Case Study: Healthy Connections

Computerworld - Spectrum Health Grand Rapids, Mich.
Who They Are: A large, regional integrated health care system serving 13 western Michigan counties and 1.38 million people.
Goal: To meet the new security requirements called for by the Health Insurance Portability and Accountability Act and to manage 5,000 independent (nonemployee) users.
Challenges: Spectrum has more than 60 locations in 13 counties, including seven hospitals. The network has to serve 12,000 employees and more than 1,000 independent physician's offices. Thus, minimizing risk was one of the primary concerns, says Jim Toth, director of technology services.
"While we could cobble together some [homegrown] solutions, we were constantly running into challenges in encryption, tunneling and protection of our protected network zone," says Toth. Without a VPN, Toth would have had to open up 50 ports into his network's protected zone, which would have been a very insecure approach.
Strategy: Toth chose technology from AppGate Inc. in Durham, N.C., that established a link between terminal emulation software and the client PCs. The AppGate product, based on the Secure Shell protocol rather than IPsec or Secure Sockets Layer, provides a tunnel at the application layer, not just the network layer, and includes 128-bit encryption.
"Automatically, we have a secure tunnel at the application layer where I wanted to have it," says Toth. "We really limit our points of access."
Issues: Even with assistance from vendors and service providers, Toth acknowledges that VPNs can be "fairly complex" systems to set up.
Payoff: "This was really a functional issue," says Toth. "It's not so much about saving money. I don't think I could have offered a solution without a VPN."

Read more about Security in Computerworld's Security Topic Center.