Forgot your password?
typodupeerror
Encryption Privacy IT

Recourse For Draconian Encryption Requirements? 555

Posted by kdawson
from the cold-dead-fingers dept.
CryoStasis writes in with this question, which likely resulted from the new Massachusetts data security law. "I work for a major hospital in the Northeast. Recently the hospital has taken it upon itself to increase its general level of computer security. As a result they now require full-disk encryption on any computer connected to their network on site. Although I think this stance is perhaps a little over-exuberant, most of these computers are machines that have been purchased with hospital funding. In the department that I work in, however, many of the employees (myself included) bring their own personal machines to work every day. For obvious reasons we're rather reluctant to allow the hospital's IT staff to attempt installation of the encryption software. Those who have allowed the installation have had major problems afterwards, on both Macs and Windows machines — ranging from severe/total data loss to frequent crashes to general slowness — which the hospital does very little to remedy. To make matters worse, the hospital is now demanding that any machine that is used to check email (via email clients or webmail directly) be encrypted, including desktop-style machines at home, which must be brought in to the IT department, as they refuse to distribute the encryption software to the employees for install. By monitoring email access they have begun harassing employees who check email from off campus, stating that their email/login access will be disabled unless they bring in their computers. I have no intention of letting these people install anything on my machine, particularly software of which their IT staff clearly doesn't have a solid grasp. Have other Slashdot readers come across this kind of a problem? Do I have any recourse, legal or otherwise, to stop them from requiring me to install software on my personal machines?"
This discussion has been archived. No new comments can be posted.

Recourse For Draconian Encryption Requirements?

Comments Filter:
  • Obvious. (Score:5, Insightful)

    by Yamata no Orochi (1626135) on Friday April 30, 2010 @11:05AM (#32044392)

    Er. As part of the IT staff at a hospital, I can tell you they certainly can't touch your machine if you don't want them to. But they don't have to let you touch their network with your machine if you won't submit to their requirements. That's that.

    • Re:Obvious. (Score:5, Insightful)

      by xaxa (988988) on Friday April 30, 2010 @11:06AM (#32044398)

      So it's easy: either they provide you with a computer to use at home, or you stop checking your email at home.

      • Re:Obvious. (Score:5, Insightful)

        by tom17 (659054) on Friday April 30, 2010 @11:15AM (#32044578) Homepage
        this
        Too many people feel the need to take their jobs home with them. If it's a job necessity for you to do so then the company has to supply the means to do it.

        Tom...
        • I Concur (Score:5, Insightful)

          by DRAGONWEEZEL (125809) on Friday April 30, 2010 @11:58AM (#32045282) Homepage

          If you were "trying to help out" then stop. NOW. You're helping no one, using your own resources for testing? I do that as I manage a VPN client that has specific.... issues. So I use my home software to verify connectivity from other networks... But when they want info on other OS's etc, I now say Show me the H/W.

          I can't test w/ hardware that I don't have, and I'm no longer going to use my hardware to do their work.

          Not because I don't want too, but if I come into a problem (like a drive I had passed on it's bit's to the next world) I have to FURTHER use my resources to try and get back to a working state asap. This is difficult for some people to do.

          However my boss totally got it, understood what I needed and is prepping me w/ the supplies as we speak.

          Just let them know what you need. If you're expected to do any work at home, you should expect them to hand you a laptop. It's so common, it's not even worth mentioning really.

          • Re:I Concur (Score:5, Insightful)

            by rwv (1636355) on Friday April 30, 2010 @12:17PM (#32045578) Homepage Journal
            I'm posting at the top because I've never seen such a unified response to an AskSlashdot in the decade I've spent reading this site. I want to inform readers... don't waste your time reading past this point because the rest of the discussion is redundant.
      • Re:Obvious. (Score:5, Insightful)

        by buchner.johannes (1139593) on Friday April 30, 2010 @11:28AM (#32044768) Homepage Journal

        Dongles and laptops are bad for security. It is obvious that the IT department doesn't want them. Tell them you need a computer so you can stay productive, if they need control over it they should provide it.
        Why are people bringing their own equipment in the first place?

        • Re:Obvious. (Score:5, Insightful)

          by poetmatt (793785) on Friday April 30, 2010 @11:32AM (#32044826) Journal

          yeah, that should raise red flags all over.

          I mean phones, ipods, etc, that cannot be reasonably controlled. However, personal laptops at work is asking for hippa, general confidentiality issues, and general security issues all around. If people are using personal laptops on the company network that's something worth informing IT/HR, as that's a huge risk.

