Policies, Standards and Procedures
Do your information security and privacy policies and standards align with international and industry standards (ISO-27001/2, COBIT, NIST SP 800-36/37/53, etc.)?
Yes. Medtronic operates in a heavily regulated medical device industry. We align our oversight and management of cybersecurity based on the International Organization for Standardization/ International Electro Technical Commission’s 27001 series (ISO/IEC 27001) and to the NIST (National Institute of Standards and Technology) Cybersecurity Framework. The devices, systems, and services we sell meet the applicable medical device regulatory requirements.
Governance, Risk & Compliance
Does an external firm perform external audits of your company’s and partners’ information security practices and controls?
A-LIGN is Medtronic Digital Surgery’s contracted third-party assessor (TPA) for the annual HIPAA, SOC 2, and SOC 3 audits of Touch SurgeryTM Enterprise. Amazon Web Services has its own TPAs to assess the cloud hosting infrastructure.
Identity and Access Control
How does your team access your cloud environment?
A Touch SurgeryTM Enterprise administrator/privileged user who accesses the Touch SurgeryTM Enterprise AWS cloud platform cannot directly connect to any AWS cloud components (e.g. server, database). This type of user must first authenticate using their authorized AWS Identity & AccessManagement (IAM) account credential (ID, password, and MFA code), and then proceed to login to the Teleport Enterprise AWS web console using their Teleport account credentials (ID, password, and MFA code) before connecting and performing any system administration.
Certain authorized Medtronic Digital Surgery staff members can log in to the Django Admin internal web portal. This gives the user granular access to specific RDS Postgres database tables required for their job role.
Does Amazon have access to the data stored on AWS?
No. Touch SurgeryTM Enterprise Servers are run as EC2 instances on AWS, which uses Nitro technology. Nitro technology, which prevents Amazon employees from accessing information on the servers to limit the possibility of human error and tampering. Thus Amazon employees cannot access information from these servers.
Can videos be retrieved if I decide to stop using Touch SurgeryTM Enterprise?
Yes. In the event of a contract termination, Medtronic Digital Surgery provides a period of 30 days for you to download videos and data to other devices before access to our cloud storage is removed. As a second option, institution administrators can request the ability to receive a file with the direct download links.
Incident Response
What is the documented process, and timeframe, for notifying customers of security incidents involving or impacting their data?
All suspected security incidents are required to be reported to Medtronic’s Global Security Office (GSO) within 24 hours. The GSO conducts a thorough investigation of every incident to determine the impact.
The contract with your institution outlines terms to include breach notification rules. HIPAA breach notification rules do not apply, as no PHI is collected by Touch SurgeryTM Enterprise.
Legal/Privacy
How does Touch SurgeryTM Enterprise comply to data protection laws?
Medtronic Digital Surgery proactively performs privacy impact assessments to identify, assess and address privacy risks, and designs new products and applicable services in accordance with “Security by design” principles. You can read further information on Data and Privacy here for the EU version and here for the US version. Additionally, Medtronic Digital Surgery uses standard templates and processes developed by the Privacy Program to ensure the appropriate privacy provisions are incorporated into third party contracts.
Do you collect or create metadata about customer data usage using inspection technologies (search engines, etc.)?
Yes, Medtronic Digital Surgery does collect metadata about customer usage to meet our legal obligations, manage our operations, improve our organization and deliver our Services to you or your institution. We also use cookies to track and analyze how users interact with the platform and to improve our product.
See https://www.touchsurgery.com/privacy and www.touchsurgery.com/cookies for more information.
Security Tools/Utilities
Do you use cloud-native tools to secure your environment?
Yes. The following native cloud tools are used to secure Touch SurgeryTM Enterprise:
AWS Identity and Access Management (IAM) - used to control access to Touch SurgeryTM Enterprise AWS resources.
AWS CloudTrail - tracks all activity in AWS environments. It records all actions a Touch SurgeryTM Enterprise user executes in the AWS console and all API calls as events.
AWS GuardDuty - threat detection services which uses machine learning to look for malicious activity in AWS environments. It combines CloudTrail event logs, VPC Flow Logs, and S3 event logs to continuously monitor and analyze Touch SurgeryTM Enterprise activity.
AWS CloudWatch - logs, monitors and alerts on performance of Touch SurgeryTM Enterprise AWS resources and applications.
AWS Shield - is a fully-managed distributed denial-of-service (DDoS) protection service for Network (Layer 3) and Application (Layer 4-Transport) type attacks.
AWS Secrets Manager - supports automatic key rotation for the AWS Relational Database Service (RDS) used by Touch SurgeryTM Enterprise
Third Party Risk Management
Is access to the organization’s information and systems by external parties permitted?
Yes. Medtronic’s Third Party Security Standard requires the performance of security and privacy reviews of all new and existing vendors and their solutions prior to: sharing non-public data, or granting access to its information systems/assets.
Does the organization obtain satisfactory assurances that reasonable information security exists across its information supply chain?
Third Party Risk (TPR) security and privacy assessments are performed before procurement, and periodically thereafter.