Recourse For Draconian Encryption Requirements? 555
CryoStasis writes in with this question, which likely resulted from the new Massachusetts data security law. "I work for a major hospital in the Northeast. Recently the hospital has taken it upon itself to increase its general level of computer security. As a result they now require full-disk encryption on any computer connected to their network on site. Although I think this stance is perhaps a little over-exuberant, most of these computers are machines that have been purchased with hospital funding. In the department that I work in, however, many of the employees (myself included) bring their own personal machines to work every day. For obvious reasons we're rather reluctant to allow the hospital's IT staff to attempt installation of the encryption software. Those who have allowed the installation have had major problems afterwards, on both Macs and Windows machines — ranging from severe/total data loss to frequent crashes to general slowness — which the hospital does very little to remedy. To make matters worse, the hospital is now demanding that any machine that is used to check email (via email clients or webmail directly) be encrypted, including desktop-style machines at home, which must be brought in to the IT department, as they refuse to distribute the encryption software to the employees for install. By monitoring email access they have begun harassing employees who check email from off campus, stating that their email/login access will be disabled unless they bring in their computers. I have no intention of letting these people install anything on my machine, particularly software of which their IT staff clearly doesn't have a solid grasp. Have other Slashdot readers come across this kind of a problem? Do I have any recourse, legal or otherwise, to stop them from requiring me to install software on my personal machines?"
Obvious. (Score:5, Insightful)
Er. As part of the IT staff at a hospital, I can tell you they certainly can't touch your machine if you don't want them to. But they don't have to let you touch their network with your machine if you won't submit to their requirements. That's that.
Re:Obvious. (Score:5, Insightful)
So it's easy: either they provide you with a computer to use at home, or you stop checking your email at home.
Re:Obvious. (Score:5, Insightful)
Too many people feel the need to take their jobs home with them. If it's a job necessity for you to do so then the company has to supply the means to do it.
Tom...
I Concur (Score:5, Insightful)
If you were "trying to help out" then stop. NOW. You're helping no one, using your own resources for testing? I do that as I manage a VPN client that has specific.... issues. So I use my home software to verify connectivity from other networks... But when they want info on other OS's etc, I now say Show me the H/W.
I can't test w/ hardware that I don't have, and I'm no longer going to use my hardware to do their work.
Not because I don't want too, but if I come into a problem (like a drive I had passed on it's bit's to the next world) I have to FURTHER use my resources to try and get back to a working state asap. This is difficult for some people to do.
However my boss totally got it, understood what I needed and is prepping me w/ the supplies as we speak.
Just let them know what you need. If you're expected to do any work at home, you should expect them to hand you a laptop. It's so common, it's not even worth mentioning really.
Re:I Concur (Score:5, Insightful)
Re: (Score:3, Insightful)
Agreed. I'm a bit shocked at the arrogance of this Ask Slashdot:
"they now require full-disk encryption on any computer connected to their network on site....many of the employees (myself included) bring their own personal machines to work every day...Do I have any recourse, legal or otherwise, to stop them from requiring me to install software o
Re:Obvious. (Score:5, Insightful)
Dongles and laptops are bad for security. It is obvious that the IT department doesn't want them. Tell them you need a computer so you can stay productive, if they need control over it they should provide it.
Why are people bringing their own equipment in the first place?
Re:Obvious. (Score:5, Insightful)
yeah, that should raise red flags all over.
I mean phones, ipods, etc, that cannot be reasonably controlled. However, personal laptops at work is asking for hippa, general confidentiality issues, and general security issues all around. If people are using personal laptops on the company network that's something worth informing IT/HR, as that's a huge risk.
All it takes is one employee with a virus and you're set for a lawsuit, or one employee with bad intentions and you've got a bunch of identity thefts.
Re:Obvious. (Score:5, Insightful)
This... the policy isn't draconian, it is absurdly lax. No unauthorized computers should be allowed, period.
Re:Obvious. (Score:5, Informative)
Re:Obvious. (Score:4, Insightful)
Yeah, that's one way of going about it. The other way to look at it is that if all it takes is one employee with an infected device to fry your network, your network is in a pretty sorry state.
I work in medical research. My previous lab was on a hospital network. One day someone, somewhere in the hospital brought in a notebook with a virus. Most of the machines in the hospital went down, including one of the MR scanner consoles. It was a huge crisis. Our lab barely noticed -- we were running Macs. Our Windows terminal server was properly patched and firewalled.