          All it takes is one employee with a virus and you're set for a lawsuit, or one employee with bad intentions and you've got a bunch of identity thefts.

          • Re:Obvious. (Score:5, Insightful)

            by butterflysrage (1066514) on Friday April 30, 2010 @11:35AM (#32044876)

            This... the policy isn't draconian, it is absurdly lax. No unauthorized computers should be allowed, period.

          • Re:Obvious. (Score:5, Informative)

            by Achromatic1978 (916097) <robert@chromablue . n et> on Friday April 30, 2010 @11:55AM (#32045222)
            Random pedantry, HIPAA, not HIPPA. That being said, two thumbs up. I'm amazed that anyone's allowed to connect their personal equipment to the network, as someone who writes medical software.
          • Re:Obvious. (Score:4, Insightful)

            by ceoyoyo (59147) on Friday April 30, 2010 @12:25PM (#32045680)

            Yeah, that's one way of going about it. The other way to look at it is that if all it takes is one employee with an infected device to fry your network, your network is in a pretty sorry state.

            I work in medical research. My previous lab was on a hospital network. One day someone, somewhere in the hospital brought in a notebook with a virus. Most of the machines in the hospital went down, including one of the MR scanner consoles. It was a huge crisis. Our lab barely noticed -- we were running Macs. Our Windows terminal server was properly patched and firewalled.

            Hospital IT responded by cracking down on outside devices but NOT really tightening up security on individual machines. Of course, if someone, either with malicious intent or by mistake, plugged an infected laptop into the network, they would be right back at square one.

        • Re:Obvious. (Score:5, Informative)

          by jriding (1076733) on Friday April 30, 2010 @11:35AM (#32044868)

          And what happens when you want to leave the company? Do they get to keep your laptop? or review your laptop for 3 weeks to make sure you are not taking their data with you?

          Never use personal equipment at work. They have every right to fully review your equipment at any time to decide if their data is on your person equipment.

          • Re: (Score:3, Insightful)

            by causality (777677)

            Never use personal equipment at work. They have every right to fully review your equipment at any time to decide if their data is on your person equipment.

            I disagree that they automatically have every right to do that. I will say that they'd be foolish not to make that a written agreement that must be signed before a job offer is made, if they plan to permit personal equipment to connect to their networks. In the absence of such an agreement, I don't recognize anyone's right to go through someone's perso

    • Re:Obvious. (Score:5, Insightful)

      by Daengbo (523424) <daengbo@@@gmail...com> on Friday April 30, 2010 @11:08AM (#32044456) Homepage Journal

      Their network, their rules. Stop taking your personal machine, and require them to supply you with one to do your job. Stop accessing the network after work. They cannot force you to install something on your computer, so they can't force you to connect after hours from home.

      Oh, yeah, and start looking for a new job. This stance will make your life easier, but you'll never get promoted.

      • by Z00L00K (682162)

        The only disk encryption I think is worth selecting is Truecrypt [truecrypt.org]. It's transparent and have decent performance.

        If they don't trust Truecrypt they aren't worth your time unless they pay you very well.

        • Re: (Score:3, Informative)

          by oakgrove (845019)
          If you're on Windows, Truecrypt is an excellent solution. On many Linux distros, encryption is offered out of the box using LUKS [wikipedia.org] which is very transparent and, at least on my netbook, suffers no discernible slowdowns. And for some nice two factor authentication, it can easily be set up to require a usb dongle [mknowles.com.au] in addition to the password before it will boot.
      • Re:Obvious. (Score:5, Insightful)

        by John Hasler (414242) on Friday April 30, 2010 @11:37AM (#32044902) Homepage

        Point out to them that their encryption software is not working well when installed on employee-owned machines and therefor may not be making those machines secure. Try to do this without implying that they are incompetent or that the software is crap, even though both are probably true. Also point out that some employees may be tempted to remove the software without telling them. Suggest that a better solution would be to ban private computers entirely and provide laptops to those who need off-site access. Explain to your boss that because of your concerns about the stability of the encryption software and the risks to you and to the hospital of having sensitive information on your computer that you intend to cease using your personal machines for work. Emphasize your concern about the risks to the hospital.

    • Re:Obvious. (Score:5, Insightful)

      by klubar (591384) on Friday April 30, 2010 @11:23AM (#32044706) Homepage
      I have to agree with your employer on this one.

      Disallowing private machines on the network is good IT practice. Employeers should not allow any unapproved (and non-employer supplied) device to connect to their networks or machines (and this should include all USB devices like camera, MP3 players, headsets). If you need it for your job, your employer should supply and support it.

