HIPAA + Zscaler =Securing Healthcare
How covered entities protect healthcare’s CIA
triad against cybercriminals with Zero Trust
Patients | Organizations | Cybersecurity | Providers | Enterprises© 2024 Zscaler, Inc. All rights reserved.

Solution Brief

Protect the security and confidentiality of patient data against
cybercriminals with Zero Trust
Network security breaches lower our confidence

Building on their Zero Trust Architecturein healthcare organizations, create chaos, andrecommendation from last year’s report, IBMdevastate patients’ lives. One flaw in a healthcare

designates modernizing data protection acrossprovider’s cybersecurity armor can expose weak

the hybrid cloud as a key step organizations cancybersecurity practices and sensitive patient datatake to prevent and reduce the cost of a data

to those who prey and profit on our citizens andbreach including:critical infrastructures.

• Working with data security and complianceDuring the first half of 2023, there were 395 data
breaches impacting at least 500 records reported

technologies that work across all platforms.
• Deploying strong Identity and Accessto the U.S. Department of Health and Human

Management (IAM) strategies that include

Services (HHS) Office for Civil Rights (OCR).

Multifactor Authentication.

1

To make matter worse, IBM’s annual Cost of a
Data Breach Report2 indicates that since 2020,
healthcare data breach costs have increased
53.3% and that, for the 13th year in a row, thehealthcare industry reported the most expensive
data breaches, at an average cost of
USD 10.93 million.
The report also highlights that:• Cloud Environments are Frequent Targets
82% breaches involved data stored in
the cloud—public, private or multiple
environments. Data breaches in public clouds
and multiple environments also hadhigher costs.
• Security System Complexity Matters
The biggest data breach cost amplifier was
identified as security system complexity.
Organizations with high levels of security
system complexity reported data breach costs“The healthcare fieldcontinues to be a top
target for cybercriminals.
According to data fromthe Department of Healthand Human Services (HHS),
there has been an 84%
increase in the numberof data breaches against
healthcare organizations
from 2018-2022.3”–Rick Pollack
President and CEO of the American

31.6% higher than those that with low or no
security system complexity.

¹ hipaajournal.com/july-2023-healthcare-data-breach-report/² ibm.com/reports/data-breach³ aha.org/news/perspective/2022-10-21-keeping-our-defenses-strong-against-cyber-threats©2024 Zscaler, Inc. All rights reserved.

SOLUTION BRIEF

02

“But We’ve Always Done It That Way.”
This is one of the most dangerous phrases in allof IT, let alone that of healthcare. Our IT systems
and networks must be reliable, but stability

This adds up to an even taller order for healthcareorganizations to reduce their attack surfaces andrisk profiles and eliminate system accessfrom cybercriminals.

should come neither at the cost of innovation nor
on the heels of aging legacy architecture.
The FBI’s Cyber Division published a ‘Private

AVERAGE DATA BREACH SIZE (2009-AUG 2023)

Industry Notification’ warning the healthcare
industry that “Medical device hardware often
remains active for 10-30 years, however,underlying software life cycles are specified by
the manufacturer, ranging from a couple [of]months to maximum life expectancy per device
allowing cyber threat actors time to discover andexploit vulnerabilities.”

MEDIAN DATA BREACH SIZE (2009-AUG 2023)

In a way, the FBI’s statement is unsurprising.
Traditional networks operating in an applianceheavy manner increase the administrative burden
and operational cost it takes to manage alreadyhardware-bloated healthcare IT security.
Healthcare IT becomes even more challenging
when migrating digital ecosystems to themobile-first world, adopting bring your own
device (BYOD), implementing telehealth, andincorporating the internet of medical things

HEALTHCARE DATA BREACHES OF 500+ RECORDS(2009-AUG 2023)(IoMT), but still operating with a concentrated
castle-and-moat architecture riddled with nonstandardized policy misconfigurations.
In its “2023 State of Cybersecurity for Medical
Devices and Healthcare Systems”4, Health-ISAC
found 993 vulnerabilities across 996 medical
devices and health care applications, a 59%
increase over 2022. With decentralized data,systems, and architectures, sensitive data, like

⁴ h-isac.org/2023-state-of-cybersecurity-for-medical-devices-and-healthcare-systems/©2024 Zscaler, Inc. All rights reserved.