Hospital IT responded by cracking down on outside devices but NOT really tightening up security on individual machines. Of course, if someone, either with malicious intent or by mistake, plugged an infected laptop into the network, they would be right back at square one.
Re:Obvious. (Score:5, Informative)
And what happens when you want to leave the company? Do they get to keep your laptop? or review your laptop for 3 weeks to make sure you are not taking their data with you?
Never use personal equipment at work. They have every right to fully review your equipment at any time to decide if their data is on your person equipment.
Re: (Score:3, Insightful)
I disagree that they automatically have every right to do that. I will say that they'd be foolish not to make that a written agreement that must be signed before a job offer is made, if they plan to permit personal equipment to connect to their networks. In the absence of such an agreement, I don't recognize anyone's right to go through someone's perso
Re: (Score:3, Insightful)
If I were to hazard a guess, I'd wager he's in the marketing department.
Perhaps. It's also possible that he works in another department and brings his own computer because they won't allow the apps he wants to use on the hospital computers. I've used my personal computer for lots of work stuff because I wasn't allowed to install anything and the only text editor available was Notepad.
I'd echo the advice already given numerous times to stop checking email on anything other than a company machine. But for
Re: (Score:3, Informative)
I also bring my own laptop to work on most days, either to take care of some personal stuff during the breaks or the downtime, or to test something work-related which could fuck up the pc or network.
I think our company does this right. Most locations, as far as I know, have wired ethernet everywhere, and you can only connect the authorized computers there. There are also two wi-fi networks, one is the corporate which requires full authentication with certificates and all that crap, and another guest network
Re:Obvious. (Score:4, Informative)
Because the hospital is probably not a standalone company, but rather part of a "Health System" or similar type of organization. They are likely in direct competition with other, nearby hospitals belonging to other regional health systems or organizations. Why wouldn't they have a marketing department?
To reiterate, I'm speaking from personal industry involvement.
Re: (Score:3, Interesting)
"...why would they (the hospital) have a marketing department?"
Are you kidding me? Here is S. Cal we're inundated with advertising for medical concerns, both private and publicly funded. Its ridiculous.
Re:Obvious. (Score:5, Insightful)
Their network, their rules. Stop taking your personal machine, and require them to supply you with one to do your job. Stop accessing the network after work. They cannot force you to install something on your computer, so they can't force you to connect after hours from home.
Oh, yeah, and start looking for a new job. This stance will make your life easier, but you'll never get promoted.
Re: (Score:2)
The only disk encryption I think is worth selecting is Truecrypt [truecrypt.org]. It's transparent and have decent performance.
If they don't trust Truecrypt they aren't worth your time unless they pay you very well.
Re: (Score:3, Informative)
Re:Obvious. (Score:5, Insightful)
Point out to them that their encryption software is not working well when installed on employee-owned machines and therefor may not be making those machines secure. Try to do this without implying that they are incompetent or that the software is crap, even though both are probably true. Also point out that some employees may be tempted to remove the software without telling them. Suggest that a better solution would be to ban private computers entirely and provide laptops to those who need off-site access. Explain to your boss that because of your concerns about the stability of the encryption software and the risks to you and to the hospital of having sensitive information on your computer that you intend to cease using your personal machines for work. Emphasize your concern about the risks to the hospital.
Re:Obvious. (Score:5, Insightful)
Disallowing private machines on the network is good IT practice. Employeers should not allow any unapproved (and non-employer supplied) device to connect to their networks or machines (and this should include all USB devices like camera, MP3 players, headsets). If you need it for your job, your employer should supply and support it.
Most concerned and resonsible organizations use strong measures to authentic machines before they are allowed to connect to the corporate network. (They might allow guest machines is a firewalled zones for vistor/guest convenience.) I have to say that your employeers policy for no foreign machines on the network is quite reasonable. As for checking your mail remotely, there are some secure solutions for Exchange that enforce secure authentication and encryption for remote access via a web browser.
You might suggest that your employeer supply smart phones like the Blackberry that can be used for secure email access and can be remotely monitored and wiped if comprimised. (POTUS has a BB that passed the security screen.) I wouldn't be surprised if your employer restricts these devices to only business use (as it is their money that is paying for them.)
Re: (Score:2)
Many companies/governmental institutions require the consultants to provide their own hardware since they think it's cheaper.
That also means that they do run a risk of an incoherent environment, but it's their headache.
