You can sleep peacefully

This also applies to the tools used in providing care. We need to trust that the electrocardiograph and glucose meter produce reliable results; otherwise, they would be simply and utterly useless.

And since IT tools began being used in healthcare — especially those that use cloud computing — we now need to trust their security as information systems. We need to trust their cybersecurity.

But what does cybersecurity really mean?

We usually talk about three complementary aspects:

1. Data confidentiality. Are those who have access to information explicitly authorized by its owner to access it?
2. Data integrity. Can we be sure that data has not been altered or deleted without authorization?
3. Data availability. Is the system that provides access to data available when we need it?

When we see headlines about a massive data breach and the possibility that citizens' data may be published on illicit websites, we are talking about a breach of the 1st point.

When we instead hear about an attack in which businesses or institutions are forced to pay a ransom or face the permanent deletion of their data, we are talking about a breach of the 2nd point.

And finally, when we wake up one morning and a crucial website is no longer responding, and the entire Internet seems to have stopped working, we are talking about a breach of the 3rd point.

The last point is less of a focus in this article, because it is a quality achieved through modern software engineering and good practices. We are never completely immune to an outage, but we can work to minimize its effects and aim for a quick recovery when one occurs.

Absolute respect for data confidentiality and integrity

At Braver, we believe that data confidentiality and integrity are fundamental to building the bond of trust we seek to establish with the community of healthcare professionals. We guarantee that data exchanged on Braver is safe, both in terms of confidentiality and integrity.

And how are we different from others?

Normally, when a service provider holds a large amount of sensitive information belonging to its users, it commits to protecting it as best it can through access control. This control is exercised using protective rules, enforced by software components, such as:

• Only user X can view data Y and Z
• Only users in group A can modify data B and C

The problem with rules like these is that, unfortunately, it is always possible to bypass them. A company employee could find a way to obtain the required privileges (as happened in the Desjardins case) and misuse them. Or a hacker could find an unexpected route to the data where the rules are not enforced.

We also have this kind of access control, but at Braver, we consider it insufficient. We ensure that even if someone managed to bypass the rules, they could not view sensitive content and could not modify or delete content. This applies equally to a Braver employee and to a hacker.

To achieve this, we use two complementary technologies:

• We end-to-end encrypt the content exchanged using variable keys that Braver does not possess, somewhat like Signal.
• We use blockchains to verify that exchanged content has not been modified or deleted, and that it was indeed produced by the identified person.

Each of these two measures would deserve an article of its own to explain it more accessibly, but in brief, they guarantee that:

1. It is impossible for us, or for anyone not explicitly authorized by a user, to access the content that user has exchanged on Braver (unless they impersonate the user, which is why two-factor authentication is enabled for all Braver users).
2. It is impossible for us, or for anyone, to modify or delete information exchanged on Braver without leaving a trace.

And what does all this give us?

First of all, as of today, Braver is the first and only open messaging tool to have obtained TGV certification from Quebec's Ministère de la Santé et des Services Sociaux. This therefore authorizes healthcare professionals in the public network to use Braver for clinical communication, in compliance with their code of ethics.

Together with other security measures we have deployed, this also enabled us to obtain a virtually flawless penetration test report in winter 2021 (which we can provide on request).

But above all, and ultimately this is why we did it, it allows us to state confidently that our healthcare professional users can sleep peacefully.