Every practice we have examined holds patient data somewhere it never meant to: a batch of scans on a desktop, an extract somebody produced for an audit in 2021, a spreadsheet of balances with dates of birth sitting in column D. Two lines here. The first goes looking and comes back with a number. The second decides what may happen to whatever was found.
Sweeping machines and shares for regulated material hands a practice something it rarely has: a ranked list. Not a general unease about patient data, but a specific statement that the reception desktop is holding nine thousand records in scanned batches while the laptop in the back office holds forty in an old extract. Ranking by exposure is what converts an uncomfortable subject into a plan with an obvious first job.
Scoring also produces something a carrier will accept. Cyber insurance questionnaires now want to know how much regulated data you keep and where it sits, and replying with a measurement instead of a guess changes the tone of that conversation considerably.
Once the material has been located, the second line takes over: encryption applied to what is sensitive, and rules on the ways data leaves, which inside a clinic means memory sticks, personal cloud accounts and outbound mail far more often than anything ingenious.
We would rather be direct about the sequence. Enforcing without searching first means writing rules over ground nobody measured, and that ends either in a control everybody routes around or in one that halts clinical work. Search first. Every time.
Every figure below arrives from the billing system while this page opens. Whatever you add sits waiting in the panel while you keep reading.
Goes looking for regulated and sensitive material across whatever you enroll, works out which category it falls into, counts it, and scores each machine so that remediation has somewhere obvious to begin.
| Built on | Actifile |
|---|---|
| Examines | Machines and the file shares attached to them |
| Finds | Health, financial and identity material sitting at rest |
| Produces | Record counts plus a per machine score |
| Handy for | Insurance questionnaires and scoping your own risk analysis |
| Counted in | Devices, monthly |
Encryption over sensitive files, plus rules on the routes data uses to leave. Meant to run after the search, so the rules are written against ground that somebody has genuinely measured.
| Built on | Actifile |
|---|---|
| Does | Encryption at rest and rules over the exit routes |
| Routes | Memory sticks, personal cloud accounts, outbound mail |
| Order | Runs after the search, over measured ground |
| Suits | Practices carrying records on hardware that travels |
| Counted in | Devices, monthly |
Data protection is the layer most frequently oversold, so this list runs longer and blunter than the others.
Heads up: card statements show FORTIFY 24X7 - Patient Data Armor is a Fortify 24x7 brand, and your subscription is billed by Fortify 24x7.