Why consultants have to use their own tools (Score:4, Informative)
Many also do it because whether or not someone you pay to do work uses tools you provide or brings their own tools is one of 20 factors specifically identified by the IRS as being used to determine whether a person paid to do work for you is an "employee" for whom you are required to withhold income taxes, pay the employer's share and withhold the employee's share of payroll taxes, etc., or an "independent contractor" to which none of those rules apply. Using the employers tools is a factor that specifically weighs in favor of finding that the worker is an employee, not an independent contractor.
Merely calling someone a "consultant" or "contractor" doesn't make the government see them that way, and employers who want someone to legally have "contractor" status generally want to do everything possible to assure that if that status is ever challenged, either by the worker or the government, the employers position that the worker is a "contractor" is upheld.
Make lemonade (Score:5, Insightful)
Stop reading work email at home. Problem solved, and it turns out that it is actually a blessing in disguise.
Re:Make lemonade (Score:5, Insightful)
As somebody pointed out above, at that point your employer has to provide you with the equipment to do so.
Re:Make lemonade (Score:4, Insightful)
> What universe do you live in?
One where involuntary servitude is illegal. He doesn't have to continue working there.
Re: (Score:3, Insightful)
Right... he also doesn't have to have a roof over his head, and doesn't have to eat.
Re: (Score:3)
Depending on your profession, at this point in our economy, THERE may be the direct alternative to NOWHERE is my point.
Re: (Score:3, Insightful)
So we should just let companies get away with deplorable behavior because there's probably a different company out there who doesn't do it? This is not just a slippery slope, it's a flowing stream (meaning that progression down the slope is not just likely, but inevitable).
Companies will act in self interest over employee interest whenever they think they can get away with it. If we accept some employers requiring people to install certain software on employee home computers as part of their job duty, event
Re: (Score:3, Funny)
Simple, just grab a pc off of one of the desks and take it home. Be sure to only use it for work. One unfunded mandate deserves another.
Re:Make lemonade (Score:5, Insightful)
In this case it is the obligation of the employer to provide you with the equipment to do so.
Mal-2
Re: (Score:2)
Re: (Score:2)
Bring them in your smartphone and see what they do. I doubt they'll be able to encrypt the root drive...
Re:Make lemonade (Score:4, Insightful)
We live in a country where some cities are topping 20% unemployment, much of it middle-class white-collar jobs.
Employers don't HAVE TO do anything now, because they can yawn, pick up the phone, and replace you in 24 hours with someone who doesn't mind dropping $2k to buy a shitty computer from the company's approved supplier to check work email at home, because they want to eat sometime this week.
Re:Make lemonade (Score:4, Insightful)
another reason why a tech union is sounding better and better.
Re:Make lemonade (Score:5, Insightful)
A union wont keep you from being fired, but it will keep you from being replaced on a whim. Hell just look at what IBM is planning... over 75% of their workforce are basically losing all their benefits by being hired back on as private contractors. That means no health, no pention, no severance, even LESS security, same hours, same wage.
Re: (Score:3, Interesting)
Well, I can't provide a link, but I can tell you that a good friend of mine who until recently worked for IBM got caught up in it. And it's even worse than GPP indicated -- they offered him his old job back as a contractor at about two-thirds the pay, with no benefits etc. I don't know if there are any news stories on it because it's not really the kind of thing IBM is going to be eager to publicize, but it's happening. And while the IRS may be cracking down on some of the chicanery involved in hiring c
Re: (Score:3, Informative)
link: http://slashdot.org/submission/1224936/IBM-may-outsource-34-of-its-permanent-workforce [slashdot.org]
Re:Make lemonade (Score:4, Insightful)
So this hypothetical replacement employee has $2,000 lying around to buy a new computer but doesn't have enough money to feed himself/his family? Something tells me that, had I only $2,000 left in my bank account, I'd use it for food before using it to buy a computer.
Re: (Score:3, Interesting)
It's the equivalent of cutting your salary by $2000. If the alternative is not earning any salary, you better come up with the money.
Re: (Score:3, Insightful)
What kind of weird world do you live in?
Jobs are offered to me regularly without me asking for it, my current company that I just joined 6 months ago provides me with lots of benefits and gives me whatever I feel like I need; I'm also free to come in whenever I want.
I say this whole crisis is nothing but a myth. Or maybe it only affects completely useless jobs.
I guess there also wasn't an earthquake in Haiti because you didn't feel any shaking. If it doesn't affect you, it must be a myth.
Re: (Score:3, Informative)
YOUR employer must buy you equipment that is required to perform YOUR job.
