Texas readies Office 365 for mission-critical police, health care data

As Texas officials move 100,000 state employees to Office 365, Microsoft is working with the state to ensure that its cloud-based messaging system meets stringent regulations for law enforcement data and health care privacy.

Compliance with Criminal Justice Information Services (CJIS) security guidelines and privacy requirements of the Health Insurance Portability and Accountability Act (HIPAA) was an important factor in the state’s selection of Office 365, said Karen Robinson, Texas CIO and executive director of the Department of Information Resources. 

Several agencies, including Texas’ Alcoholic Beverage Commission, Criminal Justice and Insurance departments, and the Health and Human Services System, require access to data that is subject to complex security and privacy regulations.

Office 365 has already been deployed across multiple state agencies, including the Health and Human Services System and Information Resources, Insurance, Motor Vehicles and Transportation departments. The Alcoholic Beverage Commission and Criminal Justice Department will come on board soon, said Todd Kimbriel, director of e-government for the Information Resources Department.

The move to Office 365 offers the state significant savings in IT spending because of greater efficiencies and increased capacity. However, Microsoft’s commitment to helping the state meet CJIS security and HIPAA privacy requirements makes the migration effort unique, Kimbriel said.

Police agencies have been cautious about moving mission-critical applications to the cloud due to security concerns, but more law enforcement officials appear to be willing to make that leap if security and reliability concerns are addressed. Police brass are considering moving more mission-critical applications to the cloud over the next two years, including those that access CJIS data, according to a recent survey by the International Association of Chiefs of Police.

CJIS databases and services are the major mechanisms for the 18,000 police departments in the nation to share information among themselves and with federal agencies. The law enforcement community helped create CJIS security policy; however, the program and associated databases are administered by the FBI.  CJIS is a cloud-compatible policy, but may be difficult for some cloud providers to follow, according to the FBI.

CJIS-compliance is a lengthy process, Kimbriel said.  “We started working with [Microsoft] in this element of the program over a year ago,” he said.  CJIS requires every cloud provider employee who touches the service infrastructure to undergo an FBI background check.  Microsoft made sure that all systems and database administrators and others working on the infrastructure passed the background checks.

Additionally, Microsoft isolated the infrastructure that will host law enforcement and other sensitive information from unauthorized individuals. Instead of a big, wide open hall, Microsoft has adopted a design much like an “apartment complex where there are a whole bunch of mini-data centers so they can physically control the infrastructure and access to that infrastructure,” Kimbriel explained. “They can place a tenant into an isolated infrastructure as appropriate.”

Microsoft has made a contractual commitment to the Texas Department of Information Resources by signing the CJIS addendum in addition to a HIPAA business associate agreement. As a result of this partnership, jurisdictions at all levels within Texas, including cities and counties, will be able to take advantage of Office 365.  The agency or customer of the cloud service provider receives the CJIS certification, but the service provider has to adhere to the standards in order for the agency to be certified, Kimbriel noted.

Meanwhile, the state is about three-quarters of the way through the transition to the cloud for e-mail and collaboration services, and should be finished by the end of the summer, Kimbriel said.  At that time, Office 365 will be audited for CJIS compliance.

The state encountered some of the challenges that many state governments and federal agencies face while transitioning thousands of employees to cloud-based messaging systems, such as training them on new technology and moving them in a way that is not disruptive to their working environment, Kimbriel said.

The move to the cloud has given some agencies the opportunity to take advantage of the new Texas.gov domain name and move away from the more cumbersome naming structure that included agency name.state.tx.us.  The newer name is more convenient for citizens to access agency websites, Kimbriel noted.

He said he expects to see significant cost-savings by moving e-mail to the cloud.  Every agency will have its own estimates of how much it will save in maintenance and other costs associated with supporting an on-premise solution. For example, the Information Resource Department, which has 200 employees, has experienced a 75 percent reduction in costs by moving e-mail to the cloud, Kimbriel said.