SOLUTION BRIEF

03

Escalation of Cyber Incidents
HIPAA Section II introduced five rules governing
privacy, transactions and code sets, security,
unique identifiers, and enforcement.

• Evaluation
A Covered Entity must perform a periodic
assessment of how well its security policies
and procedures meet the requirements of the
Security Rule.

HIPAA’s Security Rule5, enacted in 2005,
establishes national standards to protect theconfidentiality, integrity, and availability ofelectronic Personal Health Information (e-PHI). To
comply, enterprises must implement policies and

HACKING/IT INCIDENTS (2009-AUG 2023)

procedures to ensure the security of information
systems that process, store, and transmit
electronic PHI between entities. The Departmentof Human and Health Services summarizes
safeguards corresponding to employing cloudtechnologies to safeguard e-PHI.6 Despite the
HHS’s defined safeguards and standard operatingprocedures, policies, and templates, sophisticatedcybercriminals have proven they’re creative
enough to ensure the healthcare industry remains
under attack. This escalation of incidents is

RECORDS EXPOSED IN HACKING/IT INCIDENTS(2009-AUG 2023)

depicted in the HIPAA Journal’s graphs.7
Administrative Safeguards• Security Management Process.
A Covered Entity must identify and analyze
potential risks to e-PHI and implement security
measures that reduce risks and vulnerabilities toa reasonable and appropriate level.
• Information Access Management.
The Security Rule requires a Covered Entity

RECORDS EXPOSED IN LOSS/THEFT INCIDENTS(2009-AUG 2023)

to implement policies and procedures
for authorizing access to e-PHI only withappropriate role-based access consistent with
the Privacy Rule “minimum necessary” standard
for using or disclosing e-PHI.

⁵ hhs.gov/hipaa/for-professionals/security/guidance/index.html
⁶ Respective to cloud technologies
⁷ hipaajournal.com/healthcare-data-breach-statistics/©2024 Zscaler, Inc. All rights reserved.

SOLUTION BRIEF

04

Physical Safeguards

HIPAA’s Privacy Rule8 provision—added in• Workstation and Device Security.

2003—stipulates what information is considered

A Covered Entity must implement policies andprocedures to specify the proper use of andaccess to workstations and electronic media.

PHI and mandates that enterprises implement
controls to prevent and restrict any unauthorized
disclosure of PHI in any form (including paper or

A Covered Entity must also have policies anddigital distribution).

procedures regarding the transfer, removal,

It requires certain organizations to protect PHI

disposal, and reuse of electronic media toensure appropriate e-PHI protection.
Technical Safeguards• Access Control.

with appropriate safeguards that limit access toand use of the data. It also establishes how anenterprise can use PHI with (or without) explicit
patient authorization.

A Covered Entity must implement technical

The Privacy Rule clarifies the meaning ofpolicies and procedures that allow only

“privacy” with the “Minimum Necessary Rule.”

authorized persons to access e-PHI.

The Minimum Necessary Rule determines how• Audit Control.
A Covered Entity must implement hardware,
software, and/or procedural mechanisms torecord and examine access and other activity in
information systems that contain or use e-PHI.
• Integrity Controls.

and when healthcare providers and other entities
subject to HIPAA can disclose PHI. The Minimum
Necessary Rule, similar to zero trust’s principle of
least privilege, means that data can and should
only be disclosed for a stated purpose and time
period, especially PHI.

A Covered Entity must implement policies,

The Privacy Rule also allows PHI to be used andprocedures, and electronic measures to ensuredisclosed for treatment, payment, and healthcarethat e-PHI is not improperly alteredoperations. Otherwise, PHI is only disclosed whenor destroyed.

it is required by law, when it is in the patient’s• Transmission Security.
A Covered Entity must implement technicalsecurity measures that guard against
unauthorized access to e-PHI being transmitted
over an electronic network.

or the public’s interest when HIPAA-covered
entities need to exchange a patient’s PHI between
each other to provide services or coverageto the patient in question. Regardless of thecircumstances, all covered entities must comply
with the Minimum Necessary Rule.

