HP Enterprise Services - DHHR

HPES Response to West Virginia MMIS Re-procurement RFP
4.1.10 Solution Alignment with BMS’ Business and Technical Needs
Each user will have a unique ID for accessing the system. The individual user will be allowed to access applications on the
system only after entry of a password with the correct user ID. User IDs are set up with role-based security, with the ability to
assign multiple roles to a user ID, which means users are limited to the functions they are allowed to perform. Our solution
meets Appendix D Requirement SP1.3 to support a user security profile to control user access rights to appropriate levels of
functions. For example, some providers may have inquiry access only while others will have the update capability necessary to
submit claims. Stakeholders are not provided access to a system they are not required to use. The logon process provides a
list of applications that are available. The only applications that are listed on this screen are those the stakeholder has been
granted access to use.
Provide Secure Email (Req. 8)
Email has become a cornerstone of electronic communication that delivers a range of operational benefits and efficiencies. We
use a careful selection process to make sure the COTS products—including email—and hardware specific to our security solution
integrate with the overall architecture and solution. The following table includes the secure email products HPES will use to
manage daily email demands, and those that require security encryption.
Email Software Products
Purpose Vendor COTS or Hardware
Account-Based Email
Gateway
Microsoft
Account (or healthcare-based) exchange email gateway (to
help route account based email by server for DLP)
Secure Encrypted Email HP Secure/Multipurpose Internet Mail Extensions (S/MIME)
Provide New MMIS User Access (Req. 9)
HPES will implement a comprehensive security management function across each application to provide authorized, rolebased
user access to systems and applications. HPES’ solution proposes implementing robust identity management controls—
including password management controls— designed to prevent wrongful use, access, and disclosure of sensitive information.
This extends to providing appropriate role-based MMIS access to new, authorized users.
We will follow established HPES procedures that include conducting required security checks and protocols for new staff
members. Access is granted using a security request form approved and sent to a security team for execution. HPES will
develop security request form procedures that provide detailed explanations for the access types listed on the form. Security
access will be provided within one workday of employment or notification. Users receive their IDs after HPES receives
appropriate authorization.
Terminate BMS User Access (Req. 10)
HPES will use our user access procedures and security request form to revoke access of terminated BMS users. The form will
be approved by an individual listed on an authorized submitter list and sent to a security team for execution. To protect the
integrity of MMIS confidential data, HPES will swiftly terminate access for terminated BMS users by the end of their last
business day and within one hour of notification by BMS.
Identify Email and Internet Spam and Scams (Req. 11)
Antivirus and anti-spam software and support will filter infected or “junk” email from the email server before posting to the email
users. The HPES team uses proven McAfee Endpoint Antivirus software for virus detection and control. The software is
configured to notify recipients on detection of an infected email. Our support teams will use features in McAfee to allow
administrators to authorize or block website access, promoting compliance.
Detect and Prevent Hacking and Intrusion (Req. 12)
HPES best practices dictate a multilevel security regime that provides high-speed firewall and intrusion detection capabilities
within each security zone. The policies governing the type of traffic that passes between the networks through the firewalls are
normally strict to increase performance and decrease the possibility of misconfiguration—which could inadvertently leave an
avenue for hackers and unauthorized users.
Intrusion detection sensors complement the firewalls at various points in each security zone by looking for specific profiles that
indicate suspicious activity. They can alert or respond to such events. In this way, Internet server farms are secured from
intranet and extranet server farms, external access gateways, and internal networks.
RFP # MED11014 Page 299