iphones, ipads and HIPAA Compliance: A How To Guide

Transcription

1 Welcome iphones, ipads and HIPAA Compliance: A How To Guide

2 New Possibilities Create Challenge and Risk Possibility Risk Challenge

3 What We ll Explore Today Choosing a mobile device platform Instituting an IT mobility management framework Empowering healthcare IT to proactively identify and resolve HIPAA violations & provide proof of compliance

4 Attendee Profile

5 Possibility Choosing the Right Device

6 Mobile Devices Bring Utility for the Entire Organization Hospital Pharmacy Field Triage Homecare Teaching

7 Poll Question Which of the following tasks or capabilities do you plan for ipads/ ipods/iphones (select up to 3): Lab orders & results Clinical decision support Medical image viewing E-prescribing Prescription drug referencing General administration including billing, coding & claims

8 Best Fit Form factor Apps Cost

9 What s the Right Device?? Things to consider: Native data protection? Secure and flexible app distribution? Native integration with existing IT infrastructure? 9

10 Security Not All Devices are Equal

11 There s an App for That App Store for third party apps Reduces barriers to homegrown innovation 7000

12 Poll Question What is the expected timeframe for your ios pilot or deployment? Immediately Next 3 months Next 6 months Next 12 months Not sure

13 Challenge Instituting Mobility Management

14 Rapid Expansion of Mobility in Healthcare First Wave Mobility Second Wave Mobility Mobile Applications 1 è 10+ Mobile Platforms 1 è 5 Mobile Devices 5 è 50+ Enterprise Mobility Management Mobile Users 20% è 80% 14

15 Poll Question What management challenges do you anticipate as you roll out mobile devices such as the ipad (select up to 3)? Process for secure configuration and deployment Deploying and managing approved apps Ensuring mobility is auditable and compliant Identifying rogue or unauthorized devices Readying the Help Desk for support calls

16 Extending IT Control & Scale to Mobility EMM Enterprise Mobility Management provides a single point of control to proactively manage the entire mobile lifecycle for today and the future 7 steps to ready for the second wave of mobility 16

17 1. Adopt a Mobility Management Platform Key Considerations Mobility is key to the whole organization Diversity across devices & apps drives up complexity curve Recommendations Adopt a modular platform that is extensible over time new capabilities address new challenges Platforms integrate with existing IT infrastructure, people and process Group different classes of users & establish appropriate policies & procedures

18 2. Organize for Mix of Employee-Liable Devices Key Considerations Workers are using their own personal devices for work Most organizations have never allowed employee technology Recommendations Create formalized procedures & processes for allowing EL Create formal policy & enforce signed EULA agreements Use security software that controls ephi, but also preserve user s personal data Deploy Automated Asset Management to track & control

19 3. Organize for ipad in the Workforce Key Considerations Tablets present new opportunities for point-of-use Applications and LOB scenarios are driving demand These devices are more akin to smartphones then laptops Recommendations Tap your existing mobile IT specialists to support and roll out Provide cross-os tools and monitoring Extend existing laptop and mobile security standards

20 4. Organize for 2+ Devices per Mobilized Employee Key Considerations Smartphones, Tablets & Laptops are optimized for different tasks Tablets do not necessarily replace laptops, esp. content creation Users will want consistency of service across devices Seeing strong mix of iphone+ipad Recommendations Plan for most users having multiple devices Ensure approaches & technologies can easily accommodate

21 5. Organize for 2-3 Mobile Applications Key Considerations Expect strong demand for apps Mail-first will extend to LOB & Rolebased app requests Look to existing application portfolio for mobile app extensions Recommendations Deploy Application Catalog for OTA app management of internal apps and App Store Apps Deploy Asset Management to track & control Leverage device security for internal apps and native app security for third party apps

22 6. Organize for 2+ Support Issues per Mobile User Key Considerations Industry benchmarks show avg. organization has 2-4 issues per mobile user per year Service Desk teams typically have zero visibility into device status Service Desk teams lack training & access to myriad of devices & apps Recommendations Employ Tiered Mobility Support Strategy Deploy Automated Support Management

23 Console Visibility is Essential Automatically identifies specific failure with no manual hunting Alerts to detected problem 1-Click Fix-It to take action fast Simple step-by-step resolutions with embedded Best-Practice Knowledgebase 23

24 7. Organize for Managing Risk Key Considerations Typically cannot exactly match current PC-based policies & procedures Security capabilities moving targets & vary over time Recommendations Leverage AD/LDAP & extend existing policies Deploy Automated Security Management Deploy Automated Compliance Enforcement & Governance

25 Risk Ensuring HIPAA Compliance in Mobility

26 Mobile Security for Healthcare is Complex ephi universe is broad Data are individually identifiable if they include any of the 18 types of identifiers Hospital electronic patient records Hospital & medical school Homecare healthcare records Clinical drug trial results Device universe is diverse Different form factors, mobile operating systems and capabilities Security will vary by mobile operating system and vendor Devices can be owned by the employer or the employee

