Local Encryption ... Why Not?
-
@Dashrender said:
@Jason said:
@Dashrender said:
Yes sure roles - of course, but in every situation I've seen, the roles of those who 'need' access to patient data, allow full unfettered access to every patient the hospital has on their system (with rare exception - I've seen some systems have a VIP tag for celebrities. this tag would prevent anyone but senior people to have access to those few records, but, the general public... the staff have full access.)
This is actually a bit of the opposite of the way we delegate access. For example higher ups such as Directors, C level Management, Board etc. Do not have access to modify financial data, some don't even have access to view. There is a lot of separation of roles.
That only works because there is never a time that those people require access to those systems to get their job done or save a life. You have a separation of duties that allows for that kind of division. Rarely does healthcare appear to have so easily definable boundaries.
Not really we have our own Doctors, first responders , Safety team and we even have a community college.
-
@BRRABill said:
@Dashrender said:
To drive my point home:
We have fired two people over the last several years because they logged into a health system they were granted access to because our providers work there as well. They illegally gained access to patient data that had no connection to our providers.
Why is this even possible? Obviously it doesn't need to be so.. but it is, everywhere - in every system they have a logon for, they have full or near full unfettered access to all patients in the entire system.
Right. That is something I think would be fixed with @scottalanmiller 's suggestions.
Encryption does nothing for that.
Except for when that same employee who should know better does that on a laptop and it gets stolen. And the the auditors trace that. Uh-oh.
Does strict policy protect from that? That's something that I don't know about. If you have a clear policy that this is not allowed and they choose to take that data out of the allowed systems, can it be on them not on the company? No different than any other kind of theft? I know that you can do that if you move to VDI or terminal servers.
-
@StrongBad said:
Does strict policy protect from that? That's something that I don't know about. If you have a clear policy that this is not allowed and they choose to take that data out of the allowed systems, can it be on them not on the company? No different than any other kind of theft? I know that you can do that if you move to VDI or terminal servers.
Yes, you could go after them. But technically they would be coming after you first. It's up to you to make sure that doesn't happen, or if it does, it does not get breached.
There are many levels. If they are allowed access to the data it's not a concern unless the machine they are using gets stolen. Then it is a breach.
If they are NOT allowed to access the data as part of their job, it is a breach in and of itself. Our policy dictates strict penalties for such a thing, and varies by levels ranging from a total mistake on their part to malicious theft of the data.
-
@BRRABill said:
There are many levels. If they are allowed access to the data it's not a concern unless the machine they are using gets stolen. Then it is a breach.
But if putting data ON the machine is their decision and they were not allowed to do it, isn't that itself the breach? Or if you need an additional step, the breach is theirs not yours?
-
@BRRABill said:
If they are NOT allowed to access the data as part of their job, it is a breach in and of itself. Our policy dictates strict penalties for such a thing, and varies by levels ranging from a total mistake on their part to malicious theft of the data.
Is misuse of data not a breach - even if the person is allowed to have access to it? A bank manager has access to money, but he isn't allowed to take it home.
-
BTW:
I contacted Wave and asked if their software (or the drives they support) has any sort of lockout period.
They do not.
So if you happen to steal my laptop and take out the drive, you could theoretically sit and manually guess my password until the cows come home. Maybe one day you'll get it.
Even with that, I'd still like to know how this system provides the illusion of security.
-
@StrongBad said:
But if putting data ON the machine is their decision and they were not allowed to do it, isn't that itself the breach? Or if you need an additional step, the breach is theirs not yours?
OCR can go after individuals as well, if they were malicious in their intent. However, the employer would also be fined as it is their responsibility to protect the data.
I guess employers could sue the employee to recover the fine.
-
@StrongBad said:
Is misuse of data not a breach - even if the person is allowed to have access to it? A bank manager has access to money, but he isn't allowed to take it home.
Misuse would require an assessment to be done. It would then be determined whether or not it was a breach.
Usually if it stayed in-house it would not be a breach. If you saw your neighbor in the office, looked up he was being treated for something unsavory, and then told his wife, that would be a breach.
-
@BRRABill said:
BTW:
I contacted Wave and asked if their software (or the drives they support) has any sort of lockout period.
They do not.
So if you happen to steal my laptop and take out the drive, you could theoretically sit and manually guess my password until the cows come home. Maybe one day you'll get it.
Even with that, I'd still like to know how this system provides the illusion of security.
Well.... it makes you feel like you are reasonably secure to a minimum level, right? That is the illusion.
-
@BRRABill said:
@StrongBad said:
But if putting data ON the machine is their decision and they were not allowed to do it, isn't that itself the breach? Or if you need an additional step, the breach is theirs not yours?
OCR can go after individuals as well, if they were malicious in their intent. However, the employer would also be fined as it is their responsibility to protect the data.
I guess employers could sue the employee to recover the fine.
Employers are NOT required to protect the data. They are only required to provide reasonable protection attempts. An authorized user with appropriate use deciding to misuse or steal data by putting it on their desktop would be no different than any theft. Are you saying that if any employee at your customers now just grabbed data that they were using and ran out the door with it that you would be fined for having been compromised even though no security of yours was compromised?
