Protecting Partners, Members with Secure Solutions

Data breaches are becoming increasingly common, and the healthcare space is not immune.

At FEI, we know working with a new vendor requires a high level of trust that your programs and member data will be safe from security threats as you transition to, implement and use new platforms and solutions.

With FEI Systems, you can be confident your data meets industry conditions and standards for information security and client privacy. Our solutions comply with a large variety of federal and state laws, regulations, security standards, and corporate policies. Additionally, the Blue Compass platform is hosted in FEI’s Amazon Web Services (AWS) cloud, one of the most flexible and secure cloud computing environments today.

Managing and Mitigating Risk

FEI maintains an annual SOC 2 Type 2 independent audit report, demonstrating our ability to meet key regulations and industry-defined requirements while appropriately managing risk. FEI’s SOC 2 Type 2 report comprises all five (5) Trust Service Criteria (Security, Confidentiality, Processing Integrity, Availability and Privacy) as defined by the American Institute of Certified Public Accountants (AICPA).  Additionally, FEI’s internal security controls were designed and implemented to align to industry leading security frameworks such as:

• HIPAA Security Rule
• NIST Special Publication 800-53
• ISO 27001/2

Supporting Partners with Regular Staff Training, QA

FEI employees and consultants/contractors working on our projects receive yearly HIPAA training. Further, as part of FEI’s formal audit program, FEI contracts an independent assessment firm to produce our annual SOC 2 Type 2 report for our clients.   The combination of FEI’s formal audit program and satisfying our customers external audit requirements provides assurance that FEI is continually being assessed and diligently being active in safeguarding our products and customer data.

Additionally, we have the following assessments conducted on an annual basis:

• SSAE 16 SOC 2 Type II: FEI hosts the solution in AWS, which conducts SSAE 16 SOC 2 Type II annual audits and is ISO 27000 and FEDRAMP certified.
• Penetration Testing: On no less than an annual basis, we engage an independent third party to perform both internal and external network penetration tests, activities that include physical and logical social engineering.
• Organizational IT Certifications: FEI has also earned CMMI ML3, ISO 20000 and ISO 9001:2015 (PMO only) certifications, which require annual third-party assessments and attest to the maturity of our information security program, systems development, and overall IT operations.