Correct. That's one big difference between an employee and a contractor.
Stop bringing your machine to work (Score:5, Insightful)
Just stop. If you need a portable machine that will be repeatedly connected to their network, make them assign you one. Alternately, ask them to sign a form claiming responsibility for any problem with your laptop, promising to pay for data recovery services should their software cause you some problem with your data, et cetera. But if I were them, I'd tell you to fuck off.
You provided no argument as to why you should need to bring your own machine to work, so this is by far the most rational solution.
Re:Stop bringing your machine to work (Score:5, Insightful)
This. Without an argument for why your personal machine should be on a sensitive network we can't help you.
I'm slightly disturbed that there's a hospital out there that apparently allows employees unfettered access to their network from their personal machines, actually.
Re: (Score:3, Insightful)
I second this. We have a secured LAN with several large Linux clusters and a few dozen workstations, also mostly Linux. Some of the users have been issued laptops running Windows (over our objection). We secured them and regularly update antivirus and firewall software, but since the users needs admin access (over our objections), they still carry viruses and other malware on site. It is not a constant problem, but it is a persistent one. We were considering building a DMZ for all laptop users to limit
Re: (Score:3, Insightful)
This. Without an argument for why your personal machine should be on a sensitive network we can't help you.
I'm slightly disturbed that there's a hospital out there that apparently allows employees unfettered access to their network from their personal machines, actually.
Apparently they get used to that and it spoils them. Now that they're spoiled, when you fix the situation by implementing reasonable controls for sensitive data, they get upset at the new restrictions and start Ask Slashdot discussions about their unwillingness to deal with them.
I've personally worked in offices that dealt with sensitive data. What I dealt with was less sensitive than medical records, yet we had IT policies like this one and they were considered basic measures. Employees who needed to
Maybe the passive aggressive approach? (Score:4, Insightful)
If there is someone there who insists that home machine be allowed on the network (beyond stupid in the first place) this might be the "compromise" that the IT department was able to reach.
You can have your home machine on the network ... BUT ... it must have full disk encryption.
Most everyone will be able to figure out that that means "leave your home computer at home".
Re:Stop bringing your machine to work (Score:5, Insightful)
My guess is that he is an a setup that I have seen on multiple places around the country - a research or university hospital. The network layouts were designed out at time when there where no data protection laws and little electronic patient records. As a result over the years machines that host the patient records now end up on the same network that hosts machines used for research, including everybody's personal laptop. Now the new and very appropriate data protection laws come into effect and the managment and IT staff have three choices:
1. Spend tons of money on complete overhaul that will separate the patient records and the machines that process them from the rest of the network. This includes putting interfaces that would allow aggregate anonymized data to be accessed from the outside for population, epidemiological and other types of research.
2. Encrypt everything that ever touches the network.
3. Shut down the hospital or the research
Which option would you choose?
At the places where I have been very few of the postdoc and grad students have a computer that is purchased by the employer. Even if they do they still need to bring their personal laptop for various reasons directly connected to their work or study. I am currently doing research at a place like that and the security measures although not as draconian as in the article, are interfering seriously with my work. I never touch anything even remotely related to patients, but I need to exchange large chunks of data with colleagues around the world, have remote access to the local network, etc. Based on my experience I would advise the poster to calm down, and not lash out at the poor IT staff that has to deploy all this, while dealing with the anger of everybody around. You need to talk to people that are higher at the pay scale, define well the problem that you are facing and work with them to solve it.
Re: (Score:2)
I think the point was that the IT department would never agree to it so he should not let them do anything to his machine.
It's your machine, refuse. (Score:5, Insightful)
But be aware that it's their network, and expect them to refuse to allow you to connect to it.
The real solution is that if you need a machine for your job, they should be providing it to you. If you do not, then leave it at home.
No. (Score:5, Informative)
If they tell you that for security reasons you cannot connect your computer to their network unless you follow their guidelines, either follow their guidelines or leave your computer at home.
On the other hand... (Score:2)
...I bet the encryption software is for Windows and MacOS only. Install Linux on a laptop, using a full disk encryption filesystem to be compliant. Install a copy of WINE and QVWM95 so that the IT staff see a Windows-like GUI that can run Windows software. Once they're done messing with the machine, you will still have Linux with all the capabilities of Linux and all the speed and reliability of Linux, with no risk of harm from the hospital software, and no risk of liability as (a) you let the software be i
Just say no. (Score:4, Insightful)
If they insist on your home machine being encrypted, then tell them either:
1. They must supply the machine, and it's theirs, and you'll only use it for work.
2. refuse to do any work at home.
gus
Re: (Score:3, Interesting)
Re: (Score:2)
Uhhhm, yes. I realize that. But, in this case the benefit is not supposed to be for the employee. The 'benefit' is that the data is secure. it is already acknowledged that the process is slow and fragile.
