Adventist Health System

Adventist Health System enforces security and HIPAA compliance policies across Office 365 and reins in shadow cloud usage

Our real concern is around controlling access to personal health information. By implementing Skyhigh, we have more visibility and more control over the usage of file sharing services
Mark Dunkerley
 Manager of Messaging, Mobile and Video Services

Adventist Health System Enforces Security and HIPAA Compliance Policies

Challenge

With 45 hospital campuses, Adventist Health System must follow strict HIPAA compliance requirements across a multitude of technology platforms. As part of an initiative to migrate all
 of their 70,000+ users from a legacy, on-premises Microsoft Exchange system to Exchange Online, Adventist Health System was presented with additional Office 365 services. One of the new services made available to users was OneDrive, which allowed them to share large documents, but gave them cause to consider their security, compliance, and risk, not just for Office 365, but for all cloud services. Anecdotally, they knew there were multiple file sharing solutions being used by employees and they first needed visibility into current cloud usage. “It really became a question of what are we using?” said Mark Dunkerley, Manager of Messaging, Mobile and Video Services. “We had quite a few questions about what other file sharing solutions were being used and by whom.”

Solution

Adventist Health System first deployed Skyhigh for Shadow IT to understand what cloud services were in use by category, starting with file sharing providers. Using Skyhigh, they discovered over 90 file sharing services in use. Adventist Health System used a combination of Skyhigh’s real-time coaching and coarse-level blocking to migrate users to OneDrive, their new corporate standard. With shadow IT under control, they moved to enforcing security, compliance, and governance policies for Office 365. With Skyhigh for Office 365 Adventist Health System gets additional security capabilities that include insider threat detection, contextual access control, on-demand scanning, and cloud activity monitoring, all without changing the accessibility or user experience. “Our real concern is around controlling
 access to personal health information. By implementing Skyhigh, we have more visibility and more control over the usage of file sharing services,” says Mark Dunkerley, Manager of Messaging, Mobile and Video Services.