SUCCESS STORY
Banner HealthIndustry• HealthcareSolutions• OpenText™ EnCase™ Information Assurance• OpenText™ EnCase™ Endpoint Investigator

Services• OpenText Professional Services

Banner Health transforms
information discovery and security
with OpenText EnCase solutions

Nonprofit healthcare provider employs OpenText EnCase Information
Assurance (formerly EnCase eDiscovery) and OpenText EnCase Endpoint
Investigator to accelerate eDiscovery processes and data security.
Results
Accelerates eDiscovery to
defensibly collect data acrossthe enterprise
Enables a comprehensive
approach to rapid incident
management and responseIncreases efficiency,productivity and time savings“We already had OpenText EnCase eDiscovery as aforensic solution. While we considered opportunities
with other products, ultimately we came right back toOpenText. With OpenText EnCase Endpoint Investigator,
we partnered with an organization whose product had aproven track record.”
Sam E. Buhrow

Director of Cyber Incident Management & Forensics
Banner HealthBanner Health transforms information discovery and security with OpenText EnCase solutions

Headquartered in Phoenix, Arizona, Banner Health is one of thelargest nonprofit healthcare systems in the U.S., with close to 500
medical facilities across six states, including hospitals, urgent carefacilities and rehabilitation centers. In a single year, Banner Healthsees more than a million emergency room visits, runs close to fivemillion blood tests and delivers more than 30,000 babies.
Although they operate far from the emergency room, Banner
Health’s Cyber Incident Management & Forensics team supports theorganization’s commitment to patient care through the innovative useof OpenText™ EnCase™ Information Assurance and OpenText™ EnCase™
Endpoint Investigator. From data security incident response tocompliance with legal requests for electronic information (eDiscovery),the team is entrusted with managing and protecting the company’sdata. With both cybersecurity threats and litigation on the rise, Banner
Health determined its existing systems could not meet the company’s
increasingly critical needs and sought other methods to accelerate
data security response.
“Our top priority is always our patients’ healthcare and their rightto data security protection. We go to extremes to vet any newtechnology to make sure it is safe, because we are dealing withcollecting data that could affect the patient,” said Sam E. Buhrow,director of Cyber Incident Management & Forensics at Banner Health.
“We already had OpenText EnCase eDiscovery as a forensicsolution. While we considered opportunities with other products,
ultimately we came right back to OpenText. With OpenText EnCase
Endpoint Investigator, we partnered with an organization whose
product had a proven track record.”

EnCase Information Assurance provides Banner Health with
360-degree visibility across all endpoints, devices and networks
to enable forensically sound data collection for litigation. Theautomated solution allows the company to collect and preserve
potentially relevant data from multiple data sources, with a processthat ensures strict chain of custody and executes legal hold in a
defensible manner.
In addition, EnCase Endpoint Investigator, supported by OpenText
Professional Services consultants, collects and analyzes datafor incident response and investigation. When a security alert isreceived, the solution’s advanced digital forensic tools collects
relevant data to quickly assess the situation and respondaccordingly. “When an alert comes in, my team will useOpenText EnCase Endpoint Investigator to collect memory,
look at the state of the systems and try to find any indicationof compromise. We are able to quickly triage and determine
if this is an actual security event,” Buhrow said.
Automating and accelerating many time-consuming processes,
such as information collection, enables Banner Health to significantly
improve its efficiency across all fronts. For example, the teamhas dramatically reduced incident response times for eDiscovery
requests. “With OpenText EnCase Information Assurance, the time
to collect and provide data for third-party requests dropped fromthree to four weeks down to six hours,” Buhrow reported.
Investigation and incident resolution has seen equally remarkable
improvements. EnCase Information Assurance, supported by theexpertise of Professional Services, provides immediate and thoroughdigital investigations. They search, collect, preserve and analyze
data from anywhere on the corporate network.

“With OpenText EnCase
Information Assurance,
the time to collect andprovide data for thirdparty requests has
dropped from three to fourweeks down to six hours.”
Sam E. Buhrow

Director of Cyber IncidentManagement & Forensics
Banner HealthBanner Health transforms information discovery and security with OpenText EnCase solutions“With incident responses in the past, it could take up to one
week to pull the information, parse it and demonstrate in anunderstandable format that a security event had happened.
By using OpenText EnCase Endpoint Investigator, we are able topull those assets together very quickly,” Buhrow explained. “Ina recent HR investigation, my team gave HR a full report witheverything they needed in four hours. The amount of time that
the OpenText solution saves has been dramatic.”

During a recent incident response, the team rapidly pulled informationand triaged the situation. Within an hour and a half, they had aworking theory as to the nature of the incident, which caught theattention of executives, reported Buhrow. “We had senior leadershipsaying, ‘Wow, we have the right people with the right tools.’ They
just could not believe the results with OpenText. The last time asimilar incident happened, it took nearly six days before they wereable to resolve it.”

Looking at past metrics, Buhrow noted that some investigations andincident responses were often still unresolved at the 30- or even60-day mark: “If you have an incident that’s still open after 30days, that is cause for concern. With OpenText EnCase Endpoint
Investigator, we have gone from 60- and 90-day resolutions
down to 30 days or less.”

Banner Health credits the success of the solution in part to the valued
partnership with Professional Services, which helps the company
get the most out of the OpenText EnCase solutions. By leveraging theexpertise of Professional Services, the team developed processes,
playbooks and tools to accelerate incident response and maximize
efficiency. “OpenText has really been very valuable to us. To have
OpenText Professional Services support us and be a trusted
partner is a real value,” Buhrow noted.

This newfound efficiency not only results in faster responses torequests and incidents, it also bolsters the team’s reputation withstakeholders, such as HR and legal. “The faster we can provide a
response to our internal customers, the more confidence they
have that when something big and bad happens, we are able tourgently identify and resolve the issue,” Buhrow said.

About OpenText
OpenText, The Information Company,enables organizations to gain insight
through market leading information
management solutions, on-premises orin the cloud. For more information aboutOpenText (NASDAQ: OTEX, TSX: OTEX)
visit opentext.com.
Customer stories
opentext.com/contact
Twitter | LinkedIn
Copyright © 2021 Open Text. All Rights Reserved. Trademarks owned by Open Text.
For more information, visit: https://www.opentext.com/about/copyright-information(07/2021)18726EN