Which is exactly why you just say no. The assumption being that 'work' has better handle on what's right, and if they insist on doing things in a certain manner (for whatever reason - including that it's the best way to do things), then you say 'fine', but to support that then work must provide the resource
Get an old machine (Score:5, Insightful)
Considering that decent used laptops -- adequate for checking mail and browsing the web, anyway -- can be had for about a hundred bucks, I'd just buy one off eBay or Craigslist and use that for work purposes. For a little more, you could always pick up a netbook or a bottom-of-the-line laptop new.
Separate work and home (Score:5, Insightful)
Re: (Score:2, Informative)
It's not HIPPA, it's HIPAA, as in "Health Information Portability and Accountability Act".
Why Personal Equipment? (Score:4, Insightful)
Why do you need to use your personal computer equipment to do your job? Your employer should be supplying everything you need to do your job.
If you need a computer at work, your employer should supply it.
If you need to check email from home, your employer should supply you with a blackberry.
This isn't rocket surgery.
Buy a cheap (second hand?) notebook (Score:2, Informative)
What they SHOULD do (Score:2)
They should be using web-based email, that way the mail leaves their servers.
Yeah, stop using them on their network (Score:5, Insightful)
It's that simple.
Any business would be mad to let sensitive data (especially medical) get onto employee's home machines. And bringing personal machines to work and hooking them up the network?
You're a walking, talking, security nightmare. Your IT staff should be fired for not being harsh enough. NO personal laptops on the network. NO accessing email from home machines.
Re: (Score:2)
Allowing personal equipment on a hospital network is extremely irresponsible. Personally,
Its their network, their policy.. (Score:3, Insightful)
Its their network, their policy... be lucky you are even ALLOWED to connect your own personal laptop to their network, that is strictly forbidden for security reasons in most places.
If you don't want them to install that software on your personal machine, don't bring it in or don't connect it to their network and use 3G or something.
As soon as you connect to their network you must abide by their rules.
Simple as that, really.
(I'm a Network Administrator IRL.)
Honestly... (Score:4, Insightful)
As far as legal recourse, IANAL but I don't think you really have one. While I get the whole "You're not touching my computer" bit, why don't you just use the computers provided ? Hell, even at the community college I go to, I have to install some software just to connect to their network. Same with some of the other corporations that friends and family work for. In the end, if you weasel your way around the restrictions and then lose your laptop, have it stolen, whatever - you'll really be on the hook.
Why use your own PC on their network at all? (Score:5, Insightful)
Unless there are very good reasons that were not in TFA, my response would be:
1) My personal computer will stay at home from now on
2) The IT department does not install anything on my personal computer.
3) I won't check my (work) email from my home anymore. Anyone who wants to contact me can use a phone (and better have a damn good reason if it happens at 2 a.m. in the night).
Work-Issued Devices (Score:2)
Are they paying you extra to use your own laptop at work, as they might if you were using your car for work and get a mileage allowance? If so then I'd say you probably will end up letting them install whatever they like. If not, tell them that if they want you to work within their rules, they'll need to buy you a "company" computer in order to satisfy those requirements since they aren't welcome to touch your personal machine.
As for checking your email from home, either have them also buy you an email-c
Easy solution.. stop using your personal equipment (Score:2)
Pretty simple (Score:5, Insightful)
The solution is pretty simple. Don't use personal computers for business use.
If I'm a patient at your hospital I'm barely comfortable relying on the hospital's IT department to keep my medical information secure. I certainly don't want to rely on a myriad of clueless doctors, nurses, and miscellaneous technicians and administrators all maintaining or failing to maintain their own home computers.
I hope that if my medical information is leaked through any hospital employee's personal computer that I will be able to sue them for millions. It's just irresponsible to leave the handling of sensitive data to the random computer skills of people who are mostly employed for their non-computer skills.
I hope that most hospital employees are skilled in medical fields but I don't expect them to be particularly skilled with computers or to really care that much about computer security. I expect the hospital's IT department to be extremely vigilant about computer security so that the medical personnel can focus on healing patient.
