Global 500 Pharmaceuticals Company

A Global 500 pharmaceuticals company selected PKWARE to address data tracking and custom masking under GDPR and HIPAA. It protects personal data, healthcare information and confidential files through a mix of access control, encryption and masking. It reports data security increased by 75 to 90 percent, with 50 to 75 percent of the time previously spent on manual protection returned to other work.

Background

This case study of a Global 500 pharmaceuticals company is based on a December 2020 survey of PKWARE customers by TechValidate, a third-party research service. The profiled company asked to have their name blinded to protect their confidentiality.

The source is a December 2020 TechValidate survey and the company is not named. The percentages are best read as the customer’s own assessment rather than a measured benchmark; what they establish is the direction and the rough magnitude of the change the organization observed.

Challenges

The business challenges that led the profiled company to evaluate and ultimately select PKWARE:

• Data tracking (discovery/classification)
• Custom data masking

The compliance measures that most influenced their decision to use PKWARE solutions:

• GDPR
• HIPAA

With PKWARE’s data security technology, I have confidence that we are meeting our data compliance goals.

Discovery and masking appear together for a reason in this sector. Pharmaceutical work generates data that is neither wholly clinical nor wholly commercial, including trial records, adverse event reports and patient support programs, and a single file may contain both kinds. Knowing which is which is a prerequisite for masking anything, because a rule applied to the wrong field either exposes data or destroys a result.

Our Approach

Met audit and compliance requirements – Eliminated fines and fees associated with breaches – Improved protection of PI/PII.

Download PDF

Use Cases

The company protects these data types with PKWARE:

• Personal data (SSNs, race, religion, minors, etc.)
• Healthcare information
• Confidential files

They protect the data uncovered by PKWARE’s data discovery using:

• Access Control
• Encrypting
• Masking (redaction, de-identification, etc)

They also use PKWARE functionality for data security with data protection (masking or encryption).

GDPR and HIPAA overlap without agreeing. HIPAA governs protected health information held by covered entities and their business associates. GDPR governs personal data of people in the European Union regardless of sector, treats health data as a special category, and adds rights that HIPAA does not, such as erasure. A company operating under both needs classification granular enough to tell which rule applies to a given record, rather than applying the strictest rule everywhere.

Results

The immediate benefits they experienced following the deployment of PKWARE include:

• Met audit and compliance requirements
• Eliminated fines and fees associated with breaches
• Improved protection of PI/PII

They increased their data security by 75 – 90% since implementing PKWARE technology.

They saved 50 – 75% of time previously spent by moving from manually applied protection to PKWARE’s automated discovery and protection solution.

Eliminating fines and fees associated with breaches is listed as an immediate benefit, which is a claim about avoided cost rather than recovered cost. The mechanism is straightforward. Data that has been masked or encrypted at rest generally falls outside the scope of breach notification, so an incident touching it carries neither the penalty nor the notification burden.