1 Running head: GOVERNMENTAL SURVEILLANCE CLIENT PRIVACY 1 Governmental surveillance threatens client privacy Samuel D. Lustgarten The University of Iowa Author Note Samuel D. Lustgarten, Counseling Psychology, Department of Psychological and Quantitative Foundations, The University of Iowa. Corresponding Author: Samuel D. Lustgarten, Counseling Psychology, Department of Psychological and Quantitative Foundations, The University of Iowa, 361 Lindquist Center, Iowa City, Iowa, , USA.
2 GOVERNMENTAL SURVEILLANCE CLIENT PRIVACY 2 Lee. Acknowledgements: Dr. Elizabeth Altmaier, Dr. Stewart Ehly, Daniel Elchert, and Micah
3 GOVERNMENTAL SURVEILLANCE CLIENT PRIVACY 3 Governmental surveillance threatens client privacy Over the last two decades, the field of psychology has appreciated from technological progress. Practitioners are using text messaging (Norcross, Pfund, & Prochaska, 2013) and (Shapiro & Schulman, 1996) for extended client care. Colbow (2013) found that psychologists and helpers are showing growing interest in telemental health therapy (remote therapy), which necessitate teleconferencing programs (i.e., Skype or Google Hangouts). Each program and technology has consequences for client privacy and confidentiality. To manage risk associated with maintaining digital records and communication with clients, the American Psychological Association (APA) issued two documents: the Ethical Principles of Psychologists and Code of Conduct (2010; hereafter referred to as, Ethics Code ) and Record Keeping Guidelines (2007). These documents place responsibility for confidential record management with psychologists. Unfortunately, the ability for psychologists to maintain privacy and confidentiality in the twenty-first century is threatened. The evolution of technology combined with governmental surveillance and policy has led to vulnerabilities in digital maintenance of client records. This article reviews the current governmental threats to privacy and provides 5 best practices for securing information. The NSA, Cloud Storage, and Electronic Communications Various national agencies conduct surveillance in the service of state interests. Relevant to the current article is the National Security Agency (NSA; 2011), which is primarily tasked
4 GOVERNMENTAL SURVEILLANCE CLIENT PRIVACY 4 with collecting signals intelligence (from foreign sources). Until recently, it was believed that domestic surveillance was considered unlawful. In June 2013, Glenn Greenwald took possession of top-secret documents from governmental whistleblower, Edward Snowden (Greenwald, 2014). The articles, known as The NSA Files, catalogued covert surveillance operations that extended into the U.S. (Greenwald, 2013). With the help of Snowden and other journalists, Greenwald (2013) first published evidence that the NSA was demanding and receiving records of millions of Verizon customers daily. One program MUSCULAR allowed NSA analysts to access cloud storage networks of companies such as Google and Yahoo (Gellman & Soltani, 2013). This enabled the NSA to download and retrieve private information of U.S. citizens using cloud-based services (i.e., Gmail, Google Drive, and Yahoo Mail). It is possible the NSA could have retrieved private health information (PHI), notes, and work logs. If a provider and client ed back and forth, the NSA could have accessed this information. These policies hinder psychologists ability to uphold the APA Ethics Code (2010), which states, Psychologists have a primary obligation and take reasonable precautions to protect confidential information obtained through or stores in any medium. Top-secret programs are only one type of governmental threat to privacy. The Stored Communications Act of 1986 (18 U.S. Code 2703) allows the federal government to access cloud-based when left on servers over 180 days. When the Act was signed, the popular method for was to download messages to local computers removing it from servers. Now, people tend to archive messages, rather than downloading or deleting (Google, 2014). With
5 GOVERNMENTAL SURVEILLANCE CLIENT PRIVACY 5 corporations providing high-capacity cloud services, communications with clients that are saved, archived, and/or left on servers are vulnerable to government data requests. Governmental surveillance and access to communications is easier at public institutions. Anyone can make Freedom of Information Act requests (FOIA; 5 U.S. Code 552), and ask for the s of faculty and staff. For instance, while communications between practitioners and clients is considered privileged information, s between other practitioners and in indirect support of clients may not be protected (University of Iowa, 2013). Lastly, mental health providers have a duty to explain to clients about requests for confidential information (ethics code citation). The Federal Bureau of Investigation (FBI) may have the authority to issue National Security Letters (NSLs) to request client records (18 U.S. Code 2709). NSLs may necessitate that the recipient not notify persons involved, thus limiting the ability for practitioners to share about investigations affecting clients. Best Practices for Client Confidentiality The APA Ethics Code (2010) suggests that failure to maintain confidentiality and related ethical standards may result in legal consequences (Benefield, Ashkanazi, & Rozensky, 2006; Glosoff, Herlihy, Herlihy, & Spence, 1997). While the APA (2007; 2010) provides standards and guidelines for the use of data, best practices are absent. Despite the aforementioned threats to client privacy and confidentiality, there are methods to manage risk of unintended disclosures. The following section outlines 5 best practices for maintaining client confidentiality. 1. Create a threat model Practitioners should anticipate security threats. While challenging to predict every concern, practitioners can develop threat models (Barrows & Clayton, 1996; Lee, 2013).