Other workers don't use their own equipment (Score:3, Insightful)
Apart from them wanting to clamp down on the security elements of staff stealing or
Bring an old laptop... (Score:2)
Tell them to encrypt that, and use it only to check your email.
Since they don't know how to install encryption software properly, I doubt they know how to check which laptop connects to what anyway.
I'm tired of month lost/stolen laptops (Score:2)
Yes and No. (Score:4, Informative)
You are basically at an impasse here. They can't touch your computer without your consent; but you can't touch their network without their consent, and they can make your consent a condition of their consent.
Your options are basically as follows:
1)Stop checking email from home/personal machine at work. If this is impractical/untenable, move on to step two.
2)Request that, if IT wants security and management, they issue you the hardware you need to do your job. If you don't have the clout/there's no chance in hell/you'll be stuck on a Latitude CPi from 1999 if you do that, move on to step 3.
3)Purchase a "sacrificial" notebook. A netbook or cheap CULV thin-and-light(depending on where you fall on the small size vs. screen size issue) can be had for $400 or less on any given day, depending on which models are on sale. Buy one, set up a restore disk, then let the IT department do its vile work. If their software fucks it up, run the restore and make IT do it again.
What's the problem? (Score:2)
You "have no intention of letting these people install anything on my machine".
And they have no intention of letting you connect your machine to their network without letting them install some things on it.
Hence, you don't connect your machine to their network.
You "have no intention of letting these people install anything on my machine".
And they have no intention of letting you check your email on a machine they haven't installed some things on.
Hence you don't check your email from your machine.
It's their network... (Score:2)
So they get to choose who connects to it. Simple as that. If you want to bring a personal machine in for personal, non job related use, accept that you might not have connectivity. Most of the hospitals around here have a guest wifi, you might be able to use that, or a 3G card. For job related stuff, tell them they have to provide the equipment.
If you have read the HIPPA laws, the penalties for leaking PII are severe. Full-disk encryption for all connected machines is probably the best way to prevent proble
Typical unpleaseable geekdom (Score:3, Informative)
*sigh* First you bitch and moan about how everyone should encrypt everything on their computers and brag about how easy it is to do full-partition encryption and how it's oh so fucking great that there's encryption around to protect you from the sp00ks and boogeymen that dadgum gummint apparently sends after you every day (oooo, scaaaaaaary!).
And THEN you bitch and moan when someone TELLS you to do full-scale encryption on your computers! You people are never happy, are you? THIS is why nobody takes us seriously! THIS is why we can't have nice things!
Yes, Sorta, No (Score:5, Informative)
I manage security for a major hospital system and I am leading the encryption roll out.
1. Encryption is "safe harbor" meaning that if the device is lost or stolen, you don't have to notify HHS or the patients.
2. Notification costs MAJOR dollars plus the PR hit
3. As of ARRA/HITECH, _YOU_ are PERSONALLY liable in the case of WILLFUL NEGLECT. To give you an example of how broad this can be, I have met the Deputy Director for Clinical Information Privacy at HHS... and she says that password sharing is willful neglect. We both know that password sharing is more than common in the medical industry (doctors don't login, they tell someone to login)... So take this point and run with it... you left your laptop in your car overnight? It was stolen? Willful Neglect. Notify the world, and pay the fines, and possibly endure criminal charges.
4. You should not be using your personal device and you need to get used to the fact that the PHI you view is NOT YOURS. It belongs to the PATIENT.
This is a HUGE shift for the medical industry, and frankly, if people knew just how bad security was, they would call for heads. It's starting to change, but it will take time. Doctors and clinicians are not animals that like change. I will be the first to admit that encryption has a steep curve, and it can break things... but you better adapt or your State Attorney General will come for you... (State AG's are charged with enforcing both their own state's legislation as well as the new federal regs)
Bottom line: you are responsible. Leave your personal equipment at home. /posting anonymously because I don't remember the password to my 5 digit slashdot id.
Get another computer? (Score:2)
I'd probably just get another cheap-ass, used computer strictly for the purposes of checking email from home, etc (I have two or three sitting in the garage right now that would work). Let them put their software on THAT machine.
Don't use your personal machine (Score:2)
Don't use your personal machine for work.
Have them supply an appropriate laptop or desktop to do the job.
