What was the scope of their involvement?
We started building this website from scratch. We built it internally with our IT people, and FRSecure definitely consulted with us on how to build it. Once we made certain pieces, we would circle back with them for tweaks so that the finished product would be extremely secure and built the right way. For PCI compliance—which is needed for any website that's going to be collecting credit card information—they made sure that we had a secure payment gateway that was integrated correctly within our site. They also helped us on the policy side of things by explaining rules and regulations and making sure that we knew exactly what to expect from a compliance standpoint. They promoted a secure environment as we were building the website, rather than waiting until the end.
The team from FRSecure included a handful of really great guys. John [VP of Operations, FRSecure] was our first point of contact. Then, John and Steve [Senior Sales Consultant, FRSecure] helped us understand the scope based on our needs and directed us to the right people within the team. Ryan [Solutions Engineer, FRSecure] and Tim [Information Assurance Analyst, FRSecure] were incredibly knowledgeable and really bright guys. They can talk the techie lingo but are able to explain it in a way that non-techie people can understand. We also had an account manager who would set up meetings and sit in to understand what we’re about, what we’re trying to do, and facilitate our needs there. Now, we’re working with Derek [Security Consultant, FRSecure]. He's been responsive and really helped us understand what we're doing as well.
How did you come to work with FRSecure?
We did our own research online, starting with Minnesota and spreading as far as California. We looked at 15 companies. We came across FRSecure’s website fairly quickly and definitely were impressed in the first go-round. We really liked their website and message, and they seemed very professional from the start. From there, we talked to John and got a very good first impression, so we went with FRSecure.
How much have you invested with FRSecure?
Over the last 3 years, we’ve spent around $15,000–$20,000, probably closer to $15,000. They will continue working with us throughout the rest of this year. We’re going to be rolling out some new features to our website to support patient-to-practitioner messaging, which has to be HIPAA-compliant as well. If somebody talks about having a certain disease or condition, you've got to follow that HIPAA compliance protocol. We plan to double our budget over the next year, spending close to $30,000 by 2018.
What is the status of this engagement?
We started working with FRSecure almost 3 years ago. The platform is live. We launched trailheadhealth.com in December or January of this year. As with any complex website, you're going to have bugs that you can only learn about later. Once we launched, we made changes and talked with FRSecure to make sure that our tweaks are still in line with our security priorities. They have also done audits since the launch, and we explored some penetration testing, which went well. They reviewed the entire structure of our business and have been very helpful.
The internal team's security posture increased by 75% using the FISA scoring methodology, from 483 to 702. FRSecure utilizes a comprehensive framework to successfully evaluate the security of their client's systems. The team is thorough and hard-working.