⁸ hhs.gov/hipaa/for-professionals/privacy/index.html©2024 Zscaler, Inc. All rights reserved.

SOLUTION BRIEF

05

You Can’t Prevent What You
Can’t Detect
Zscaler and HIPAA: How Covered Entities
Achieve Compliance
Pre-COVID, healthcare organizations werealready migrating their IT infrastructures to thecloud to secure PHI-rich environments despite

so selecting the right SSE platform is thecornerstone of cloud security. Along with
reducing cloud security risk and misconfigurationand improving compliance, shadow IT, andthreat intelligence, Zscaler enforces and supports
the HHS OIC’s best practices for securing ahealthcare organization’s cloud data.

HIPAA and HITECH not always keeping pacewith technology. However, in the age of COVID,
healthcare organizations expedited their digitaltransformation plans to promote telehealth andsecurely deploy cloud technologies to reduce
operational costs and risks as well as increase
their security profile in the most efficient

HHS Office of Information
Security Top 10
1.

that encrypts

way possible.
Zscaler’s industry-leading cloud native Security
Service Edge9 (SSE) fulfills the cloud’s promiseof secure scalability, flexibility, and ease of

Use a cloud service provider

2. Conduct compliance audits
3. Implement a Zero Trust model

access. Zscaler’s Zero Trust Architecture (ZTA)

4. Set up your privacy settings

provides the HIPAA-compliant cloud utility to

5. Use a Two-Factor Authentication

progressive healthcare organizations, including
threat protection, data loss prevention (DLP),SSL inspection, sandboxing, browser isolationand much more. And because Zscaler connects

6. Establish and enforce security policies
7.

Maintain cloud visibility

users to applications, not IP networks, Zscaler

8. Understand cloud compliance,

enables aging healthcare IT infrastructures torequirements, and regulations

seamlessly leverage their current service catalog
while adopting other cloud solutions. As noted in
the HHS Office of Information Security10, digitaltransformation, cloud technology adoption, and

9. Install updates to youroperating system
10. Avoid using public Wi-Fi

application and service migration to the cloud areshared responsibilities,

910

gartner-magic-quadrant-security-service-edge-sse-2023
hhs.gov/sites/default/files/cloud-security-analyst-note-tlpwhite.pdf©2024 Zscaler, Inc. All rights reserved.

SOLUTION BRIEF

06

Zsclaer Internet Access (ZIA)

DNS Filtering: Zscaler’s DNS filtering solution

Zscaler’s ZIA solution securely connects users

provides a local DNS resolver and enforces

to externally managed applications, including

acceptable use policies.

SaaS apps and internet destinations, regardless

URL Filtering: Zscaler’s URL filteringof device, location, or network. ZIA sits between

capabilities enable customers to enforce

users and the internet and ensures malware does

acceptable usage policies and protect

not reach users and valuable corporate data doesorganizations from users visiting unauthorized

not leak out. It enforces access based on granular

websites or illegally downloading content thataccess control policies, inspects traffic, both

can increase liability and impact their brand.

unencrypted and encrypted, inline for malware
and advanced threats, and prevents data leakage.

Bandwidth Control: To improve productivity
and user experience, Zscaler’s bandwidth

Policies follow users to provide identicalcontrol and traffic shaping capabilities

protection on any device, regardless of

ensure that business-critical applications,location; any policy changes are enforced forespecially proprietary healthcare applications,users worldwide. The Zscaler cloud security

are prioritized over non-business-criticalplatform provides full inline content inspection

applications. By enforcing quality of service inof webpages to assess and correlate the risk of

the cloud, Zscaler’s platform optimizes “last-

webpage objects, continuously discovering andmile” utilization of the health IT network,

blocking sophisticated threats. ZIA includes broad

providing significant value.

