Press Release | Media on CrowdStrike
Back to Pressroom

CrowdStrike Falcon® Platform Achieves Independent Validation for HIPAA Compliance

CrowdStrike Falcon® is the First Next-Generation Endpoint Security Solution to Address Eight Key Technical Requirements

Irvine, CA – Sept. 21, 2016 – CrowdStrike, the leader in cloud-delivered next-generation endpoint protection, today announced that the CrowdStrike Falcon®™ Platform has been independently validated to assist healthcare organizations with compliance with the Health Insurance Portability and Accountability Act (HIPAA). The validation was provided in a report by Coalfire, a leading assessor for HIPAA, HITRUST, PCI, FedRAMP and other compliance standards across the financial, government, industry, and healthcare industries.

HIPAA is an act passed in 1996. Title II of HIPAA provides regulations and guidelines for maintaining the security and privacy of individually identifiable health information. According to this independent report, “the CrowdStrike Falcon® platform capabilities in detection and responding to threats, and associated collection of activities makes CrowdStrike a suitable solution for addressing a number of key technical requirements in the HIPAA Security and Privacy Rules.”

Coalfire has determined that CrowdStrike Falcon® with its powerful unified combination of next-generation antivirus and endpoint detection and response (EDR) capability and managed hunting addresses unprecedented eight requirements, namely:

45 CFR 164.306(A)

  • Ensure the confidentiality, integrity, and availability of all electronic protected health information the covered entity or business associate creates, receives, maintains, or transmits.
  • Protect against any reasonably anticipated threats or hazards to the security or integrity of such information.
  • Protect against any reasonably anticipated uses or disclosures of such information that are not permitted or required under subpart Eof this part; and
  • Ensure compliance with this subpart by its workforce.

45 CFR 164.308(a)(1)(ii)(B)

  • Implement security measures sufficient to reduce risks and vulnerabilities to a reasonable and appropriate level to comply with § 164.306(a): Security Standards, Administrative Safeguards

45 CFR 164.308(a)(1)(ii)(D)

  • Implement procedures to regularly review records of information system activity, such as audit logs, access reports, and security incident tracking reports.

45 CFR 164.308(a)(5)(ii)(B)

  • Implement procedures for guarding against, detecting, and reporting malicious software.

45 CFR 164.308(a)(5)(ii)(C)

  • Implement procedures for monitoring login attempts and reporting discrepancies.

45 CFR 164.308(a)(6)(ii)

  • Identify and respond to suspected or known security incidents; mitigate, to the extent practicable, harmful effects of security incidents that are known to the covered entity or business associate; and document security incidents and their outcomes.

45 CFR 164.312(b)

  • Implement hardware, software, and/or procedural mechanisms that record and examine activity in information systems that contain or use electronic protected health information.

45 CFR 164.404(b)

  • A covered entity shall, following the discovery of a breach of unsecured protected health information, notify each individual whose unsecured protected health information has been, or is reasonably believed by the covered entity to have been, accessed, acquired, used, or disclosed as a result of such breach.
  • Breaches treated as discovered.

According to a recent Forrester report, titled ‘Healthcare’s IoT Dilemma: Connected Medical Devices,’ “The healthcare industry suffered more data breaches in 2015 than any other sector, with more than 100 million people directly affected in the US alone. This increase has been driven by the increasing underground value of medical records — now worth 10 times more than credit card numbers.”[1]

“The CrowdStrike platform is increasingly being adopted in the healthcare sector as the leading endpoint protection solution to stop breaches. With this expert report, current and future customers can better understand how to leverage the technology to meet HIPAA requirements,” said Colin Black, CrowdStrike’s chief information officer. “HIPAA spells out a number of specific requirements related to vulnerability management, threat detection and response, as well as breach discovery and reporting. CrowdStrike Falcon® is the most comprehensive and effective platform to provide unified prevention, detection, visibility, and response to equip healthcare organizations and the constituents they serve with the best security protection possible and enable them to seamlessly meet required compliance standards.”

As part of its next-generation endpoint protection technology, CrowdStrike uses powerful signatureless machine learning algorithms and Indicators-of-Attack (IoA) based threat prevention to identify and block known and unknown threats. In addition, CrowdStrike Falcon® provides enhanced visibility within its endpoint detection and response (EDR) solution. It records all activities of interest on an endpoint for deeper inspection — on the fly and after the fact — allowing users to quickly detect and investigate attacks that passed through traditional prevention mechanisms. CrowdStrike Falcon®’s unique cloud based architecture allows for fast deployments and unparalleled efficacy and scalability.
 

About CrowdStrike

CrowdStrike is the leader in next-generation endpoint protection, threat intelligence and response services. CrowdStrike’s core technology, the CrowdStrike Falcon®™ platform, stops breaches by preventing and responding to all types of attacks – both malware and malware-free. CrowdStrike has revolutionized endpoint protection by being the first and only company to unify three crucial elements: next-generation antivirus, endpoint detection and response (EDR), and a 24/7 managed hunting service — uniquely delivered via the cloud in a single lightweight sensor. Falcon uses the patent-pending CrowdStrike Threat Graph™ to analyze and correlate billions of events in real time, providing complete protection and five-second visibility across all endpoints. The company leads threat prevention with its potent combination of signatureless machine learning and behavioral-based analytics.

Many of the world’s largest organizations already put their trust in CrowdStrike, including three of the 10 largest global companies by revenue, five of the 10 largest financial institutions, three of the top 10 health care providers, and three of the top 10 energy companies. CrowdStrike Falcon® is currently deployed in more than 176 countries.

We Stop Breaches. Learn more: https://www.crowdstrike.com/

Follow us: Blog | Twitter

 

Media Contact:
Ilina Dimitrova
CrowdStrike
202.340.0517
Ilina.dimitrova@crowdstrike.com

 

[1] Forrester, “Healthcare’s IoT Dilemma: Connected Medical Devices,” by Chris Sherman, published on May 20, 2016