SP Central Workflow System Security Overview

System Security Features

User Authentication

• Windows Operating System and Application Security Configuration based on Defense Health Agency (DHA) and Center for Internet Security (CIS) standards STIGs
• Kiosk-mode system; user access is limited to SP Central UI
• User-specific customizable role-based access for pharmacy user accounts
• Configurable time-out period for logged-in users
• Transaction logs identify actions performed by users
• Logging, including OS, Application, User, Remote Access, and Security
• Antivirus Software*
• Host Based System Security (HBSS)*

• Optional screen saver launch, requires access confirmation with valid security credentials to access SP Central UI
• SP Central supports individual user accounts for pharmacy staff and system administrators
• Kiosk mode enforces user authentication for configured user actions at the terminal (fill, verify, dispense, access a Patient Profile, run a report, etc.)
• Operator authentication options:
  • System-generated operator ID barcode/Personal Identification Number (PIN)
  • High-security parameters enforcing username and password
  • Multi-factor authentication support with customer-provided CAC or PIV cards
• Password rotation at 90-day intervals and requires the latest password to differ from five previous passwords
• Complex passwords with a minimum number of characters and include at least one letter, 1 number, and one symbol (!@#$%^&*)

Remote Access

Automated Updates

• Remote support access traffic utilizes fully secure site-to-site IPSec VPN tunnel featuring AES256 level encryption
• Isolated and secure remote administration environment
• SP Central enforces a unique, expiring, and complex username and password and multi-factor authentication (via CAC) for each support person
• To align with HIPAA and Privacy Act standards, all ScriptPro remote support personnel undergo annual PHI, data handling training, VA, IHS, DoD, and security training

• Updates ScriptPro application software automatically
• Full Disk Encryption Key Management*
• Automated antivirus updates*
• Automated Windows patching
• Drug data and third-party insurance updates
• Automated Technical Support User Management (TSUM)

Standards and Certifications

Data Storage and Transmission

• HIPAA
• DHA Type accreditation with full Authority to Operate (ATO)
• VA Risk Assessment approval with full ATO
• ScriptPro corporate HITRUST Certification

• Full Disk Encryption*
• No data transmitted outside the hospital network
• Off-site backup files are compressed and encrypted*
• Private Key Infrastructure with SHA 256 CA in place
• PharmacyPro (available add-on product) uses Microsoft Azure App Services over HTTPS to allow secure access from mobile devices and web browsers; Microsoft Azure is certified and aligns with HIPAA and government ATO standards

Network and Firewall

• IPV/6 compatible
• SP Central installed on isolated VLAN or Demilitarized Zone (DMZ)
• Customer and/or ScriptPro-provided firewall used with customer-approved Access Control Lists (ACLs) to enforce separation and protection