If you work as a contractor and believe it would be possible, you could get the name of the software they are using, or other software which they would approve and do it yourself. This is the approach I would take on my machine if the rules were being imposed. No-one other than me installs software on it and I want the recourse to deal with whatever company wrote the software in the event I have a proble
Yay for misinterpretation! (Score:4, Informative)
But in your case, there's a clear cut solution. Company policy says you need to only access their information from an encrypted computer. That leaves you with four options.
Don't forget, no matter how stupid you think the policy is (or it may actually be), it's still your job to abide by them (unless you have the power to change them, which it doesn't seem you do). So either comply, or don't. If you chose not to, realize that you may be let go... It's as simple as that.
Re: (Score:2)
HIPPA - Health Insurance Privacy and Protection Act
You got the acronym wrong (although a lot of people do), and then synthesized a non-existent name to expand it. You get credit for thoroughness.
Health Insurance Portability and Accountability Act [wikipedia.org]
No mention of privacy in the title. All patient privacy stuff is the included Privacy Rule section (Section 264), although the law itself is devoid of actual standards and guidance. That was all added administratively after the fact.
Re: (Score:3, Insightful)
From my time in IT, I guarantee that at least 1 in 10 of those personal laptops is compromised in a major way. You can encrypt the hard drive against physical theft, but you can't encrypt the OS against being rooted. Personally I'm shocked they let private data on personal laptops at all.
Simple solution (Score:4, Insightful)
Keep your personal machine off the Hospital network.
The only really sane policy: if it's on the Hospital network, it conforms to IT security guidance. Period.
I'm assuming you're in the U.S. "Exuberant" is an apt description of HIPAA [wikipedia.org] data infrastructure guidance, but it's still the law of the land. I don't want my patient information accidentally sneaking out on your laptop's unencrypted hard drive.
If you must conduct personal internet business at work and don't want to convert your personal computer into a personally-owned company-configured machine, bypass the hospital net with a 3g dongle and your own data plan.
Belligerent Obedience (Score:2)
I'm not sure I'd suggest being that extreme, but you should consider why are you funding your employer's
Guest network? (Score:2)
Standard Policy (Score:5, Insightful)
Hi,
IMHO a private PC has nothing to do inside any enterprise (>1.000 PCs) network. If a PC of an employee/consultant/customer is used, he is placed in a special DMZ. From there he can connect (e.g. by SSL-VPN) to the company network. He has only access to certain ressources. The access to the ressources may vary with "type of authentication", "security level of the pc", etc. Certain actions (e.g. transfer of files) are only allowed through clearing points.
Installing any kind of endpoint security (disk encrpytion, desktop firewall) on a private PC by an enterprise is a recipe for disaster. I am doing endpoint security concepts and projects for several years now. An exact inventory of OS, Hardware, Software installed, etc. is an absolute key element for such a project to succeed. If you use a "this software works for all platforms" approach, the support effort will usually kill you ten times over. Even the best software (Check Point FDE for Enterprises, Truecrypt for private users) has many dependencies: The virus scanner may prevent the boot sector to be written, the keyboard may not be recognised correctly by the Preboot-Auth-Code, certain Boot-Loader may not be interoperable with product of choice or you just may be unlucky.
It is probably cheaper for an enterpise to give a worklplace (e.g. Thin Client, SunRay or cheap Notebook) to an employee (even a temp) than trying to fix his security for or against him
Sincerely yours, Martin
P.S. This is a very, very short summary.... A complete account of experiences and ideas would require days to type. When a customer wants an introduction into the topic, i usually start with an 2-4 hour presentation.
Stop checking your email (Score:2)
If they're going to insist on this type of software, then stop using your personal machines to connect to the network or check your email at home.
If they really want you to check your email, demand that they provide hardware that meets with their approval to do so.
This isn't hard. (Score:2)
Do not use your personal computer for work. Do not use your work computer for fun. You are asking for trouble.
If you are a contractor or such, you should already have your hard drive encrypted. Provide the facility with evidence that your hard drive is encrypted.
There is no good excuse, in 2010, to not have the hard drive of your computers encrypted. Operating systems should be encrypting hard drives by default during installation. The only exception is if they are servers sitting in a physically secured da
And I am glad! (Score:3, Interesting)
People who use their own personal machines to access sensitive information should perhaps be
even *more* restrictive. It is this type of access that is the most dangerous.
If you simply have to check your facebook, check email, etc, then get yourself
a 3G network enabled device.
Do I have any recourse (Score:3, Informative)
To add to the general recommendations... (Score:3, Insightful)
"In the department that I work in, however, many of the employees (myself included) bring their own personal machines to work every day."
