcare field and Preventsys is acutely aware of the management and policy challenges that these departments face on a daily basis," said Tom Rowley, chief executive officer for Preventsys. "St. John Health System was able to benefit from Preventsys' ready-made HIPAA security policy guidelines and see a dramatic improvement in their remediation workflow process -- no more spreadsheets and long email threads to sort through. Now details on vulnerabilities, patches and policy conformance are centrally located and automatically updated, and we've introduced a new level of tracking and accountability."

Preventsys also gives St. John the ability to assess critical medical devices for vulnerabilities and updated patch status, then send Preventsys' data on how to fix those vulnerabilities to the system administrators so that a patch can be implemented. Currently, customers are prohibited from patching medical equipment by many vendors, and the depth of security exposure created by unpatched systems wasn't completely understood until Preventsys.

The Preventsys Enterprise Security Management system integrates security facts from multiple data sources, such as network vulnerability, wireless and application scanners, with configuration information from network devices or hosts across multiple platforms to provide a complete and accurate picture of what is on the network. Once vulnerabilities and configuration violations are found, Preventsys' cross-system workflow and automated regression testing enables the IT operations team to prioritize and manage mitigation efforts. The scalable, distributed enterprise software system also includes a CISO-level drill-down dashboard, auto-classification of assets and detailed customizable reports.

About Preventsys

Preventsys Inc. is a pioneer in providing enterprise security management systems for large, distributed organizations. Its innovative and award-winning technology dramatically improves network security and reduces costs by automating the traditionally manual processes of network auditing, policy development and compliance, remediation management and reporting. Preventsys is a privately held company founded in 2002 with more than 40 employees and venture funding from Enterprise Partners, Apax Partners and UV Partners. Preventsys is headquartered in Carlsbad, Calif., and has regional offices in across the U.S. For more information, please visit the company's Web site at www.preventsys.com or call 760-268-7800.