6 GOVERNMENTAL SURVEILLANCE CLIENT PRIVACY 6 Threat models consider client populations (i.e., low, moderate, and high risk). By grouping clients into different risk categories, practitioners can create greater protections when necessary (i.e., LGBT-identified clients, dissidents, politicians, and celebrities). Practitioners threat models should be inversely related to risk: high-risk populations met with lower-tech mediums. 2. Encrypt everything Practitioners should research encryption software to protect welfare. The APA Practice Organization (2014) catalogued three different types of options for client records: full-disk, virtual-disk, and file encryption. Full-disk encryption provides protection for the entire file system, and prevents organizations from files. If providers are interested in backing up and storing client records on HIPAA-compliant cloud-storage servers, files should be encrypted prior to uploading via virtual-disk encryption. Micah Lee (personal communication, September 28, 2014), technologist for The Intercept, provided four suggestions: disk encryption, firewalls, strong passwords (unique per account), and cryptology in communication (i.e., encrypted text messages). 3. Turn on two-factor authentication Cloud-based websites usually require usernames and passwords. Government agencies need additional information to circumvent this process. One method of further account security is two-factor authentication. This feature utilizes time-based tokens that change every 30 seconds. When activated, two-factor authentication is required after correctly providing username and password credentials. If a password were stolen, the encrypted token would still be necessary. 4. Buy an air-gapped computer
7 GOVERNMENTAL SURVEILLANCE CLIENT PRIVACY 7 The Electronic Frontier Foundation (EFF; 2014) suggests that with more sensitive information, an air-gapped computer should be used. Air-gapped computers have all Internet capabilities disabled or forcibly removed. The NSA (2010) recommends that Mac users have an Apple-certified technician remove wireless cards. For high-risk clients, notes and information would be maintained, but need to be moved via external device (i.e., USB flash drive). 5. Modify informed consent process The APA Ethics Code (2010) asks that informed consent be given at the outset of treatment. If client and practitioners express an interest in digital technologies to enhance treatment, informed consent should properly explain, justify, and present risks to communication methods (Devereaux & Gottlieb, 2012). If clients express concern during informed consent, and in the interest of autonomy and privacy, practitioners should consider more basic methods (i.e., pen and paper). Conclusion Clients (Rubanowitz, 1987; VandeCreek, Miars, & Herzog, 1987) and psychologists have agreed that confidentiality is imperative for provision of care (Donner, VandeCreek, Gonsiorek, & Fisher, 2008; Fisher, 2008; Glosoff et al., 1997). Additionally, the U.S. Supreme Court reasserted psychotherapeutic privilege for client confidentiality in the 1996 case, Jaffee v. Redmond. Despite this historical precedence, government policies have threatened privacy. Each technological innovation provides greater flexibility and accessibility for care. Unfortunately, as Baker and Bufka (2011) suggest, psychologists are engaging with technologies that have legal and ethical ramifications for clients, research participants, and third-party providers. While the APA has created guidelines and standards for interacting with technology,
8 GOVERNMENTAL SURVEILLANCE CLIENT PRIVACY 8 there are risks to certain communication and storage mediums, especially when using cloudbased providers. Now more than ever, practitioners should be circumspect to new technologies related to the communication and storage of client data. By adopting the best practices listed within this article, practitioners will be taking a stand for client and human rights.
9 GOVERNMENTAL SURVEILLANCE CLIENT PRIVACY 9 References American Psychological Association. (2007). Record keeping guidelines. The American Psychologist, 62, doi: / X American Psychological Association. (2010). Ethical principles of psychologists and code of conduct. Washington, DC: Author. Retrieved from principles.pdf APA Practice Organization. (2014). ABCs and 123s of encryption. Good Practice, Spring/ Summer. Baker, D. C., & Bufka, L. F. (2011). Preparing for the telehealth world: Navigating legal, regulatory, reimbursement, and ethical issues in an electronic age. Professional Psychology: Research and Practice, 42, doi: /a Barrows, R. C., & Clayton, P. D. (1996). Privacy, confidentiality, and electronic medical records. Journal of the American Medical Informatics Association, 3, doi: /jamia Benefield, H., Ashkanazi, G., Rozensky, R. H. (2006). Communication and records: HIPPA issues when working in health care settings. Professional Psychology: Research and Practice, 37, doi: / Colbow, A. J. (2013). Looking to the future: Integrating telemental health therapy into psychologist training. Training and Education in Professional Psychology, 7, doi: /a Counterintelligence access to telephone toll and transactional records. 18 U.S. Code 2709.