      Most concerned and resonsible organizations use strong measures to authentic machines before they are allowed to connect to the corporate network. (They might allow guest machines is a firewalled zones for vistor/guest convenience.) I have to say that your employeers policy for no foreign machines on the network is quite reasonable. As for checking your mail remotely, there are some secure solutions for Exchange that enforce secure authentication and encryption for remote access via a web browser.

      You might suggest that your employeer supply smart phones like the Blackberry that can be used for secure email access and can be remotely monitored and wiped if comprimised. (POTUS has a BB that passed the security screen.) I wouldn't be surprised if your employer restricts these devices to only business use (as it is their money that is paying for them.)
      • by Z00L00K (682162)

        Many companies/governmental institutions require the consultants to provide their own hardware since they think it's cheaper.

        That also means that they do run a risk of an incoherent environment, but it's their headache.

        • by DragonWriter (970822) on Friday April 30, 2010 @12:41PM (#32045930)

          Many companies/governmental institutions require the consultants to provide their own hardware since they think it's cheaper.

          Many also do it because whether or not someone you pay to do work uses tools you provide or brings their own tools is one of 20 factors specifically identified by the IRS as being used to determine whether a person paid to do work for you is an "employee" for whom you are required to withhold income taxes, pay the employer's share and withhold the employee's share of payroll taxes, etc., or an "independent contractor" to which none of those rules apply. Using the employers tools is a factor that specifically weighs in favor of finding that the worker is an employee, not an independent contractor.

          Merely calling someone a "consultant" or "contractor" doesn't make the government see them that way, and employers who want someone to legally have "contractor" status generally want to do everything possible to assure that if that status is ever challenged, either by the worker or the government, the employers position that the worker is a "contractor" is upheld.

  • Make lemonade (Score:5, Insightful)

    by smallfries (601545) on Friday April 30, 2010 @11:06AM (#32044396) Homepage

    Stop reading work email at home. Problem solved, and it turns out that it is actually a blessing in disguise.

  • by drinkypoo (153816) <martin.espinoza@gmail.com> on Friday April 30, 2010 @11:06AM (#32044400) Homepage Journal

    Just stop. If you need a portable machine that will be repeatedly connected to their network, make them assign you one. Alternately, ask them to sign a form claiming responsibility for any problem with your laptop, promising to pay for data recovery services should their software cause you some problem with your data, et cetera. But if I were them, I'd tell you to fuck off.

    You provided no argument as to why you should need to bring your own machine to work, so this is by far the most rational solution.

    • by Jer (18391) on Friday April 30, 2010 @11:11AM (#32044514) Homepage

      This. Without an argument for why your personal machine should be on a sensitive network we can't help you.

      I'm slightly disturbed that there's a hospital out there that apparently allows employees unfettered access to their network from their personal machines, actually.

      • Re: (Score:3, Insightful)

        by mprinkey (1434)

        I second this. We have a secured LAN with several large Linux clusters and a few dozen workstations, also mostly Linux. Some of the users have been issued laptops running Windows (over our objection). We secured them and regularly update antivirus and firewall software, but since the users needs admin access (over our objections), they still carry viruses and other malware on site. It is not a constant problem, but it is a persistent one. We were considering building a DMZ for all laptop users to limit

      • Re: (Score:3, Insightful)

        by causality (777677)

        This. Without an argument for why your personal machine should be on a sensitive network we can't help you.

        I'm slightly disturbed that there's a hospital out there that apparently allows employees unfettered access to their network from their personal machines, actually.

        Apparently they get used to that and it spoils them. Now that they're spoiled, when you fix the situation by implementing reasonable controls for sensitive data, they get upset at the new restrictions and start Ask Slashdot discussions about their unwillingness to deal with them.

        I've personally worked in offices that dealt with sensitive data. What I dealt with was less sensitive than medical records, yet we had IT policies like this one and they were considered basic measures. Employees who needed to

      • by khasim (1285) <brandioch.conner@gmail.com> on Friday April 30, 2010 @11:29AM (#32044778)

        If there is someone there who insists that home machine be allowed on the network (beyond stupid in the first place) this might be the "compromise" that the IT department was able to reach.

        You can have your home machine on the network ... BUT ... it must have full disk encryption.

        Most everyone will be able to figure out that that means "leave your home computer at home".

