FNHA Builds Trust in Healthcare with Scalable F5 Cybersecurity

Trust. With all the talk of zero-trust security today, it’s easy to forget the value of trust—within a community and in authorities, technology solutions, and business relationships. The First Nations Health Authority in British Columbia (BC) works to overcome issues of trust as it improves health outcomes while relying on F5 solutions and people for security, scalability, and responsive support.

The Challenge

The First Nations Health Authority (FNHA) is a nonprofit organization formed in 2013 to help more than 200 First Nations communities across the province take control to improve the health outcomes of their members. As the first of its kind in Canada—if not the world—the FNHA had to build an IT system from scratch while creating interfaces with, and accessing data from, a variety of existing health authorities at federal, provincial, and regional levels.

The technical challenges were (and continue to be) exacerbated by the lack of Internet—or even transportation—connectivity in dozens of the small, low-density, and frequently remote communities the FNHA serves. In the mountainous and island-dotted province, some of those communities and the health providers supporting them can’t be accessed by road, only boat or seaplane. Meanwhile, the human challenges include an historical lack of trust in government or quasi-government agencies—a distrust justified by decades of discrimination, neglect, and broken promises.

In this tough environment, Steven Ma has worked since 2014 to create a technology infrastructure that enables change and improves health outcomes. As the FNHA’s director of core technology, infrastructure, and cybersecurity, he works with a team of 20 to support 1,000 FNHA employees, 50 to 60 dispersed health centers, and nearly 200,000 FNHA clients. From the start, Ma decided to work with F5.

The Solution

“We had the benefit of a clean sheet,” says Ma. “When we selected our technology, we made sure it was from a technology leader and that it was scalable. That’s why we chose F5.” The FNHA initially supported its systems and services with F5 BIG-IP Local Traffic Manager (LTM) and F5 BIG-IP Access Policy Manager (APM), first as on-premises appliances and later transitioning to an F5 BIG-IP Virtual Edition (VE).

“In the early years we were focused on local traffic, implementing policies, and making sure security was in place for all our VPNs required for remote connections,” he explains. The work included support for a few legacy systems inherited from Health Canada, the federal health authority, as well as the integration of client health data from a variety of electronic medical record (EMR) systems used by the regional healthcare providers. “One struggle is interoperability, or the lack of it,” Ma says.

In addition, with telehealth on the rise, secure remote access remains a critical issue. Ma notes that 80% of the province has no cellular coverage, and satellite Internet services can cost thousands of dollars a month and still be inadequate, particularly in the most northern communities.

Nonetheless, the FNHA continues to work toward solutions while providing health services and building trust in healthcare, and it recently decided to improve its security posture with a web application firewall (WAF). Ma calls security and privacy for personal information (PI) the most critical aspects of the systems he manages. Of course, the organization must comply with regulatory guidelines for secure services, including BC’s Personal Information Protection Act. But keeping that private information safe is perhaps even more important on a psychological level as the FNHA works to build client trust among a population all too familiar with failures and betrayal.

At the same time, Ma also needed to safely open a portal to the public for employee recruitment. In less than a decade, the organization had tripled in size, and its human resources department needed a better applicant pipeline. The IT team had to make sure the public portal didn’t increase the risk of attack or loss of sensitive information.

After evaluating different solutions, the FNHA chose a virtual edition of F5 BIG-IP Advanced WAF. “It made sense,” Ma says. “We could integrate it to our existing system and load balancer, and it made more sense than having another product that we’d have to learn, implement, and support. It was a no-brainer for us.”

The implementation timing turned out to be lucky. When the global COVID-19 pandemic hit shortly afterward, the FNHA was able to operate securely with most of its employees suddenly working from home. Ma explains, “Because we had the technology in place and it was scalable, we were able to move to remote work pretty quickly and enable the organization to keep functioning.”

The Results

Enabling a secure, scalable transition to the cloud

Recently, strict provincial mandates for data residency and control have shifted, no longer requiring on-premises and in-Canada data storage and transit. That change and a foundation of F5 solutions are enabling the FNHA to transition to a cloud strategy.

“There’s been a huge pent-up demand for cloud-based services,” Ma says. “The province knew this was a real roadblock for us, so they changed the requirements, allowing us to leverage the cloud. We just have to prove we have solid authentication, security, and encryption in place.” With the demonstrated protection of F5 solutions and the agility of BIG-IP VEs, the FNHA is well positioned to take advantage of the shift.

“We know the future is going to be cloud-based,” Ma says. “So it really made sense, and knowing the product is scalable was an important F5 feature for us. Recently we’ve set up our Microsoft Azure tenant, and we’ll be investigating AWS as well. I don’t see us completely moving off the premises, but it’s a cloud-based future for us—and potentially multi-cloud as well.”

Enjoying a relationship built on responsiveness

When asked what he values most about F5, Ma cites the responsiveness of his account team. “We’ve got a fabulous relationship, and their availability has been fantastic,” he says. “They’re always available to help us, and we’ve sent a number of staff members to F5 training. We definitely appreciate the support.”

“Using technology to really benefit people”

Ma says, “Our mandate is really clear—to help improve the health outcomes of First Nations people, who for generations have been discriminated against or have not had access to good health care. They need to have that level of trust that we’re an organization built to support them.” In turn, F5 is pleased to support the FNHA. As Ma explains, “We’re not a big customer for F5, but I think your storytelling ability can enable you to share socially conscious stories like ours about using technology to really benefit people.”