functionality, which Zscaler categorizes into threeareas: access control, threat prevention, anddata protection.
1

2

Threat Prevention
Zscaler’s second area of functionality, threat

Access Control

prevention, keeps users safe from savvy

Zscaler’s ZIA access control enforces accessthreat actors by providing multiple layers

and usage policies to externally managedof protection. Zscaler provides functionality

applications, including SaaS applications

traditionally offered by disparate, standalone

and internet destinations. This includes

products, which are described below:

functionality traditionally provided bystandalone point products, such as:

Advanced Threat Protection: Zscaler’s
advanced protection solution delivers real-

Cloud Firewall: The Zscaler Cloud Firewall

time protection from malicious internet

was designed to protect users by inspecting

content like browser exploits, scripts, zero-internet traffic on ports and protocols. It

pixel iFrames, malware, and botnet callbacks.

offers user-level policies and application

Over 120,000 unique security updates

identification with deep packet inspection andare performed daily to the Zscaler cloud to

DNS Filtering: Zscaler’s DNS filtering solution

protect users. Once Zscaler detects a newprovides a local DNS resolver and enforces

threat to a Zscaler calls this the “cloud security

acceptable use policies.

effect.” Advanced threat protection
features include:©2024 Zscaler, Inc. All rights reserved.

SOLUTION BRIEF

07

SSL Inspection: In a legacy security

Cross-site scripting (XSS) protection:

environment, encrypted traffic creates a blindProtection against XSS, in which malicious

spot for security and compliance. SSL andcode injected into websites is downloaded to

TLS (SSL’s successor) are data encryption

a user’s web browser from compromised

standards, and most internet traffic is SSL/

web servers.

TLS encrypted. For example, Google says
more than 95% of Chrome browser traffic isencrypted.11

Suspicious destinations protection: Blocks
requests to any country based on ISO 3166
mapping of countries to their IP address

Zscaler’s SSL Inspection feature12 decrypts,

space. Websites are blocked based on theinspects, and then re-encrypts data traffic

location of the web server.

before it reaches its destination. This lets
Zscaler intercept, identify and block incoming
threats or apply customer data protection
policies to reduce risks.

Unauthorized communication protection:
Protection against communications likeinternet relay chat (IRC) tunneling applicationsand “anonymizer” sites that are used toBotnet Protection: Protection from botnets

bypass firewall access and proxythat could be secretly installed on user

security controls.

devices to perform malicious tasks at the
instruction of command-and-control servers.

Peer-to-peer (P2P) anonymizer protection:
Blocks anonymizing applications such as Tor,

Malicious activity content protection:

an application that enables users to bypass

Protection against websites that attempt topolicies controlling what websites they may

download dangerous content to a user’s

visit or internet resources they may access.

web browser.

Sandbox: The Zscaler Sandbox enables

Fraud protection: Protection against phishingenterprises to block zero-day exploits

sites that mimic legitimate sites, such as

and advanced persistent Threats (APTs)

banking and e-commerce sites, to stealby analyzing unknown files for malicious

confidential information.

behavior and can scale to every user
regardless of location. Zscaler’s purposebuilt multitenant sandbox allows customers“Google says more than 95%
of Chrome browser traffic isencrypted. Similarly, Zscaler’s
worldwide data traffic is, on
average, 83% encrypted.”

to determine which traffic should be sent to
the Sandbox. As an integrated cloud security
platform, healthcare IT administrators can set
policies by users and destinations to prevent
patient zero scenarios by holding, detonating,and analyzing suspicious files in the sandbox
before being sent to the user.

11
12transparencyreport.google.com/https/overview?hl=en
zscaler.com/resources/white-papers/encryption-privacy-data-protection.pdf©2024 Zscaler, Inc. All rights reserved.

