RRD Healthcare IT Security Platform

• Clearly defined incident response measures

  Clearly defined incident response measures

  If security incidents do arise, RRD is ready to respond rapidly and effectively. Our well defined, documented and audited process addresses any incident as it occurs. Our staff is specifically trained in incident response to properly guide operations teams and engage appropriate external parties as necessary.

• Rigorous and frequent third-party auditing

  Rigorous and frequent third-party auditing

  Each year, we undergo approximately 350 on-site customer security audits and more than 800 written risk assessments. RRD’s annual SOC2+HITRUST CSF report attests to RRD’s compliance with HITRUST CSF controls and three of the AICPA Trust Services Criteria.

• Comprehensive security and compliance

  Comprehensive security and compliance

  RRD has a dedicated security and compliance team managing and monitoring all security controls, audits, assessments and incidents. Our security and compliance program is built on the internationally recognized frameworks of NIST CSF and the three AICPA Trust Principles of Data Security, Data Confidentiality, and Data Availability.

  Our framework also maps to specific healthcare regulatory legislation including but not limited to:

  • Health Insurance Portability and Accountability Act (HIPAA)
  • EU General Data Protection Regulation (GDPR)
  • Canadian Personal Information Protection and Electronic Documents Act (PIPEDA)
  • Payment Card Industry Data Security Standard (PCI DSS)
• Continuous systems monitoring and protection

  Continuous systems monitoring and protection

  RRD networks are designed and implemented with appropriate trust boundaries to control access to sensitive data. RRD’s Security Operations Center (SOC) provides 24x7 monitoring of a wide variety of information from various platforms identifying and acting on potential security events.

  We also routinely assess our systems and applications for vulnerabilities, adhering to strict patch management protocols.

• Leading technology, world-class service, peace of mind

  Leading technology, world-class service, peace of mind

  RRD partners with leading data security providers, delivering solutions that provide ongoing resiliency against the threats you face. From data center service partnerships that ensure access to backup and failover environments at geographically dispersed locations, we deliver around-the-clock account service customized precisely to your needs.

• Secure facilities, stringent standards

  Secure facilities, stringent standards

  RRD only processes member data in facilities approved to handle confidential and private information. Facility employees must wear visible identification at all times and are monitored with video surveillance in production areas where private or confidential work is carried out. All systems access is granted on a least-privilege basis to confirm that staff has access only to data relevant to their job.

• Rigorously-screened and highly-trained workforce

  Rigorously-screened and highly-trained workforce

  Our IT workforce spans the globe to accommodate your needs. All job applicants are carefully screened — particularly those applying for positions requiring access to private or confidential information.

  Our application process includes thorough background checks and nondisclosure agreements detailing security and legal responsibilities. Once hired, team members receive ongoing job-specific training as well as security awareness training.

Premier Data Privacy Program

For any communications services organization, a focus on data privacy is equally critical as a focus on data security and compliance. The depth, breadth, and consistency of RRD’s security program is matched by its privacy program.

• Staffed for privacy, globally
  Staffed for privacy, globally

  RRD maintains a global staff dedicated to managing our privacy obligations, including a Chief Privacy Officer, regional Privacy Managers, and in-house legal counsel with special knowledge on privacy regulations and concerns.

  RRD also has ongoing relationships with external legal firms specializing in privacy matters. We are engaged with and a corporate member of the International Association of Privacy Professionals (IAPP).

• Incident response
  Incident response

  RRD’s Global Incident Response Program is designed with the understanding that any adverse event involving sensitive customer data is likely to have security, regulatory, and privacy components and addresses all aspects with equal diligence.

  In fact, RRD offers services to our customers to assist with data breach notifications procedures and communications resulting from data exposure incidents within their organizations.