27 Security ROI Typical HIPAA Violation ~ $150,000

28 Poll Question What regulatory mandates apply to your organization (chose all that apply)? HIPAA GLBA FERPA Sarbanes-Oxley Pharma (FDA, DEA) Other

29 Mobility Assessment HIPAA Criteria Question Mobile Device Is all Electronic Protected Health Information (ephi) stored on a mobile device protected by password access and data 1 Workforce security encryption? 2 Security incident procedures 3 Contingency plan 4 Workstation security Are users required to report lost devices? Do you have backup and restore capabilities that ensures the integrity of ephi if the device is lost or damaged during an emergency or disaster? Do you limit network access based on user compliance with security policies? 5 Device and media control 6 Access control 7 Audit control 8 Integrity 9 Person or entity authentication 10 Transmission security If a device is lost or removed from service, do you wipe it to ensure that ephi is removed from the device? Do you have the ability to prevent users from installing third party applications on corporate devices? Have you implemented audit controls to record and examine activity on remote devices that contain or use ephi? Do you have security compliance management and reporting facilities to ensure that user compliance is maintained while also providing evidence for external HIPAA compliance audits? Does your authentication management solution for mobile devices support password policies beyond simple PIN or password? Do mobile devices use a secure VPN or SSL connection to transmit ephi over the internet?

30 Implementing HIPAA Security for Mobility

31 Automated Policy Management Apple APNS 2 1 Active Directory 3 MDM Server Leverage Active Directory for authentication, authorization and group-based policies Actions in Active Directory trigger policy updates to device Policies changes are transparent to the user 31

32 Native Security Enforcement Authentication & Authorization Access Control Data Protection Malware Protection Strong passcodes Digital certificates Keychain services Integration with RSA and other 3 rd party capabilities WiFi VPN Hardware encryption Wipe Encrypted backups Runtime protection Mandatory code signing 250+ Settings and Policies 32

33 Automated Compliance Management Monitor the device and back-end IT systems " " " Unmanaged devices Lost devices Rogue devices Devices out of IT spec User is unauthorized Tailored Actions by compliance violation Quarantine device Selective wipe Full wipe Notify user Notify IT stakeholders Incident Reports Archived Data for Audit & Compliance 33

34 Centrally Enforce & Track Security Compliance Automatically tracks & detects security & policy violations Automatically tracks & isolates rogue devices 34

35 Compliance Enforcement Spans All of IT Quickly identify compliance actions that have completed 1 Click Fix-It take next step actions as needed when user calls 35

36 Let s Review HIPAA Criteria Question Mobile Device 1 Workforce security Is all Electronic Protected Health Information (ephi) stored on a mobile device protected by password access and data encryption? Native Security 2 Security incident procedures Are users required to report lost devices? Proactive Compliance 3 Contingency plan Do you have backup and restore capabilities that ensures the integrity of ephi if the device is lost or damaged during an emergency or disaster? Encrypted itunes 4 Workstation security Do you limit network access based on user compliance with security policies? Automated Compliance 5 Device and media control 6 Access control 7 Audit control 8 Integrity 9 Person or entity authentication 10 Transmission security If a device is lost or removed from service, do you wipe it to ensure that ephi is removed from the device? Do you have the ability to prevent users from installing third party applications on corporate devices? Have you implemented audit controls to record and examine activity on remote devices that contain or use ephi? Do you have security compliance management and reporting facilities to ensure that user compliance is maintained while also providing evidence for external HIPAA compliance audits? Does your authentication management solution for mobile devices support password policies beyond simple PIN or password? Do mobile devices use a secure VPN or SSL connection to transmit ephi over the internet? Automated Compliance Native Security & Automated Compliance Automated Compliance Automated Compliance Third party apps Native Security

37 BoxTone Meets All of Your Mobility Needs Automated Security and MDM for HIPAA Compliance Auto-enforce security on employee devices Auto-detect compliance violations, quarantine & selective wipe OTA self-provisioning of devices OTA App deployment via enterprise app catalog Full reporting for compliance verification and auditing Full Lifecycle Management for Scale and Control Single point of control Automated Level 1-3 support Mobile Analytics to optimize performance and ensure high reliability 37

38 Our Customers Have Made Us the Industry Standard Healthcare BCBS Kaiser Permanente MD Anderson UPMC US Army Medical Veterans Affairs Medical Suppliers Abbott Bristol-Myers Squibb Eli Lilly McKesson Merck Roche Government California OIT EPA House of Reps Justice Department Ontario State Department Financial Services Barclays Citi JPMC Lincoln Financial PNC Wells Fargo MSP & Outsourcing CSC Dell (Perot) Deloitte HP Services IBM Global Services Xerox (ACS) Retail & Media COX ebay News Corp/Fox Staples Virgin Media Houghton Mifflin Energy & Utilities Constellation Energy Exelon Mirant SCANA WE Energies Westar Energy Manufacturing Bombardier Caterpillar Henkel Honeywell Northrop Grumman Texas Instruments

39 Get This How To Guide Mobile Security for HIPAA Compliance

40 Questions? Dan Dearing Group Director, Mobile Strategies BoxTone