SOLUTION BRIEF

08

Antivirus: Zscaler’s antivirus technology uses

Cloud Access Security Broker (CASB):

a signature database of files and objects on

Zscaler’s CASB prevents data exposure,the internet known to be unsafe and runs

ensures SaaS compliance with out-of-

traffic through multiple antivirus engines in aband CASB, and discovers and controls

single pass.

unknown cloud applications with Inline

DNS Security: Zscaler blocks access to known
malicious sites, including command-andcontrol sites, and routes suspicious traffic to
Zscaler’s threat detection engines forcontent inspection.

scan, detect and control PHI at rest in SaaS
applications or to implement granular access
control for specified cloud applications, suchas the ability to upload or download files orpost comments or videos based on user orBrowser IsolationTM: Zscaler Browser Isolationgroup identities. Additionally, Zscaler

stops active content and ransomware frompartners with specific CASB vendors toreaching endpoint devices and prevents

extend their policy controls and visibility ofthe exfiltration of confidential data fromcloud applications.

business- critical applications.
3

CASB. Healthcare policies can be defined toData Protection
Zscaler’s data protection function prevents
unauthorized sharing or exfiltration ofconfidential information, like e-PHI, reducing
the health industry’s HIPAA business andcompliance risk.

Data Security Posture Management (DSPM):
DSPM proactively identifies and remediates
misconfigurations in IaaS and PaaS to
reduce risk, ensure compliance across AWS,
Azure, and GCP, and maintain a soundsecurity posture. With pre-built policies
for compliance standards and security bestpractices, it helps security teams enforce

Data Loss Prevention (DLP): Zscaler’s

guardrails for secure, compliant deployments

DLP13 service helps prevent intentional orthat improve DevOps efficiency.

unintentional exfiltration of an enterprise’s

Browser Isolation: Zscaler’s Browser Isolation

sensitive data like PHI and examines dataflows. Zscaler sits inline between the user andthe data destination and uses dictionaries,
content matching, file type control, machinelearning-based matching, and “Exact Data
Match” to identify potential data exfiltration
activity. Most HIPAA compliance programs
include user education and Zscaler alert
notifications that provide users withfunctionality allows customers to eliminate
exposure to risky web content and data
exfiltration by separating browsing activity
from the end user device by isolating traffic toa secure cloud browser which can restrict thetypes of actions performed (e.g., download,
read, write, etc.) on files from
untrusted sources.

sensitive data processing information to help
administrators understand HIPAA workflows.

13

zscaler.com/products/data-loss-prevention©2024 Zscaler, Inc. All rights reserved.

SOLUTION BRIEF

09

Zscaler Private Access

Secure Application Access: Zscaler’s ZPA solution

Zscaler’s ZPA solution offers authorized users

delivers seamless connectivity to internallysecure and fast access to internally managed

managed applications and assets, whether in theapplications hosted in enterprise data centers

cloud, enterprise data center, or both. Healthcareor the public cloud. Zscaler’s ZPA solution’s

IT administrators can set global policies from aarchitecture does not expose applications’ identity

single console, enabling policy-driven accessor location and only provides the necessary accessthat is network-agnostic to users. By creatinglevels. While traditional remote access solutions,access to applications regardless of a user’s

such as virtual private networks (VPNs), connect

network, Zscaler’s ZPA solution replaces the needa user to the corporate network, Zscaler’s ZPA

for traditional remote access VPNs, SSL VPNs,

solution connects a specific user to a specificreverse proxies, and other similar products.

application without bringing the user onto the
network, resulting in better security. Zscaler’s
ZPA solution was designed around Zscaler’s key
tenants that fundamentally change the way users
access internal applications:• Connect users to applications without bringing
users onto the network.

Application Segmentation: This architecture
enables user and application-level segmentation
capabilities. As each user-to-application
connection is segmented with microtunnels,
lateral movement across the network isprevented, significantly reducing unauthorized
data access and security risk. Similar to CASB,• Never expose applications to the internet.