    • by pesho (843750) on Friday April 30, 2010 @12:06PM (#32045404)

      My guess is that he is an a setup that I have seen on multiple places around the country - a research or university hospital. The network layouts were designed out at time when there where no data protection laws and little electronic patient records. As a result over the years machines that host the patient records now end up on the same network that hosts machines used for research, including everybody's personal laptop. Now the new and very appropriate data protection laws come into effect and the managment and IT staff have three choices:

      1. Spend tons of money on complete overhaul that will separate the patient records and the machines that process them from the rest of the network. This includes putting interfaces that would allow aggregate anonymized data to be accessed from the outside for population, epidemiological and other types of research.

      2. Encrypt everything that ever touches the network.

      3. Shut down the hospital or the research

      Which option would you choose?

      At the places where I have been very few of the postdoc and grad students have a computer that is purchased by the employer. Even if they do they still need to bring their personal laptop for various reasons directly connected to their work or study. I am currently doing research at a place like that and the security measures although not as draconian as in the article, are interfering seriously with my work. I never touch anything even remotely related to patients, but I need to exchange large chunks of data with colleagues around the world, have remote access to the local network, etc. Based on my experience I would advise the poster to calm down, and not lash out at the poor IT staff that has to deploy all this, while dealing with the anger of everybody around. You need to talk to people that are higher at the pay scale, define well the problem that you are facing and work with them to solve it.

  • by Tim C (15259) on Friday April 30, 2010 @11:06AM (#32044404)

    But be aware that it's their network, and expect them to refuse to allow you to connect to it.

    The real solution is that if you need a machine for your job, they should be providing it to you. If you do not, then leave it at home.

  • No. (Score:5, Informative)

    by characterZer0 (138196) on Friday April 30, 2010 @11:06AM (#32044414)

    If they tell you that for security reasons you cannot connect your computer to their network unless you follow their guidelines, either follow their guidelines or leave your computer at home.

    • ...I bet the encryption software is for Windows and MacOS only. Install Linux on a laptop, using a full disk encryption filesystem to be compliant. Install a copy of WINE and QVWM95 so that the IT staff see a Windows-like GUI that can run Windows software. Once they're done messing with the machine, you will still have Linux with all the capabilities of Linux and all the speed and reliability of Linux, with no risk of harm from the hospital software, and no risk of liability as (a) you let the software be i

  • Just say no. (Score:4, Insightful)

    by gus goose (306978) on Friday April 30, 2010 @11:07AM (#32044420) Journal

    If they insist on your home machine being encrypted, then tell them either:
    1. They must supply the machine, and it's theirs, and you'll only use it for work.
    2. refuse to do any work at home.

    gus

    • Re: (Score:3, Interesting)

      by ProdigyPuNk (614140)
      You realize that in the real world such harsh actions very rarely end with any type of benefit for the employee, right ? Might as well just quit. He works on a network with people's sensitive medical records. Myself, along with millions of other Americans, applaud hospitals and other institutions for NOT letting these kinds of shenanigans go on. That's why HIPAA was created, love it or hate it.
      • by gus goose (306978)

        Uhhhm, yes. I realize that. But, in this case the benefit is not supposed to be for the employee. The 'benefit' is that the data is secure. it is already acknowledged that the process is slow and fragile.

        Which is exactly why you just say no. The assumption being that 'work' has better handle on what's right, and if they insist on doing things in a certain manner (for whatever reason - including that it's the best way to do things), then you say 'fine', but to support that then work must provide the resource

  • Get an old machine (Score:5, Insightful)

    by Angst Badger (8636) on Friday April 30, 2010 @11:07AM (#32044428)

    Considering that decent used laptops -- adequate for checking mail and browsing the web, anyway -- can be had for about a hundred bucks, I'd just buy one off eBay or Craigslist and use that for work purposes. For a little more, you could always pick up a netbook or a bottom-of-the-line laptop new.

  • by ageoffri (723674) on Friday April 30, 2010 @11:07AM (#32044434)
    If you don't want to follow security standards then don't check your email from your personal machine. If they make it a requirement that you be able to respond to email outside of the physical location then require a laptop. I really doubt you have any legal recourse, especially since HIPPA and PII data have so many additional requirements around them.
  • by Slashdot Parent (995749) on Friday April 30, 2010 @11:07AM (#32044436)

    Why do you need to use your personal computer equipment to do your job? Your employer should be supplying everything you need to do your job.

    If you need a computer at work, your employer should supply it.

    If you need to check email from home, your employer should supply you with a blackberry.

    This isn't rocket surgery.