The IT department made a mistake there. Not acceptable to allow confidential data on a private machine. Their error, not yours. If your department doesn't have budget for IT services, perhaps it needs to be managed properly or shut down. Obviously, they will manage it properly.
"the hospital is now demanding that any machine that is used to check email (via email clients or webmail directly) be encrypted", including desktop-style machines at home"
BlackBerry Problem solved. If they balk at handing out BBs, then you don't need offsite or portable email access. Problem solved.
I'm astonished that they let you bring your own machine in to do work with confidential data. Entirely unacceptable, no matter how diligent you are about your machine's security. It is responsible. They cannot be responsible if they don't control the environment, including the hardware and software. I'm equally astonished they aren't using a VPN with certificates.
But I am not unfamiliar with Massachusetts hospitals, so I am not greatly astonished. One Boston-area hospital got a cool teleradiology contract with a hospital I worked at back in the 90s, and gave us the stern lectures about security, data encryption, etc. And emailed the user IDs and passwords to everyone on the department mailing list, even the CEO and CFO. Nice, guys. How about taking out an ad in the Globe next time, ok? It would be safer, nobody reads that.
They shouldn't just stop an encryption (Score:3, Insightful)
If a major hospital is letting people roll up and connect personal (i.e. uncontrolled) laptops to their internal networks, the information security team/officer there is either incompetent or being ignored. They should take responsibility for making sure neither of those things is happening.
As for the OP, they seem to me to be recklessly endangering the security of patient data. People's personal laptops have all kinds of scary cruft on them. Seventeen different kinds of malware, if they run Windows, probably.
Re: (Score:3, Informative)
"Find a new job" may be a curse, not advice.
If I were a patient in your hospital, and the doctor was using some ultrasound machine or other PC-based diagnostic device, and the damn thing had a virus that caused a misdiagnosis, I'd be right pissed at the person who brought the virus in.
I know that lots of those machines are still running the manufacturer's originally-shipped OS, because they don't certify every OS hotfix and patch that comes out. I also know that if the thing can email a doctor a copy of th
Re:Find a new job (Score:5, Interesting)
I'm sorry, you must be under the impression that systems in a hospital are integrated in SOME fashion. They are not, and I've never heard of one that was, although my experience with them only spans about 7 years and only includes 3 U.S. states (not Mass). Electronic medical records are just now KIND OF being integrated and usually only at expensive hospitals. And I have yet to see a medical diagnostic device that didn't run in it's own vendor supported proprietary bubble. So having a virus run amok doesn't really concern me as it would get stopped in its tracks by the entire clusterfuck that is Healthcare IT.
Healthcare IT is a vendor lock-in, non-integrated mess and having IT run around and lose people's data with some mandated encryption system they probably bought from a snake oil salesman is probably worse than any scenario you might be thinking about.
Re: (Score:3, Informative)
A non-integrated system doesn't mean the equipment isn't sharing the same network infrastructure. Viruses, worms, malware or whatever, they don't restrict themselves to looking for "integrated systems" to infect. They blast their payloads out to any network or subnet address within reach. Vulnerable systems get infected, integrated or not.
The things I'm talking about are machines that have no apparent medical business being on the network, yet are. I was looking at an ultrasound machine that was still r
Re: (Score:2)
In any case - many virus outbreaks are due to old/insecure client computers used to browse the web. And it may be sufficient to surf to a well-known site with commercials displayed - like many newspapers/magazines since the malware may be embedded in the commercials.
And when one machine gets the flu it spreads through the network like a wildfire.
Re: (Score:2)
Otherwise, when you bring your PC in for them to install the software, require them to sign an agreement in which they acknowledge that they are responsible for data loss on your machine, and for any exploits to which your machine might be exposed from running their software.
Re: (Score:3, Insightful)
Probably something like "because you say it is in a signed statement." Lying is almost certainly grounds for termination plus whatever penalties HIPPA can be used to bring to bear. Lying, therefore would be stupid, the act of a total moron.
This is health care and health care records. We should all hope they get serious, are serious and stay serious.
Re: (Score:3, Interesting)
I suggest that the answer is very simple and non-technical. They ask everyone with access to email externally to sign a piece of paper stating that they have read the security policy and will never violate it, where violating it is doing things like accessing the email system through any unsecured computer.
Violation of the policy is grounds for immediate termination plus criminal penalties for potentially exposing patient data. After the first guy goes to jail for five years or so people will start actual