10 GOVERNMENTAL SURVEILLANCE CLIENT PRIVACY 10 Devereaux, R. L., & Gottlieb, M. C. (2012). Record keeping in the cloud: Ethical considerations. Professional Psychology: Research and Practice, 43, doi: /a Donner, M. B., VandeCreek, L., Gonsiorek, J. C., & Fisher, C. B. (2008). Balancing confidentiality: Protecting privacy and protecting the public. Professional Psychology: Research and Practice, 39, doi: / Electronic Frontier Foundation. (2014). Keeping Your Data Safe. Retrieved from https:// ssd.eff.org/en/module/keeping-your-data-safe Freedom of Information Act of 1966, 5 U.S. Code 552. Gellman, B., & Soltani, A. (2013). NSA infiltrates links to Yahoo, Google data centers worldwide, Snowden says. The Washington Post. Retrieved from google-datacenters-worldwide-snowden-documents-say/2013/10/30/e51d661e e3-8b74- d89d714ca4dd_story.html Glosoff, H. L., Herlihy, S. B., Herlihy, B., & Spence, E. B. (1997). Privileged communication in the psychologist-client relationship. Professional Psychology: Research and Practice, 28, doi: /j tb01929.x Google. (2014a). Archive messages. Retrieved from https://support.google.com/mail/answer/ 6576?hl=en Greenwald, G. (2013). NSA collecting phone records of millions of Verizon customers daily. The Guardian. Retrieved from nsa phone-records-verizon-court-order
11 GOVERNMENTAL SURVEILLANCE CLIENT PRIVACY 11 Greenwald, G. (2014). No place to hide: Edward Snowden, the NSA, and the U.S. surveillance state. New York, NY: Penguin Group. Jaffee v. Redmond, 518 U.S. 1 (1996). Lee, M. (2013). Encryption works: How to protect your privacy in the age of NSA surveillance. Freedom of the Press Foundation. Retrieved from https://freedom.press/sites/ default/files/encryption_works.pdf National Security Agency. (2010). Hardening tips for Mac OS X 10.6 Snow Leopard. Retrieved from https://www.nsa.gov/ia/_files/factsheets/macosx_10_6_hardeningtips.pdf National Security Agency. (2011). Mission. Retrieved from https://www.nsa.gov/about/mission/ index.shtml Norcross, J. C., Pfund, R. A., & Prochaska, J. O. (2013). Psychotherapy in 2022: A Delphi Poll on its future. Professional Psychology: Research and Practice, 44, doi: /a Rubanowitz, D. E. (1987). Public attitudes toward psychotherapy-client confidentiality. Professional Psychology: Research and Practice, 18, doi: / Shapiro, D. E., & Schulman, C. E. (1996). Ethical and legal issues in therapy. Ethics & Behavior, 6, doi: /s eb0602_3 Stored Communications Act of 1986, 18 U.S. Code University of Iowa. (2013). Chapter 19: Acceptable use of information technology resources. Retrieved from
12 GOVERNMENTAL SURVEILLANCE CLIENT PRIVACY 12 VandeCreek, L., Miars, R. D., & Herzog, C. E. (1987). Client anticipations and preferences for confidentiality of records. Journal of Counseling Psychology, 34, doi: /
CYBERSECURITY INSIDER THREAT BEST PRACTICES GUIDE JULY 2014 INSIDER THREAT BEST PRACTICES GUIDE I. DISCLAIMER This report was prepared as an account of work within the private and public sector. Neither
REED COLLEGE ediscovery GUIDELINES FOR PRESERVATION AND PRODUCTION OF ELECTRONIC RECORDS TABLE OF CONTENTS A. INTRODUCTION... 1 B. THE LANDSCAPE OF ELECTRONIC RECORDS SYSTEMS... 1 1. Email Infrastructure...