  • Use it for nothing else. They can't mess up your personal machine or lose your data if they don't get their paws on it.
  • They should be using web-based email, that way the mail leaves their servers.

  • by Nursie (632944) on Friday April 30, 2010 @11:08AM (#32044460)

    It's that simple.

    Any business would be mad to let sensitive data (especially medical) get onto employee's home machines. And bringing personal machines to work and hooking them up the network?

    You're a walking, talking, security nightmare. Your IT staff should be fired for not being harsh enough. NO personal laptops on the network. NO accessing email from home machines.

    • by oatworm (969674)
      Agreed. Installing encryption software on the personal machine isn't even sufficient - the IT department should maintain a known good "white list" image with all of the required software needed to work in the hospital and nothing else extra. Furthermore, it should be on known good "white list" hardware that's been audited for hardware-related security breaches and can be remotely killed in the event of compromise.

      Allowing personal equipment on a hospital network is extremely irresponsible. Personally,
  • by DiSKiLLeR (17651) on Friday April 30, 2010 @11:09AM (#32044464) Homepage Journal

    Its their network, their policy... be lucky you are even ALLOWED to connect your own personal laptop to their network, that is strictly forbidden for security reasons in most places.

    If you don't want them to install that software on your personal machine, don't bring it in or don't connect it to their network and use 3G or something.

    As soon as you connect to their network you must abide by their rules.

    Simple as that, really.

    (I'm a Network Administrator IRL.)

  • Honestly... (Score:4, Insightful)

    by ProdigyPuNk (614140) on Friday April 30, 2010 @11:10AM (#32044500) Journal
    This is one of those "damned if you do, damned if you don't" situations. The hospital is just trying to stay in compliance with HIPAA and the various personal non-public information regulations. Their solution DOES seem a little overboard, but this is what happens when people continually lose laptops/usb drives/etc that contain sensitive information. While this might be a little hard for the hospital's employees to get used to, it's really a win for us normal folk (assuming it's all properly executed, which is a big assumption).

    As far as legal recourse, IANAL but I don't think you really have one. While I get the whole "You're not touching my computer" bit, why don't you just use the computers provided ? Hell, even at the community college I go to, I have to install some software just to connect to their network. Same with some of the other corporations that friends and family work for. In the end, if you weasel your way around the restrictions and then lose your laptop, have it stolen, whatever - you'll really be on the hook.
  • by Lonewolf666 (259450) on Friday April 30, 2010 @11:10AM (#32044502)

    Unless there are very good reasons that were not in TFA, my response would be:

    1) My personal computer will stay at home from now on
    2) The IT department does not install anything on my personal computer.
    3) I won't check my (work) email from my home anymore. Anyone who wants to contact me can use a phone (and better have a damn good reason if it happens at 2 a.m. in the night).

     

  • Are they paying you extra to use your own laptop at work, as they might if you were using your car for work and get a mileage allowance? If so then I'd say you probably will end up letting them install whatever they like. If not, tell them that if they want you to work within their rules, they'll need to buy you a "company" computer in order to satisfy those requirements since they aren't welcome to touch your personal machine.

    As for checking your email from home, either have them also buy you an email-c

  • As the subject says. Stop using your personal computer(s). Let management know that once you are off-site, you will no longer have email access as you are not going to install this software on your own computer. If they want you to continue to have off-site email access, they can provide you with appropriate equipment. The same goes with you bringing in your laptop to work, stop doing it, and let work provide a laptop.
  • Pretty simple (Score:5, Insightful)

    by Paul Carver (4555) on Friday April 30, 2010 @11:13AM (#32044548)

    The solution is pretty simple. Don't use personal computers for business use.

    If I'm a patient at your hospital I'm barely comfortable relying on the hospital's IT department to keep my medical information secure. I certainly don't want to rely on a myriad of clueless doctors, nurses, and miscellaneous technicians and administrators all maintaining or failing to maintain their own home computers.

    I hope that if my medical information is leaked through any hospital employee's personal computer that I will be able to sue them for millions. It's just irresponsible to leave the handling of sensitive data to the random computer skills of people who are mostly employed for their non-computer skills.

    I hope that most hospital employees are skilled in medical fields but I don't expect them to be particularly skilled with computers or to really care that much about computer security. I expect the hospital's IT department to be extremely vigilant about computer security so that the medical personnel can focus on healing patient.

     

    • You don't expect (and would run away, very fast) if other hospital workers started bringing in their own thermometers, or scalpels or things they told you were medical instruments? Why should a guy with a home computer be any different? Personally I'm glad that your hospital is starting to take a professional attitude towards its IT. Banning all non-hospital supplied (and maintained) IT equipment would be a good next step.

