Blog 8 - Data Security & Encryption with Verisense

The 8th edition of our blog series focuses on the importance of Data Security and outlines the measures the Verisense platform employs to protect the data of our users.

We are all familiar with high profile data breaches that have proven costly. In this ever increasing digital world, there are few industries left unaffected by the potential harm of massive data breaches.

Healthcare data in particular is a key target for hackers. The sensitive nature of health records makes them all the more valuable. A recent study produced by Seh et al, 2020(1) outlined how since 2005, the healthcare industry has faced the highest number of data breaches among all industries. Usually, a data breach would fetch $8.19 million, however, the average cost of a healthcare data breach (average breach size 25,575 records) in the USA is $15 million(2).

In this context, data security is a huge consideration for vendors providing equipment into a clinical setting. Verisense employs a number of key security features that limits exposure to a data breach to the absolute minimum.

Verisense Architecture

The Verisense Sensor sends data from the Sensor to the Verisense Base Station. The Verisense Base Station (Android Smartphone) acts as a communication gateway to upload data to the Verisense Cloud Web Portal, using Wi-Fi or a data network. Amazon Web Services (AWS) is the data hosting platform.

The safe passage of data from one component of the system to the next relies heavily on the following security features.

a) End to End Encryption

All Verisense data is end to end encrypted. This method encrypts all data as it is created and added to the Verisense system. Data can only be deciphered at the end of its journey by authorized personnel, approved by the Trial Manager.

Shimmer uses the AES (Advanced Encryption Standard)-256 method, which is regarded as the go-to standard for encrypting data. AES-256 is widely trusted by top governments and the world’s largest organizations to secure their valuable data. AES is generally considered invulnerable to all attacks except for brute force. To date there are no publicly known methods for cracking AES-256.

b) No Personal Identifying Information (PIDI)

No PIDI of Trial Participants is ever stored on the system. When adding participants to the Verisense system, operators are instructed to add the Participant ID of that person. No other participant information such as medical information, date of birth, address or contact details is ever added to the Verisense system. Only a unique identifying ID is required to add Trial Participants.

c) AWS Identity and Access Management (IAM)

As AWS is the default hosting platform for all Verisense data, we are able to leverage AWS Identity and Access Management (IAM) to ensure only authorized personnel are provided with access to Verisense data. AWS IAM has numerous features such as users, groups and permissions to allow flexibility in the access and actions different personnel can perform. Further details on AWS IAM can be found here.

d) Bluetooth 5

Data from the Verisense Sensor is sent to the Base Station using Bluetooth 5. A unique ID, created by the Trial Operator, is required to pair a Verisense Sensor with a Base Station, and thus enable the Sensor and Base Station to communicate.

A further feature is the use of an algorithm generated 6 digit pin required to access the Bluetooth protocol. Not even Operators of the Verisense system have access to this pin. This feature further secures data being transferred via Bluetooth 5 to ensure it can only be accessed in a secure location controlled by AWS IAM.

e) Uploading Data to AWS

With the Verisense System, Sponsors have two options for how they wish to upload data from the Verisense Base Station to AWS.

1.      Via Data Network/SIM Card

From a data security standpoint, this is the recommended option. Shimmer can select the URLs the SIM Card can communicate to i.e. only allow connection with the the AWS hosting platform. All other websites can be restricted. This greatly reduces the possibility for data to be ported elsewhere.

2.      Via Wi-Fi Network

Users may wish to upload data via Wi-Fi Networks to reduce the costs of data network charges. Uploading via Wi-Fi is less secure, but if using this method its recommended to only upload via a secured, password protected home Wi-Fi network, not publicly open Wi-Fi networks.

f) Instant Removal of Data from Devices

Data on the Sensor is removed once transfer to the Base Station is complete. Similarly Data on the Base Station is deleted once upload to the AWS server is confirmed.

As the above measures highlight, data security was at the forefront of the system design when developing the Verisense platform. From liaising with various stakeholders in the Clinical Research landscape it was clear that this was a key requirement if the adoption of wearable sensors in wide scale Clinical Trials was to be successful.

While we believe the current measures employed make the Verisense platform as secure as reasonably possible, we are continually monitoring new advancements in this space. We also have the capability to add bespoke security measures for customers on request.

*Verisense is registered as a CE Medical device in Europe - Class I CE Certified (22286). Verisense is FCC approved and CE marked. Verisense is manufactured to ISO 13485:2016 Medical Device Quality Standards by Shimmer Research Ltd.

1 - Seh, A. H., Zarour, M., Alenezi, M., Sarkar, A. K., Agrawal, A., Kumar, R., & Khan, R. A. (2020). Healthcare Data Breaches: Insights and Implications. Healthcare (Basel, Switzerland), 8(2), 133. https://doi.org/10.3390/healthcare8020133

2 - . 2019 Cost of A Data Breach Study Reveals Increase in U.S. Healthcare Data Breach Costs. [(accessed on 29 October 2020)]; Available online: https://www.hipaajournal.com/2019-cost-of-a-data-breach-study-healthcare-data-breach-costs/