Strategies for Writing a HIPAA-Friendly BYOD Policy

Transcription

1 Strategies for Writing a HIPAA-Friendly BYOD Policy

2 Strategies for Friendly With bring-your-own-device (BYOD) on the rise, it is essential for CIOs to secure their networks against data breaches especially with HIPAA in mind. With a thoughtful combination of a BYOD policy and technology controls, personal devices can be secured. Read this expert E-Guide to discover the strategies you should consider for shaping a successful BYOD policy. Friendly BYOD Policy The bring-your-own-device movement can't be stopped, but for HIPAAminded health care CIOs who must secure their networks against data breaches, personal devices must be contained via a BYOD policy. In SearchHealthIT's virtual trade show presentation "BYOD for Healthcare: The Good, the Bad and the Ugly," John Halamka, M.D., CIO at Beth Israel Deaconess Medical Center (BIDMC), shared some of his experiences implementing BYOD policies for the hospital. He also offered some tips for attendees in the process of crafting or refining their BYOD policy. "My experience overseeing 3,000 physicians and 12,000 employees is that BYOD is here to stay," said Halamka, adding that while it's a tough and potentially expensive row to hoe security-wise, employee-owned smartphones, tablets and notebooks can contribute positively to productivity, quality and safety in health care. BYOD security issues are so vexing because it's not just a problem, it's a paradox. "I see that not only do people have one device, but they have two and maybe in the near future, three or more," Halamka said. "CIOs have limited authority but infinite accountability." There is no one-size-fits-all approach or technology control for securing all mobile devices on their various operating systems (such as Android, ios, Page 2 of 5

3 Strategies for Friendly and the various flavors of Linux and Windows), Halamka said. Furthermore, it's difficult to manage an employee user base whose technology savvy varies. Compliance on each individual device is a moving target: Employees are constantly upgrading their devices and operating systems. But based on what has worked so far at Beth Israel in its constantly evolving efforts to secure mobile devices, Halamka offered the following ideas that health care providers shaping their own BYOD policy should consider: Plan first for mobile device malware, specifically those employing screen-scraping and keylogging, especially on laptops that employees use both at home and work. The problem is that policy isn't enough, yet state-of-the-art mobile device management software can cost $50 to $100 per device, an untenable budget number for many health systems. Mixing a little policy with a little control is how to start, and hoping the combination -- policy compliance by employees coupled with technology controls -- will prevent breaches. Start with a policy requiring "nontrivial password" protection of access to patient data. Add time-out periods that require the password to be re-entered. At Beth Israel there's a third policy prong that isn't popular among employees who store personal data, such as family pictures, on their devices, but they do it anyway: After 10 incorrect password attempts on a device credentialed for the network, its content is remotely wiped. That means employees should keep devices they use for work away from small children who innocently click around touchscreens or laptop keyboards. Always encrypt protected data. Don't be lulled into thinking this is foolproof on smartphones and the only protection needed, either, Halamka said. Know how native encryption works for the devices your policy will support. Encryption keys for the iphone, for example, reside on the device itself, making it akin to locking your house but "hiding the key under the doormat," he said. But it's effective enough that BIDMC's policy includes a six-month password change coupled Page 3 of 5

4 Strategies for Friendly with an encryption attestation requirement so the hospital knows employees are complying with this piece of policy. Attestation happens at what he calls "encryption depots," where employees give their personal devices to IT staffers, who check them to make sure that encryption's enabled. Disable unneeded device services and wireless interfaces (for example, Wi-Fi and Bluetooth) when they're not in use. Monitor and keep antivirus software updated on all devices -- even though, Halamka acknowledged, it isn't as effective as it used to be, considering new computer viruses that self-mutate and stay ahead of some antivirus software. Don't downplay the importance of physical controls in your policy, such as requiring that employees keep laptops under lock and key when they're unattended, both at home and at the office. Employees also should keep phones on their person or locked, and computers in trunks, not in passenger compartments when their car is unattended, and so forth. Have a theft-reporting procedure in place so stolen devices can be tracked, wiped or otherwise dealt with as quickly as possible. Don't forget device disposal rules that seal off the network from predators sifting through the trash. "Disposing of a device appropriately is important," Halamka said, "because the last thing that you want is a device with personal or patient-identifiable data ending up in a landfill where somebody retrieves it and a privacy breach occurs. We've all heard about issues of devices, hard drives, backup tapes and other things ending up in landfills, and patient privacy being threatened." Page 4 of 5

5 Strategies for Friendly Free resources for technology professionals TechTarget publishes targeted technology media that address your need for information and resources for researching products, developing strategy and making cost-effective purchase decisions. Our network of technology-specific Web sites gives you access to industry experts, independent content and analysis and the Web s largest library of vendor-provided white papers, webcasts, podcasts, videos, virtual trade shows, research reports and more drawing on the rich R&D resources of technology providers to address market trends, challenges and solutions. Our live events and virtual seminars give you access to vendor neutral, expert commentary and advice on the issues and challenges you face daily. Our social community IT Knowledge Exchange allows you to share real world information in real time with peers and experts. What makes TechTarget unique? TechTarget is squarely focused on the enterprise IT space. Our team of editors and network of industry experts provide the richest, most relevant content to IT professionals and management. We leverage the immediacy of the Web, the networking and face-to-face opportunities of events and virtual events, and the ability to interact with peers all to create compelling and actionable information for enterprise IT professionals across all industries and markets. Related TechTarget Websites Page 5 of 5