      Apart from them wanting to clamp down on the security elements of staff stealing or

  • Tell them to encrypt that, and use it only to check your email.

    Since they don't know how to install encryption software properly, I doubt they know how to check which laptop connects to what anyway.

  • Where employees have download up to a million customer social security numbers and identities. Many medical sites still use SS# as patient IDs.
  • Yes and No. (Score:4, Informative)

    by fuzzyfuzzyfungus (1223518) on Friday April 30, 2010 @11:16AM (#32044594) Journal
    IT can't do jack to your computer without your consent. To do so would be criminal. However, IT is under absolutely no obligation to let your computer on their network. And, while they probably can't stop you from pinging the mailserver, they can certainly stop you from logging in from an untrusted machine. Given that (I am quite sure) this process is a gigantic pain in the ass for the IT guys, they have probably been told that stopping you is their job(either under the law, or because the boss will fire them otherwise).

    You are basically at an impasse here. They can't touch your computer without your consent; but you can't touch their network without their consent, and they can make your consent a condition of their consent.

    Your options are basically as follows:
    1)Stop checking email from home/personal machine at work. If this is impractical/untenable, move on to step two.
    2)Request that, if IT wants security and management, they issue you the hardware you need to do your job. If you don't have the clout/there's no chance in hell/you'll be stuck on a Latitude CPi from 1999 if you do that, move on to step 3.
    3)Purchase a "sacrificial" notebook. A netbook or cheap CULV thin-and-light(depending on where you fall on the small size vs. screen size issue) can be had for $400 or less on any given day, depending on which models are on sale. Buy one, set up a restore disk, then let the IT department do its vile work. If their software fucks it up, run the restore and make IT do it again.
  • You "have no intention of letting these people install anything on my machine".

    And they have no intention of letting you connect your machine to their network without letting them install some things on it.

    Hence, you don't connect your machine to their network.

    You "have no intention of letting these people install anything on my machine".

    And they have no intention of letting you check your email on a machine they haven't installed some things on.

    Hence you don't check your email from your machine.

  • So they get to choose who connects to it. Simple as that. If you want to bring a personal machine in for personal, non job related use, accept that you might not have connectivity. Most of the hospitals around here have a guest wifi, you might be able to use that, or a 3G card. For job related stuff, tell them they have to provide the equipment.

    If you have read the HIPPA laws, the penalties for leaking PII are severe. Full-disk encryption for all connected machines is probably the best way to prevent proble

  • by Anonymous Coward on Friday April 30, 2010 @11:17AM (#32044624)

    *sigh* First you bitch and moan about how everyone should encrypt everything on their computers and brag about how easy it is to do full-partition encryption and how it's oh so fucking great that there's encryption around to protect you from the sp00ks and boogeymen that dadgum gummint apparently sends after you every day (oooo, scaaaaaaary!).

    And THEN you bitch and moan when someone TELLS you to do full-scale encryption on your computers! You people are never happy, are you? THIS is why nobody takes us seriously! THIS is why we can't have nice things!

  • Yes, Sorta, No (Score:5, Informative)

    by Anonymous Coward on Friday April 30, 2010 @11:19AM (#32044640)

    I manage security for a major hospital system and I am leading the encryption roll out.

    1. Encryption is "safe harbor" meaning that if the device is lost or stolen, you don't have to notify HHS or the patients.

    2. Notification costs MAJOR dollars plus the PR hit

    3. As of ARRA/HITECH, _YOU_ are PERSONALLY liable in the case of WILLFUL NEGLECT. To give you an example of how broad this can be, I have met the Deputy Director for Clinical Information Privacy at HHS... and she says that password sharing is willful neglect. We both know that password sharing is more than common in the medical industry (doctors don't login, they tell someone to login)... So take this point and run with it... you left your laptop in your car overnight? It was stolen? Willful Neglect. Notify the world, and pay the fines, and possibly endure criminal charges.

    4. You should not be using your personal device and you need to get used to the fact that the PHI you view is NOT YOURS. It belongs to the PATIENT.

    This is a HUGE shift for the medical industry, and frankly, if people knew just how bad security was, they would call for heads. It's starting to change, but it will take time. Doctors and clinicians are not animals that like change. I will be the first to admit that encryption has a steep curve, and it can break things... but you better adapt or your State Attorney General will come for you... (State AG's are charged with enforcing both their own state's legislation as well as the new federal regs)

    Bottom line: you are responsible. Leave your personal equipment at home. /posting anonymously because I don't remember the password to my 5 digit slashdot id.