-
@BRRABill said:
@StrongBad said:
Is misuse of data not a breach - even if the person is allowed to have access to it? A bank manager has access to money, but he isn't allowed to take it home.
Misuse would require an assessment to be done. It would then be determined whether or not it was a breach.
Usually if it stayed in-house it would not be a breach. If you saw your neighbor in the office, looked up he was being treated for something unsavory, and then told his wife, that would be a breach.
Wouldn't it be a breach the moment that someone took data and removed it from the allowed security system and exposed it? It may not have been used maliciously yet. But it has been taken already. It sounds like you only consider it a breach once it has been misused, not just when it has been removed.
Similar to saying a bank isn't robbed when the money is stolen, only when the stolen money is used to buy things.
-
@scottalanmiller said:
Well.... it makes you feel like you are reasonably secure to a minimum level, right? That is the illusion.
I feel much more than minimally secure.
Are you that certain someone can hack my SED?
-
@scottalanmiller said:
Employers are NOT required to protect the data. They are only required to provide reasonable protection attempts. An authorized user with appropriate use deciding to misuse or steal data by putting it on their desktop would be no different than any theft. Are you saying that if any employee at your customers now just grabbed data that they were using and ran out the door with it that you would be fined for having been compromised even though no security of yours was compromised?
Employee "steals" data from their local hospital they are not allowed to have access to and puts it on a USB drive.
USB drive get stolen.
Local newspaper finds out about the PHI on the USB drive, does story.
OCR goes after ... the thief, you say? The hospital is in the clear? -
@scottalanmiller said:
Wouldn't it be a breach the moment that someone took data and removed it from the allowed security system and exposed it? It may not have been used maliciously yet. But it has been taken already. It sounds like you only consider it a breach once it has been misused, not just when it has been removed.
Similar to saying a bank isn't robbed when the money is stolen, only when the stolen money is used to buy things.
Legal words:
A breach of protected health information (“PHI”) is defined as the acquisition, access, use, or disclosure of unsecured PHI, in a manner not permitted by HIPAA, which poses a significant risk of financial, reputational, or other harm to the affected individual.7 Parsing this definition into its components, there must be: (1) an access to, or use or disclosure of unsecured PHI; (2) a use, access or disclosure that violates the “Privacy Rule” ( i.e., Subpart E of 45 C.F.R. 164); (3) a significant risk that such access, use or disclosure will cause financial, reputational, or other harm to the patient; and (4) no exceptions that apply.If the data doesn't leave the building, no harm done.
If someone's ex looks up information on whether someone has an STD, and tells people about it. Harm has been done. (True story.)
In your bank robbing example, it would be like if they rob the bank, but leave the money there. Or like someone just put the money in the wrong place, but it never actually got stolen.
-
@BRRABill said:
@scottalanmiller said:
Employers are NOT required to protect the data. They are only required to provide reasonable protection attempts. An authorized user with appropriate use deciding to misuse or steal data by putting it on their desktop would be no different than any theft. Are you saying that if any employee at your customers now just grabbed data that they were using and ran out the door with it that you would be fined for having been compromised even though no security of yours was compromised?
Employee "steals" data from their local hospital they are not allowed to have access to and puts it on a USB drive.
USB drive get stolen.
Local newspaper finds out about the PHI on the USB drive, does story.
OCR goes after ... the thief, you say? The hospital is in the clear?The hospital should be in the clear. Assuming a few things of course. The employee had reasons to have access to the data in the first place, and the hospital has policies that state that users can't copy data on to memory sticks.
-
@BRRABill said:
If the data doesn't leave the building, no harm done.
I don't agree with this. Once the employee has the data, the breach has happened. Because the employee has broken the rules and copied the data someplace it's not suppose to be. The employee is the breach.
-
@Dashrender said:
I don't agree with this. Once the employee has the data, the breach has happened. Because the employee has broken the rules and copied the data someplace it's not suppose to be. The employee is the breach.
There is a breach in the simplest definition of the word. But it might not be a HIPAA violation.
-
@Dashrender said:
The hospital should be in the clear. Assuming a few things of course. The employee had reasons to have access to the data in the first place, and the hospital has policies that state that users can't copy data on to memory sticks.
They would still have to report the breach, including to the media.
And be investigated by the OCR.
And hope, as you said, they had covered all these things in the documentation and training. And REALLY hope they hadn't already been warned about it.
-
@Dashrender said:
I don't agree with this. Once the employee has the data, the breach has happened. Because the employee has broken the rules and copied the data someplace it's not suppose to be. The employee is the breach.
I don't agree with your disagreement.
The employee should NEVER been given access to the data. That would definitely be considered a breach.
-
@BRRABill said:
@Dashrender said:
The hospital should be in the clear. Assuming a few things of course. The employee had reasons to have access to the data in the first place, and the hospital has policies that state that users can't copy data on to memory sticks.
They would still have to report the breach, including to the media.
And be investigated by the OCR.
And hope, as you said, they had covered all these things in the documentation and training. And REALLY hope they hadn't already been warned about it.
In this situation if the hospital knew that this employee did in fact download this against company policy.. i think they'd have no choice but to report it, legally. Assuming they discovered is as soon as it happened, they could also report that the data was never at large risk, but the report I would think legally would still need to be made.
