Encrypted database storage, mandatory MFA, and a complete audit trail — built for healthcare compliance.
A regional hospital network transfers patient records — lab results, imaging reports, and discharge summaries — between its main campus and three satellite facilities. HIPAA requires that protected health information (PHI) be encrypted both in transit and at rest, with a complete audit trail showing every access event.
The current system stores files on a shared network drive with folder-level ACLs. An annual risk assessment identified critical gaps: no encryption at rest, no multi-factor authentication, and no centralized audit log. The compliance team cannot produce the access reports that auditors and HHS investigators routinely request.
The receiving facilities need an easy way to pick up files without installing specialized software. IT needs to forward all access events to the hospital's Splunk SIEM instance for real-time monitoring and 7-year retention. And if an account is compromised, automatic lockout must kick in before an attacker can exfiltrate data.
Files are stored in an AES-encrypted H2 database — never on local disk. MFA is mandatory for all users. Every event flows to the SIEM in real time via syslog. The browser portal gives receiving facilities zero-install access.
Four configuration blocks address every HIPAA technical safeguard: encryption, access control, audit, and automatic lockout.
SSH encrypts data in transit. The H2 database encrypts data at rest with AES. No patient record ever touches an unencrypted disk. Cipher password secured in a PKCS#12 keystore with file-system ACLs.
TOTP-based MFA is enforced on every login — SFTP and web portal alike. Users enroll with any authenticator app. No hardware tokens to purchase or distribute.
Every connection, login, upload, download, and failed attempt is recorded and streamed to Splunk in real time. Generate the access reports HHS investigators require in seconds.
Account lockout triggers after 5 failed attempts. Locked accounts are flagged in the audit trail and the SIEM. IT gets an immediate alert, and the account is automatically unlocked after 30 minutes.
