Principles
FiveGuardian5 is designed to protect the organization's and its patients' information, collecting only what is needed for security and compliance. This page explains, in general terms, what is recorded and what is not.
What FiveGuardian5 does not do
- It does not inspect the content of encrypted traffic. FiveGuardian5 does not read the content of your emails, documents, encrypted web pages or applications.
- It does not record what you type or take screenshots of your screen.
What FiveGuardian5 records
For network security and HIPAA compliance, FiveGuardian5 can record:
- Connection metadata: with the Traffic Events module, when it is active in your organization, which device connected, when, to which destination and over which protocol, without the content. See Traffic Events.
- Audit events: administrative changes and sign-ins. See Activity and auditing.
- Device information: name, operating system, client version and connection status.
Access to these records is limited to authorized people in the organization and the FiveGuardian5 support team, for security, support and compliance purposes.
Retention
Retention periods are defined with each organization according to its compliance obligations; to learn or adjust them, contact Support. Expiration of a premium module license does not delete data; see Licensing.
How FiveGuardian5 supports HIPAA compliance
- Encryption in transit: outside the office, traffic is designed to travel through an encrypted tunnel; by default, without the tunnel up, internet access is blocked except for what is needed to reconnect.
- Access control: access to resources is granted by identity, group and explicit policies.
- Authentication: sign-in with the company account; two-step verification when the organization requires it.
- Audit controls: records of administrative changes and, with the Traffic Events module when it is active in your organization, of network activity.
- Malware protection: DNS filtering of malicious domains.
FiveGuardian5 is one part of the organization's compliance program; it does not replace it. Internal policies, training and risk management remain the organization's responsibility.
Shared responsibilities
- FiveGuardian5: operation, availability and security of the platform; installing and updating the protection together with your IT team.
- Organization administrators: managing users, groups and policies; periodic review of access and events.
- Users: protecting their account, not sharing credentials and reporting incidents or lost devices immediately to Support.