ZPA’s application discovery reports for internet• Segment access to applications without

applications and provides granular discovery

relying on the traditional approach of network
segmentation• Provide remote access over the internet
without VPNs
Zscaler’s ZPA solution enforces a global policy
engine that manages access to internallymanaged applications regardless of location. If
access is granted to a user, Zscaler’s ZPA solution
connects the user’s device only to the authorized
application without exposing the identity or
location of the application. Since applications
are not exposed to the internet, the healthcareorganization’s attack surface is eliminated, limiting
threat exposure. This reduces cost and complexity
while offering better security and an improved
user experience. ZPA functionality falls within
three major areas:of internally managed applications to aid thecreation of segmentation policies, which ensureauthenticated users are granted access only toauthorized applications and not access to the IT
infrastructure network.
Application Protection: Zscaler’s ZPA solution
initiates and connects together outbound-only
links between authenticated users and internallymanaged application microtunnels. Access isprovided to users without bringing them onto thecorporate network or exposing applications to
the internet. Internally managed applications are
not discoverable or identifiable. With no inboundconnections and public IP addresses, there isno inbound attack surface, therefore removing
the threat of distributed denial-of-service(DDoS) attacks. With Zscaler’s approach, Zscaler
subsumes the need for a next-generation firewall
or DDoS mitigation system.

©2024 Zscaler, Inc. All rights reserved.

SOLUTION BRIEF

010

Zscaler HIPAA Considerations

Bypassing SSL decryption is not generally

Per HIPAA, “covered entities” include healthrecommended, but Zscaler’s SSL decryption canplans, healthcare clearinghouses, and healthcare

bring Zscaler into contact with PHI. To reduce

providers that electronically transmit any healththe impact and to address HIPAA compliance,

information for which the U.S. Department ofhealthcare organizations and other covered

Health and Human Services (HHS) has adopted

entities that employ Zscaler for SSL inspection

standards. Also, some employers that provide

can consider a workaround: Categorize the URLs

“self-funded” healthcare are considered coveredof PHI-data locations and applications, andentities under HIPAA.

then set data traffic to/from only those URLs to

14

As a cloud security services provider, Zscaler
does not fall under an easily discernible HIPAA
category as it is not a Covered Entity, and rarely

bypass SSL inspection. In that way, a healthcare
enterprise minimizes Zscaler’s contact with PHI
during decryption.

acts as Business Associate since it typically

Sandbox Services

does not have access to, nor process PHI in

Zscaler provides cloud-based advanced

most deployments. However, Zscaler services

behavioral malware analysis services through its

could access and/or process PHI in applying SSL

Cloud Sandbox service.

Inspection, Sandbox, DLP, and Browser Isolation
services, which may qualify Zscaler as a
Business Associate.

Zscaler Cloud Sandbox enables customers toisolate suspicious files in an in-memory sandbox
environment where they can be evaluated byConsiderations depend on the services Zscaler

Zscaler security. Only if the file is malicious

provides to the Covered Entity and the policies

will it be stored in a secure, encrypted location

the customer applies. In these rare cases, ain the region chosen by the customer (United

supplemental customer Business AssociateStates or European Union). In rare cases, Zscaler

Agreement (BAA) may be required. Note thatThreatLabZ security researchers may examine

any Zscaler BAA is limited in scope to cover only

unique threat materials. If an infected file contains

those Zscaler products that may have access

PHI, Zscaler may gain access to PHI.

to PHI in a customer environment as describedabove.

Zscaler maintains extensive access control
requirements, storage, encryption, and logging

SSL Inspection

for files that are accessed via Cloud Sandbox by

To enable detection of threats and enforce

the ThreatLabZ team. Typically, Zscaler works

customer data protection policies, Zscalerwith healthcare customers to gain insight ordecrypts SSL (or TLS) encrypted traffic according

contextual understanding to identify PHI in

to customer defined configurations.

relation to a Covered Entity’s data. In that way,

This activity is— notably for HIPAA
compliance—ephemeral, performed entirely in

Zscaler and customer can take appropriate action
to protect identified files containing PHI.

memory, for the purpose of enabling other threat
prevention and data protection services.
14

hhs.gov/hipaa/for-professionals/covered-entities/index.html©2024 Zscaler, Inc. All rights reserved.

