PREMERA BLUE CROSS, MOUNTLAKE TERRACE, WA

Keeping Pace at Premera Blue Cross

Four years ago, Premera Blue Cross designed a new architecture to provide secure internal and external communications, as well as eliminate charges for Internet access attained through modems and dial-up services. The network engineering team at Premera chose Content Technologies' MAILsweeper for email security. That foresight has paid off immeasurably by protecting the network against viruses and malicious code, restricting inappropriate uses of the email system, and effectively managing network bandwidth. Premera's use of MAILsweeper also prepares the company for compliance to the strict health care information security and confidentiality regulations being imposed on all health care organizations by the Federal Government's Health Insurance Portability and Accountability Act (HIPAA).

A Half-Century of Health Care

Serving residents of Washington and Alaska for more than 50 years, Premera Blue Cross offers health care coverage to over 1.2 million members through its affiliate health care plans ¾ Premera Blue Cross, Premera HealthPlus, MSC Blue Cross, StatesWest Life, LifeWise (Oregon) and Blue Cross Blue Shield of Alaska. With more than 17,000 hospitals, physicians, and other providers offering services, Premera Blue Cross is one of the largest health care organizations in the state of Washington. Yet size hasn't impinged upon quality. Recently, Premera's managed care plans earned an Excellent Accreditation from the National Committee for Quality Assurance. Headquartered near Seattle in Mountlake Terrace, Premera has satellite offices in Seattle, Spokane and Kennewick, Washington, Portland and Bend, Oregon and Anchorage, Alaska. The pace of Premera's progress is rapid.

Foresight at the Firewall

As Premera grows, so do its business security needs. Four years ago, Premera's connection to the "outside world" was primitive (Compuserve and modems). There was virtually no control over security and viruses could easily infect the organization's computers. In 1996, a Checkpoint firewall was put into place and a suite of anti-virus products installed. To ensure the security of email, Premera installed the MIMEsweeperä solution. Content Technologies' Stacy McBride, account manager for Premera, says, "They're a leader in their field. Four years ago, health care organizations simply weren't thinking about email security."

Premera now runs MAILsweeper version 4.1 on a dedicated server. Together with five Microsoft Exchange Servers, SMTP services are provided through a combined Novell NetWare and Windows NT network over TCP/IP with approximately 4,000 nodes. The company chose this configuration to minimize impact to all services in case of malfunctions or scheduled downtimes.

Email Swept Clean

There are two groups in the network engineering team at Premera. One of these oversees the infrastructure and WAN, the other the servers. Systems engineer Jon Adams works on the server team. He uses MAILsweeper on the email servers to ensure business integrity, preserve network resources, and protect against viruses.

Jon cites the great degree of control over viruses and their variants that MAILsweeper gives the company. Without MAILsweeper, he notes, "we would be continually infected with all manner of VB script variants. Because we quarantine and/or park all documents and binary files for comparative analysis, we have also successfully detected and blocked patterns that relate to macro-based mass mailing' viruses ¾ for example, the Melissa viruses which accessed global and local users' local address lists to spread virus-infected email messages without the users' knowledge."

In addition to protecting Premera's network from viruses, MAILsweeper manages messages that could clog the company's network or reduce employee productivity. Jon has created policies to catch and destroy junk mail or screen selected email attachments. For example video and sound files over a certain size are blocked, while other files larger than a specified size are parked for delivery when network activity is low. These policies are instrumental in the network engineering team's efforts to keep IT infrastructure costs down.

Supporting Company Policies

Business policies drive the growing uses for MAILsweeper at Premera. Karen Costle on Premera's network engineering team administers the Exchange servers. She will soon be creating MAILsweeper reports for department managers who are determining employee policies on email content and use. MAILsweeper's flexible Graphical User Interface allows the team to quickly implement and update security policies as administrative policies are developed and updated.

Forward into the Future

The full impact of MAILsweeper at Premera is yet to be realized. Upcoming government regulations set by the Health Insurance Portability and Accountability Act (HIPAA) will require that health care organizations protect the security and confidentiality of electronic health information. At Premera Laurie Lueck is developing enterprise-wide policies to meet these standards within the next two to three years. She plans to use MAILsweeper to scan for literals in email; for example, detecting a subscriber name near a diagnostic code would be a "red flag."

Premera will soon install another product in the MIMEsweeper family from Content Technologies. Jon Adams plans to use WEBsweeper to control Internet access, detect and protect against harmful Java and ActiveX controls, and block certain types of traffic. "MAILsweeper will be a keystone of our HIPAA compliance efforts," notes Laurie.