Case Study

Unencrypted Databases. One Shared Key. A Healthcare Provider's Path to FIPS 140-2 Compliance

How Encryption Consulting assessed a 20,000-employee US healthcare provider’s cryptographic infrastructure, found gaps in encryption, key management, and access controls, and guided the organization to FIPS 140-2 certification.

Customer Profile

A leading US healthcare provider offering health insurance and services nationally and internationally. Manages a global database of thousands of clients and their confidential information across multiple locations with 20,000+ employees, in regular communication with hospitals and clinics.

Industry

Healthcare (Health Insurance & Services)

Engagement Type

FIPS 140-2 Compliance Assessment & Remediation Guidance

Download Case Study

At a Glance Outcome

FIPS 140-2

Compliance certification achieved

20,000+

Employees under strengthened cryptographic standards

AES 256

RSA-2048 data-at-rest encryption implemented

TLS 1.2+

Minimum protocol enforced for data-in-transit

The Enterprise

Challenges

The organization needed a gap assessment of its cryptographic environment against FIPS 140-2 standards. The assessment revealed gaps across database encryption, key management, access controls, and cryptographic standards that left sensitive patient data exposed.

Sensitive databases with no encryption

Multiple Oracle and SQL Server databases stored sensitive PII and PHI data without encryption, leaving patient information unprotected against unauthorized access or breach.

01 Encryption

Single encryption key shared across all applications

One encryption key was used to encrypt data across multiple applications, services, and backup databases. A single compromise would give an attacker access to every system sharing that key, so a breach could cascade across all of them.

02 Key Management

No RBAC or IAM controls

The organization lacked role-based access control and identity-based access management. Users were granted more access than needed, making it too easy to reach sensitive keys and information without appropriate authorization.

03 Access Control

The organization’s cryptographic environment had grown without a compliance-focused strategy. The assessment provided the clarity needed to identify every gap and build a structured path to FIPS 140-2 certification.

Encryption Consulting

Engagement Summary · Encryption Consulting · Compliance Services

Our Offered

Solutions

The engagement delivered a gap analysis against FIPS 140-2 standards, studied data flow diagrams from ingress to egress across all in-scope applications, and provided specific recommendations for every identified gap. The result: a clear path to compliance.

Capability 01

Gap Analysis & Cryptographic Policy Alignment

Mapped each application’s data flows at rest and in transit and assessed cryptographic controls against FIPS 140-2. Policies were updated, outdated algorithms replaced, and module specifications defined to ensure FIPS-aligned practices going forward.

Capability 02

Encryption Standards & Key Isolation

Recommended AES-256/RSA-2048 for data-at-rest and TLS 1.2+ for data-in-transit. Unique keys per application and resource isolate systems so a single compromise cannot cascade across the environment.

Capability 03

Access Control, Authentication & Least Privilege

Recommended RBAC and IAM with least privilege for key management across on-premises and cloud environments, with required and optional roles logically separated. MFA advised for all cryptographic system and key management access.

Capability 04

Key Lifecycle Management & Design Assurance

Recommended a secure key lifecycle covering generation using random number generators, distribution, rotation with defined validity periods, revocation, and HSM/key vault storage with usage monitoring. Design assurance documentation captured each application’s module design, implementation, and operational environment.

The result was a comprehensive remediation roadmap that aligned the organization’s cryptographic infrastructure with FIPS 140-2, updated every outdated algorithm, isolated every shared key, and established the governance needed to maintain compliance long-term.

Encryption Consulting

Engagement Summary · Encryption Consulting · Compliance Services

The Overall

Business Outcome

The assessment and remediation guidance brought the organization to FIPS 140-2 compliance, with a stronger security posture, better protection for patient information, and a foundation for long-term growth and innovation.

FIPS 140-2 certification achieved

Standardized encryption and security measures now align with FIPS 140-2. A compliance attestation certificate was delivered to confirm the organization’s commitment to protecting sensitive information and reducing breach and regulatory risk.

New partnership opportunities unlocked

FIPS 140-2 compliance unlocked new partnerships with technology suppliers and healthcare providers who require certified security standards for collaboration.

Security best practices embedded for long-term compliance

Security best practices are now embedded in daily operations, reducing future non-compliance risk. The organization can now focus on quality care while remaining secure, compliant, and ready for new threats.

Discover Our

Latest Resources

Education Center

Securing Machine Identities in Kubernetes in a Zero Trust World

Secure machine identities in Kubernetes with Zero Trust: bound service account tokens, mTLS, cert-manager, SPIFFE/SPIRE, and 47-day certificate readiness.

view all blogs

What Is Zero Trust Security?

Difference Between Azure and AWS DevOps

Management of Digital Certificates and Keys in DevOps

White Paper

The Cert Wars: The Race Against Expiry

One expired certificate (cert) can bring operations to a halt. Discover how to prevent outages and manage certificate expiry before it impacts your business.

view all white papers

Post-Quantum Cryptography for Finance: Threats, Standards, and the Road to 2035

FIPS 140-3 Migration: The Complete Guide to Meeting the September 21, 2026 Deadline

The PQC Signature Selection Playbook

Video

The 2029 Convergence: Why Microsoft, Google, and Cloudflare All Chose the Same PQC Deadline

Explore expert insights on cybersecurity, PKI, and post-quantum readiness, with practical guidance to strengthen security and future-proof cryptography.

Watch Now

view all videos

The Quantum Mandate Explained: What the 2026 Executive Order Means for Post Quantum Cryptography

Decoding Post-Quantum Security on the International Space Station (Part 2) | What It Means For You

Decoding Post-Quantum Security on the International Space Station