Best Practices for Online Service Providers June 2008 eff.org Table of Contents Introduction...1 1. Are you an OSP?... 1 2. How OSPs Can Develop Sane Network Policies to Protect Themselves From Legal Liability
The Cloud and the Small Law Firm: Business, Ethics and Privilege Considerations COMMITTEE ON SMALL LAW FIRMS NOVEMBER 2013 NEW YORK CITY BAR ASSOCIATION 42 WEST 44 TH STREET, NEW YORK, NY 10036 The Cloud
ACA Code of Ethics As approved by the ACA Governing Council 2005 AMERICAN COUNSELING ASSOCIATION www.counseling.org About ACA The American Counseling Association (ACA) is a nonprofit professional and educational
Data Protection Act 1998 Guidance on the use of cloud computing Contents Overview... 2 Introduction... 2 What is cloud computing?... 3 Definitions... 3 Deployment models... 4 Service models... 5 Layered
VOIP for Telerehabilitation: A Risk Analysis for Privacy, Security, and HIPAA Compliance Valerie J.M. Watzlaf, PhD, RHIA, FAHIMA, Sohrab Moeini, MS, and Patti Firouzan, MS, RHIA Department of Health Information
Electronic Records Handbook Table of contents Key points to consider 3 Introduction 5 Selecting an appropriate system 7 Regulation of electronic records (erecords) 10 Patient consent and rights to access
Computer security guidelines A self assessment guide and checklist for general practice 3rd edition istockphoto.com/marcela Barsse Computer security guidelines A self assessment guide and checklist for
The Department of Health and Human Services Information Systems Security Awareness Training Fiscal Year 2015 Information Systems Security Awareness Introduction Information Security Overview Information
Federal Trade Commission Privacy Impact Assessment Mobile Device Management System February 2015 1 1. Overview The FTC Mobile Device Management (MDM) System includes three separate components that provide
hottopic ARMA International s MAKING THE JUMP TO THE CLOUD? How to Manage Information Governance Challenges www.arma.org Governance for Protecting Information in the Cloud Barclay T. Blair If your organization
Technology in Human Services: Using Technology to Improve Quality of Life Susan Kincaid, Ph.D., Editor Council for Standards in Human Service Education MONOGRAPH SERIES September 2004 Technology in Human
Welcome to the HIPAA, Privacy & Security Training Module THIS TRAINING MODULE IS APPROVED FOR NON-COMMERCIAL USE ONLY. Copyright protected by the University of North Carolina at Chapel Hill, 2013-15 During
Agreements between Cloud Service Providers and their Clients: A Review of Contract Terms Robert McLelland, Yvette Hackett, Grant Hurley, Daniel Collins InterPARES Trust ABSTRACT: This paper explores the
WITH LIBERTY TO MONITOR ALL How Large-Scale US Surveillance is Harming Journalism, Law and American Democracy H U M A N R I G H T S W A T C H With Liberty to Monitor All How Large-Scale US Surveillance
6100-010588 FINAL REPORT OF FINDINGS Investigation into the personal information handling practices of WhatsApp Inc. January 15, 2013 REPORT OF FINDINGS Our File: 6100-010588 Complaints under the Personal
HIPAA Security Risk Analysis Toolkit In January of 2013, the Department of Health and Human Services Office for Civil Rights (OCR) released a final rule implementing a wide range of HIPAA privacy and security
Computer Forensic Services and the CPA Practitioner 2010-2012 Forensic Technology Task Force 2010-2012 Forensic Technology Task Force Ron Box Margaret Daley Carl Hoecker Joel Lanz Charles Reid Donna Tamura
Delgado Community College Information Technology Security Policy Approved: *November 5, 2010 ) Delgado Community College IT Security Policy Page 2 *November 5, 2010 Table of Contents Title Page 1.0 Introduction
Cyber Security Planning Guide The below entities collaborated in the creation of this guide. This does not constitute or imply an endorsement by the FCC of any commercial product, service or enterprise
Internet & Cell Phone Usage Policy The Internet usage Policy applies to all Internet & Cell phone users (individuals working for the company, including permanent full-time and part-time employees, contract
Recommendations for Electronically Stored Information (ESI) Discovery Production in Federal Criminal Cases Department of Justice (DOJ) and Administrative Office of the U.S. Courts (AO) Joint Working Group
Summary of Responses to an Industry RFI Regarding a Role for CMS with Personal Health Records Table of Contents EXECUTIVE SUMMARY... 4 1. INTRODUCTON... 7 2. CMS ROLE WITH PHRs... 9 What PHR functionalities
2014 ACA Code of Ethics As approved by the ACA Governing Council AMERICAN COUNSELING ASSOCIATION counseling.org Mission The mission of the American Counseling Association is to enhance the quality of life
Global Network Initiative Public Report on the Independent Assessment Process for Google, Microsoft, and Yahoo Global Network Initiative Protecting and Advancing Freedom of Expresssion and Protecting and