Fittleworth
An encryption module that protected sensitive information behind Clinical Respect, Fittleworth’s former service for nurses, GPs and commissioners.
Sensitive information, protected where it is stored
Clinical Respect was Fittleworth’s service for healthcare professionals. Its website hosted ProVIS, a free online tool that gave nurses, GPs and NHS commissioners access to dispensing data for the patients who had chosen Fittleworth as their Dispensing Appliance Contractor.
Information like that has to be protected wherever it is kept, and the site stated that security measures were in place to keep patient information confidential. Fittleworth asked us for a module that would encrypt sensitive information before it was stored and decrypt it again when the service needed it, and that module was part of how the site protected the data.
One module, used by the website and the database
In 2015 we built the module in C# on .NET. It used 256-bit Rijndael encryption, the cipher family that the AES standard is based on, with keys held in a password-protected certificate rather than in the code or the database.
The same module could be reached in two ways:
- A small web service with encrypt and decrypt functions, for the website and other applications
- Functions installed inside SQL Server, so the database could encrypt and decrypt directly within its own queries
Because both routes used one shared component, information encrypted by one could be read by the other, and errors were logged centrally.
Why it mattered
ProVIS let healthcare professionals review their patients’ dispensing data, and Clinical Respect published examples of specialist nurses using ProVIS reports to spot over-ordering and support their patients. With sensitive fields encrypted and the key held in a separate certificate, a copy of the database on its own would not reveal them.
Clinical Respect is no longer running, and this is a past project. It remains a good example of the kind of work we do for healthcare organisations: building data protection into a system from the start rather than adding it afterwards.
Protection built in
Related service: Custom Software
Related Case Studies
GINA
Luxury ecommerce. Learn how we improved the online and mobile presence of a luxury brand with a global customer base and tailored results to users' needs.
Read the story
Urban Industry
How a B2C sales platform, multichannel integration and strategic advice helped an award-winning streetwear retailer become a major online player.
Read the story
The Tri Store: Riding E-commerce Forward
A complete e-commerce rebuild for The Tri Store, a specialist in triathlon equipment, with SEO that lifted visitors and sales.
Read the story