  • I'd probably just get another cheap-ass, used computer strictly for the purposes of checking email from home, etc (I have two or three sitting in the garage right now that would work). Let them put their software on THAT machine.

  • Don't use your personal machine for work.
    Have them supply an appropriate laptop or desktop to do the job.

    If you work as a contractor and believe it would be possible, you could get the name of the software they are using, or other software which they would approve and do it yourself. This is the approach I would take on my machine if the rules were being imposed. No-one other than me installs software on it and I want the recourse to deal with whatever company wrote the software in the event I have a proble

  • by ircmaxell (1117387) on Friday April 30, 2010 @11:20AM (#32044666) Homepage
    This all boils down to misinterpretation of the laws governing medical information (Most importantly HIPPA - Health Insurance Privacy and Protection Act)... They don't need every machine being encrypted. All they need to do is make sure that the medical information is encrypted. And encrypting the hard drive has nothing to do with that. If they are providing you with web mail (something like Outlook Web Access), then what difference in reality does it make if you have your hard drive encrypted? All they need to do is set the headers properly to not allow client side caching. That way, you never have any data on your machine anyway. I don't see any reason that all the hard drives in the facility need to be encrypted. If they wanted to create an encrypted data partition, sure. If they want to encrypt laptops, fine. But why is sensitive data stored on local computers anyway? That should all reside on an encrypted network share (if for nothing else than data backup and compliance reasons). All they are doing is trying to cover their asses so that in case something does happen, they can say "well, but we took steps to try to lock down the data" even if those steps were ancillary and irrelevant to the problem at hand.

    But in your case, there's a clear cut solution. Company policy says you need to only access their information from an encrypted computer. That leaves you with four options.
    • Encrypt your personal computer
    • Get a second computer just for work, and encrypt that
    • Have your employer provide you with a laptop or computer to take home to work with
    • Don't work from home

    Don't forget, no matter how stupid you think the policy is (or it may actually be), it's still your job to abide by them (unless you have the power to change them, which it doesn't seem you do). So either comply, or don't. If you chose not to, realize that you may be let go... It's as simple as that.

    • by idontgno (624372)

      HIPPA - Health Insurance Privacy and Protection Act

      You got the acronym wrong (although a lot of people do), and then synthesized a non-existent name to expand it. You get credit for thoroughness.

      Health Insurance Portability and Accountability Act [wikipedia.org]

      No mention of privacy in the title. All patient privacy stuff is the included Privacy Rule section (Section 264), although the law itself is devoid of actual standards and guidance. That was all added administratively after the fact.

    • Re: (Score:3, Insightful)

      by cgenman (325138)

      From my time in IT, I guarantee that at least 1 in 10 of those personal laptops is compromised in a major way. You can encrypt the hard drive against physical theft, but you can't encrypt the OS against being rooted. Personally I'm shocked they let private data on personal laptops at all.

  • Simple solution (Score:4, Insightful)

    by idontgno (624372) on Friday April 30, 2010 @11:21AM (#32044674) Journal

    Keep your personal machine off the Hospital network.

    The only really sane policy: if it's on the Hospital network, it conforms to IT security guidance. Period.

    I'm assuming you're in the U.S. "Exuberant" is an apt description of HIPAA [wikipedia.org] data infrastructure guidance, but it's still the law of the land. I don't want my patient information accidentally sneaking out on your laptop's unencrypted hard drive.

    If you must conduct personal internet business at work and don't want to convert your personal computer into a personally-owned company-configured machine, bypass the hospital net with a 3g dongle and your own data plan.

  • I once worked with a fellow who worked long hours, including weekends, just of his own volition. Once, his management demanded that he come in and work on a Saturday. From that day forward, he only worked overtime when demanded by his management. Belligerent obedience. When asking for more pay, he was told "we pay average", so he replied "then I will give you average work". Belligerent obedience.

    I'm not sure I'd suggest being that extreme, but you should consider why are you funding your employer's
  • Perhaps you could suggest they provide two networks. One secure network that requires the full disk encryption and allows access to patient records etc. to which the hospital provides all client workstations for work use and a second guest network for everything else that doesn't require the encryption. If you make the guest network open to patients and their visitors as well then it might even be possible to at least partly fund the installation with a pay for access scheme. You'd probably want to push
  • Standard Policy (Score:5, Insightful)

    by mseeger (40923) on Friday April 30, 2010 @11:25AM (#32044722)

    Hi,

    IMHO a private PC has nothing to do inside any enterprise (>1.000 PCs) network. If a PC of an employee/consultant/customer is used, he is placed in a special DMZ. From there he can connect (e.g. by SSL-VPN) to the company network. He has only access to certain ressources. The access to the ressources may vary with "type of authentication", "security level of the pc", etc. Certain actions (e.g. transfer of files) are only allowed through clearing points.

