Case Study

10 Million Members. Six PKI Gaps. One Healthcare PKI Rebuild.

How Encryption Consulting designed and implemented a two-tier Microsoft PKI for Texas’s largest health benefits provider to meet HIPAA Technical Safeguard and FIPS requirements and close critical security gaps.

Customer Profile

Texas’s largest health benefits provider, serving ~10 million members through 150,000+ physicians and 500+ hospitals. Offers individual, employer, Medicaid, Medicare Advantage, dental, and vision plans, with over a century of service in clinical care and community health.

Industry

Healthcare & Health Insurance

Engagement Type

PKI Implementation & Infrastructure Deployment

Download Case Study

At a Glance Outcome

2-Tier

Microsoft PKI architecture deployed with offline Root CA

HSM

Root and Issuing CA keys secured in tamper-resistant hardware

Compliant

HIPAA and FIPS-aligned key ceremony delivered

NDES

Secure mobile enrollment with real-time OCSP certificate revocation

The Enterprise

Challenges

As the client's digital services expanded, six weaknesses in their hybrid PKI environment came into focus: an exposed Root CA, unprotected private keys, missing governance controls, and gaps in resilience planning.

Root CA online, domain-joined, and exposed

An online, domain-joined Root CA exposed to network threats, privilege escalation, and domain compromise, against industry and compliance norms.

01 INFRASTRUCTURE

Private keys stored in file system, not HSMs

Root and Issuing CA private keys sat in an encrypted file system instead of HSMs. Leaked keys or a compromised server would expose them.

02 KEY SECURITY

No key custodian matrix or separation of duties

No custodian matrix on Root or Issuing CA. A single admin could change keys unsupervised, raising insider-threat and unauthorized-change risk.

03 ACCESS CONTROL

Six gaps, one trust chain. Every weakness traced back to the same Root CA, so the fix had to start there, then rebuild outward.

Encryption Consulting Assessment Team

PRE-IMPLEMENTATION ASSESSMENT | ENCRYPTION CONSULTING · PKI SERVICES

Our Offered

Solutions

The engagement ran four workstreams across four phases: assessment and design, build and implementation, functional testing, and knowledge transfer.

Capability 01

PKI Architecture Design & Planning

Assessed the crypto environment (SSL/TLS, S/MIME, client/server auth, code signing) and finalized the design, tasks, and timelines with the client.

Capability 02

HSM Integration & Key Ceremony

Ran a HIPAA/FIPS key ceremony, moved Root and Issuing CA private keys into tamper-proof HSMs, and stood up a custodian matrix for multi-party key approval.

Capability 03

Two-Tier Microsoft PKI Deployment

Deployed a two-tier Microsoft PKI (offline Root + two subordinate CAs) with CAPolicy.inf, PathLength, and shortened validity, plus NDES/WAP mobile issuance, OCSP, and self-signed controls.

Capability 04

DR Planning & Knowledge Transfer

Delivered PKI documentation (architecture, key ceremony, CP, CPS) and a DR/BCP with backups, redundancy, and failover; ran knowledge-transfer on PKI and DR operations.

The result was a compliant, resilient, and scalable PKI infrastructure, purpose-built to protect the sensitive health data of millions of members and support the organization’s growth for decades ahead.

Encryption Consulting Assessment Team

ENGAGEMENT SUMMARY | ENCRYPTION CONSULTING · PKI SERVICES

The Overall

Business Outcome

With the two-tier Microsoft PKI in place, the client closed the structural vulnerabilities, met HIPAA and FIPS requirements, and now has a security foundation that protects 10 million members and scales as the organization grows.

PKI trust chain fully secured

Offline Root CA, HSM key storage, and a custodian matrix closed the prior exposure, cutting insider threat, misconfiguration, and unauthorized access to member health data.

HIPAA and FIPS compliance achieved

Key ceremony, HSMs, CP/CPS, and two-tier architecture met HIPAA and FIPS requirements; documentation and knowledge transfer enabled independent operation.

Lifecycle control and resilience established

Shorter validity, self-signed guidelines, lifecycle tracking, and NDES ended expiration outages and simplified mobile provisioning; DR/BCP ensured fast recovery and continuity.

Discover Our

Latest Resources

Uncategorized

Multi-Cloud PKIaaS Architecture Guide for AWS, Azure, and GCP

A technical architecture guide for deploying PKIaaS across AWS, Azure, GCP, Kubernetes, service mesh, and on-premises environments. Covers certificate issuance patterns, enrollment protocol mapping per cloud, cert-manager integration, Istio and Linkerd mTLS, HashiCorp Vault PKI engine, and unified CLM across a multi-cloud estate.

view all blogs

PKIaaS Architecture Patterns for Kubernetes and Cloud-Native Workloads

PKIaaS Deployment Models Explained: Vendor-Hosted, Customer-Hosted, Hybrid, and Air-Gapped

The CertSecure MCP Server: Agentic AI for CLM, With Governance Built In

White Paper

The 47-Day Certificate & Post-Quantum Readiness Playbook

Navigate the 47-day certificate validity era and post-quantum cryptography with a practical readiness playbook covering deadlines, automation, ownership, exceptions, and ROI.

view all white papers

The PQC Control Guide 2026

Cryptographic Bill of Materials (CBOM) Solutions

The Cert Wars: The Race Against Expiry

Video

Introducing MCP Server for Certificate Lifecycle Management (CLM) | AI-Powered CertSecure Manager

Explore expert insights on cybersecurity, PKI, and post-quantum readiness, with practical guidance to strengthen security and future-proof cryptography.

Watch Now

view all videos

Navigating PQC Code Signing: Architectural Strategies for Software Supply Chain Integrity

The End of clientAuth in Public TLS: What It Breaks and How to Prepare

The Claude Mythos Cryptanalysis Findings Explained: What AI Found in HAWK and Reduced-Round AES