We protect the health information our members and customers trust us with. This page explains how we do that, and the rules that apply to anyone who wants to test our systems.
Abby Care is committed to protecting the data entrusted to us by our members, customers, and partners, especially protected health information (PHI). We have invested in an information security program designed to guard that data against a wide range of threats, keep our services available, and make sure information is stored, processed, and transmitted securely.
We take security seriously because we know how much it matters to the people who rely on us.
Abby Care maintains a formal information security management program. Responsibility for our security and privacy policies rests with our Information Security Officer and Privacy Officer. Our leadership team reviews and approves these policies, and we review them at least annually and whenever circumstances change.
Key parts of the program include security awareness training for all personnel, regular audits of our practices, physical security policies, vendor risk management, and independent assessments.
If you need detailed security information to complete a vendor security assessment, contact your account manager. We provide a security package to prospective and existing customers. Because the documentation is sensitive, we require a signed NDA before we share it.
No testing without written approval. You may not test, scan, probe, or attempt to gain access to any Abby Care system, application, or data unless Abby Care has approved your request in writing beforehand.
Our systems hold sensitive health information, and unplanned testing can put that information and our members' care at risk. For that reason, penetration testing, vulnerability scanning, and other security research against Abby Care are permitted only with prior written approval from our Information Security team.
What requires approval
Approval is required before you do any of the following against Abby Care, its affiliates, or the systems and services we operate:
- Penetration testing or red-team activity
- Automated or manual vulnerability scanning
- Attempts to access, modify, or extract data, accounts, or credentials
- Testing of our websites, APIs, mobile applications, or network infrastructure
- Social engineering of our personnel, members, or customers
- Denial-of-service or load testing
Email security@abbycare.org before you begin, with:
- Your full name and location. [Researchers must be located in the United States.]
- The organization you work for, or a statement that you are an independent individual
- The type of research you want to conduct and why
- The systems you propose to test and your proposed dates
If our Information Security team approves your request, we will tell you in writing which systems are in scope and any conditions that apply. Approval is limited to what the written approval states. We may decline a request or withdraw approval at any time.
- Stay within the systems, methods, and dates we approved.
- Avoid harm to Abby Care systems, operations, and members.
- Do not access, copy, store, or disclose PHI or other personal information.
- If you encounter it, stop immediately and tell us.
- Do not exploit a vulnerability beyond the minimum needed to show that it exists.
- Do not disrupt service, degrade performance, or modify or destroy data.
- Report your findings only to Abby Care, and keep them confidential until we have had a reasonable opportunity to fix them.
Testing without written approval, or outside the scope of an approval, is unauthorized. Abby Care treats unauthorized activity as a potential violation of our Terms of Use and of applicable laws, including the Computer Fraud and Abuse Act and state computer crime statutes. We may block the source, preserve evidence, report the activity to law enforcement and regulators, notify affected parties as required by law, and pursue all available legal remedies. We reserve all of our rights.
If you believe you have found a vulnerability, or you are concerned that your own account has been compromised, contact us at security@abbycare.org. Please do not attempt to verify the issue by accessing systems or data. Include what you observed, where, and when, and we will review it.
This policy does not create any right to test our systems, and it does not waive any of Abby Care's rights. Abby Care may update it at any time.
Questions about our security practices, requests for testing approval, and security concerns all go to the same place: security@abbycare.org