CMS zips up sensitive data for security in transit

Every year, the Centers for Medicare and Medicaid Services process about 1.25 billion Medicare claims, 1 billion prescription claims and 1 billion Medicaid files, along with claims for Children’s Health Insurance Programs — all on behalf of more than 90 million Americans.

“We’re a very large health insurer with a public health mission,” said Julie Boughn, director of the Office of Information Services and chief information officer at CMS. “We send and receive vast quantities of health care data.”

The data is not only voluminous but also a valuable public asset, she said. “Since we have so much of it, there is a lot of interest in using our information” for activities such as medical research and fraud investigations.

In this report:

Sharing data with many partners requires a common encryption platform

Some of the data is scrubbed of personally identifiable information and made available publicly for statistical purposes. Medical researchers often do not need to know the identity of the people whose information they are using, but some details are necessary to correlate data. On the other hand, law enforcement investigations typically require full information.

CMS has strict requirements for how partner organizations use data, and officials spell out the required levels of protection. But it is not enough for CMS’ partners to handle the data securely — CMS has to ensure that the information is secure while in transit.

That is not a simple task. The list of partners sending and receiving CMS information includes all 50 states and numerous health care providers and research institutions, each of which use different information technology systems.

When the Office of Management and Budget mandated that agencies secure data on mobile and portable devices in 2006, “we took that very seriously,” Boughn said. “We had already started down that path” by encrypting laptop PCs and using Pointsec to encrypt e-mail messages and data on USB drives.

As for data shared with partners, “I said I was not shipping any data out of our data center that is not encrypted,” Boughn said.

But that approach had unintended consequences. CMS is a mainframe shop, with IBM hardware that can encrypt data transferred to other media, such as the tape cartridges the agency sends to its partners. However, those recipients use everything from mainframes to servers and desktop PCs to access that data.

“We could send them encrypted [data], but the recipients might not have any way to decrypt it,” said Ray Pfeifer, senior technical adviser at CMS’ Office of the Chief Information Security Officer.

As a result, tapes full of data that other users needed were piling up at the data center. “I said there has to be a way to encrypt data on any type of media and provide a capability at the other end to decrypt it,” Boughn said.

CMS officials eventually settled on PKware’s SecureZIP PartnerLink for the task. The company does not provide an engine or algorithms for encrypting data, but it offers a platform for encrypting data and a virtual container in which to ship it.

“We do not consider ourselves an encryption company,” said George Haddix, PKware’s chairman and chief executive officer. “We deliver products that allow people to use encryption in managing their data. The Zip archive, I think, is an ideal container for data-centric security.”

PKware maintains the Zip data compression and archiving format, which works with most computing platforms. Many organizations have used it for years to transmit and store files. The Zip archive container includes metadata about the files so users can identify and individually retrieve them.

“We developed the concept about four years ago that this could be done in a secure manner by encrypting, signing or otherwise authenticating the files contained in the container,” Haddix said.

The company implemented the concept by extending the Zip archive definition to include the ability to use a strong password or pass phrase for access control and digital certificates for signing or encrypting the data being compressed.

The PartnerLink package requires customers to license the enterprise version of SecureZIP. Customer-sponsored partners can then download free software to decrypt and encrypt files using digital certificates that the customer provides. The 50 states are also preparing to send their data securely to CMS via PartnerLink.

SecureZIP can also be used with existing engines, and many mainframe customers, including CMS, use the hardware engines on their existing equipment’s co-processors.

“We’re taking advantage of that because it speeds things up,” Pfeifer said. The encryption engines are certified to meet Federal Information Processing Standard 140-2 for government encryption modules. CMS uses the Triple Data Encryption Standard.

Another advantage of using SecureZIP to encrypt files for transit is that it also compresses the files by about 80 percent, an important consideration when dealing with the huge volumes of data CMS routinely sends. Using SecureZIP, a shipment of 25 tape cartridges can be compressed to five, Pfeifer said.

One issue recipients of encrypted data need to keep in mind is the format in which it will be used. Many recipients convert the mainframe data for use on other platforms, such as servers and desktop PCs. SecureZIP supports conversion from one format to another, “but you have to be aware you are doing the conversion of encrypted data at the other end,” Pfeifer said.

Overall, the tool is user-friendly, and customer support from PKware has been good, he said. “The time it takes for installation [ranges] from less than an hour for users of Windows to a few hours for a mainframe,” he added.