SOLUTION BRIEF

011

To address HIPAA compliance regarding Cloud

Cloud Browser Isolation

Sandbox and PHI, covered entities can consider

Cloud Browser Isolation (CBI) safely isolates

an alternative approach: categorize the URLs ofusers and endpoints from potential dangerous

PHI-data locations and applications, and thenactive web content and isolates customer private

use that information to ensure PHI-inclusive files

applications from unmanaged endpoints bybypass the sandbox in transit. (This can be done

rerouting web traffic through an isolated browser

via the “First Time Action = Allow & Do Not Scan”

run by Zscaler.

in Zscaler Cloud Sandbox rule policy.)

When a user gets rerouted through CBI, they will

Data Loss Prevention (DLP)

continue to have the same experience within theirZscaler DLP can examine data at rest and data

local browser, but they will only see and interact

in motion. In a healthcare setting, this enables

with the image or pixel representation of thecustomers to detect and prevent sensitive medical

isolated browser session. Their local browser will

data such as patient information, medical record

no longer be exposed to active web content now

numbers, disease names, drug names, and evenrunning on the isolated browser, and customers

lab reports from leaving control of

can define policies for file upload or download

the organization.

through CBI.

All Zscaler DLP processing is done in-memory

Zscaler CBI can — in rendering web content

and does not store any source data in logs or— come into contact with PHI. User session

in the Zscaler cloud. Only the event metadata

content in memory or ephemeral storage within

related to the customer’s security policy is logged.

the isolation browser container is deleted as soon

Zscaler DLP can also send Internet Content

as the user’s session ends or crashes. Files that

Adaptation Protocol (ICAP) data, including

are uploaded/downloaded (as allowed by policy)

source data evidence, to an external DLP systemor rendered (e.g., pdf in the isolated browser areor a Zscaler Incident Receiver in the customer

temporarily stored in encrypted form and getenvironment, and can alert DLP administrators

deleted once the user action or session ends. The

via email.

CBI service can also optionally persist user cookies

Zscaler DLP can—in examining data—comein encrypted form to enhance user experience.

into contact with PHI. However, customer can

To reduce PHI exposure to the CBI service,define granular multi-criteria DLP policies that

customers can target or exempt specific users,

target or exempt specific users, groups, locations,groups, locations, destinations, and content types

destinations, and content types with granularwith granular multi-criteria policies. Customers

multi-criteria policies. To help further reduce

can also disable Cookie persistence. CBI does notaccess of PHI, Zscaler can provide healthcare

otherwise store any customer data in logs or incustomers with customized reports andthe Zscaler cloud.

notifications for visibility into PHI activity.

©2024 Zscaler, Inc. All rights reserved.

SOLUTION BRIEF

012

Zscaler’s industry-leading cloud-native Security Service Edge15(SSE) not only enforces and supports HIPAA’s Security and Privacy Rules but fulfills the healthcare industry’s
requirements of reliability, availability, and scalability (RAS). And Zscaler accomplishes this feat in one of
the most modern and secure ways possible: a zero trust architecture responsible for securing over 40
million concurrent users at any given time, including most US cabinet-level agencies.

15

gartner-magic-quadrant-security-service-edge-sse-2023

About Zscaler
Zscaler (NASDAQ: ZS) accelerates digital transformation so that customers can be more agile, efficient, resilient,and secure. The Zscaler Zero Trust Exchange protects thousands of customers from cyberattacks and data loss
by securely connecting users, devices, and applications in any location. Distributed across more than 150 data
centers globally, the SSE-based Zero Trust Exchange is the world’s largest inline cloud security platform.
Learn more at zscaler.com or follow us on Twitter @zscaler.
+1 408.533.0288

Zscaler, Inc. (HQ) • 120 Holger Way • San Jose, CA 95134© 2024 Zscaler, Inc. All rights reserved. Zscaler™,
Zero Trust Exchange™, Zscaler Internet Access™,
ZIA™, Zscaler Private Access™, ZPA™ andother trademarks listed at zscaler.com/legal/
trademarks are either (i) registered trademarks orservice marks or (ii) trademarks or service marksof Zscaler, Inc. in the United States and/or othercountries. Any other trademarks are the propertiesof their respective owners.

zscaler.com