    Installing any kind of endpoint security (disk encrpytion, desktop firewall) on a private PC by an enterprise is a recipe for disaster. I am doing endpoint security concepts and projects for several years now. An exact inventory of OS, Hardware, Software installed, etc. is an absolute key element for such a project to succeed. If you use a "this software works for all platforms" approach, the support effort will usually kill you ten times over. Even the best software (Check Point FDE for Enterprises, Truecrypt for private users) has many dependencies: The virus scanner may prevent the boot sector to be written, the keyboard may not be recognised correctly by the Preboot-Auth-Code, certain Boot-Loader may not be interoperable with product of choice or you just may be unlucky.

    It is probably cheaper for an enterpise to give a worklplace (e.g. Thin Client, SunRay or cheap Notebook) to an employee (even a temp) than trying to fix his security for or against him

    Sincerely yours, Martin

    P.S. This is a very, very short summary.... A complete account of experiences and ideas would require days to type. When a customer wants an introduction into the topic, i usually start with an 2-4 hour presentation.

  • If they're going to insist on this type of software, then stop using your personal machines to connect to the network or check your email at home.

    If they really want you to check your email, demand that they provide hardware that meets with their approval to do so.

  • Do not use your personal computer for work. Do not use your work computer for fun. You are asking for trouble.

    If you are a contractor or such, you should already have your hard drive encrypted. Provide the facility with evidence that your hard drive is encrypted.

    There is no good excuse, in 2010, to not have the hard drive of your computers encrypted. Operating systems should be encrypting hard drives by default during installation. The only exception is if they are servers sitting in a physically secured da

  • And I am glad! (Score:3, Interesting)

    by goffster (1104287) on Friday April 30, 2010 @11:47AM (#32045072)

    People who use their own personal machines to access sensitive information should perhaps be
    even *more* restrictive. It is this type of access that is the most dangerous.

    If you simply have to check your facebook, check email, etc, then get yourself
    a 3G network enabled device.

  • by c0d3g33k (102699) on Friday April 30, 2010 @12:52PM (#32046110)
    Yes. Quit.
  • by rickb928 (945187) on Friday April 30, 2010 @02:05PM (#32047118) Homepage Journal

    "In the department that I work in, however, many of the employees (myself included) bring their own personal machines to work every day."

    The IT department made a mistake there. Not acceptable to allow confidential data on a private machine. Their error, not yours. If your department doesn't have budget for IT services, perhaps it needs to be managed properly or shut down. Obviously, they will manage it properly.

    "the hospital is now demanding that any machine that is used to check email (via email clients or webmail directly) be encrypted", including desktop-style machines at home"

    BlackBerry Problem solved. If they balk at handing out BBs, then you don't need offsite or portable email access. Problem solved.

    I'm astonished that they let you bring your own machine in to do work with confidential data. Entirely unacceptable, no matter how diligent you are about your machine's security. It is responsible. They cannot be responsible if they don't control the environment, including the hardware and software. I'm equally astonished they aren't using a VPN with certificates.

    But I am not unfamiliar with Massachusetts hospitals, so I am not greatly astonished. One Boston-area hospital got a cool teleradiology contract with a hospital I worked at back in the 90s, and gave us the stern lectures about security, data encryption, etc. And emailed the user IDs and passwords to everyone on the department mailing list, even the CEO and CFO. Nice, guys. How about taking out an ad in the Globe next time, ok? It would be safer, nobody reads that.

  • by James Youngman (3732) <jay.gnu@org> on Saturday May 01, 2010 @11:05AM (#32056152) Homepage

    If a major hospital is letting people roll up and connect personal (i.e. uncontrolled) laptops to their internal networks, the information security team/officer there is either incompetent or being ignored. They should take responsibility for making sure neither of those things is happening.

    As for the OP, they seem to me to be recklessly endangering the security of patient data. People's personal laptops have all kinds of scary cruft on them. Seventeen different kinds of malware, if they run Windows, probably.

"We learn from history that we learn nothing from history." -- George Bernard Shaw

Working...