For more info on a specific newsletter, click the title. Details will be displayed in a new window.
Subscribe to
Computerworld 40 years of the most authoritative source of news and information for IT leaders.
Health care groups to review telecommuting policies
or
Other Computerworld Stories
|
|
|
|
May 07, 2001 (Computerworld) -- To comply with government regulations, health care organizations aren't just overhauling their operations. They're also reviewing their telecommuting policies.
 |
Under Wraps Health care organizations can protect private information used by telecommuters by:
|
Improving security measures for home devices, with encryption, PKI or biometric ID devicesThe privacy rules of the Health Insurance Portability and Accountability Act, with which health care organizations must comply by April 2003, states that unauthorized persons can't have access to private medical data. That has prompted several health organizations to review their telecommuting policies to prevent off-site privacy breaches.
"At work, you can make sure people don't enter a facility unless they're authorized, but at home, it's different," said Jim Hudack, CEO of UnitedHealth Group Inc.'s technologies division in Minnetonka, Minn.
Although Hudack doesn't think HIPAA will force UnitedHealth to ban telecommuting altogether, he said the company has to "be careful about what we let people work on at home."
For instance, if an employee was telecommuting and his son walked into the room and saw confidential patient information, that would violate the privacy rule.
Health care organizations also need to consider whether telecommuters are downloading patient information from the network and storing it on their home computer hard drives, said James Harvey, an attorney at Alston & Bird LLP in Atlanta who specializes in privacy issues. If so, organizations need to extend security rules to home computers, he said.
"It's much easier to address security issues in a centralized mainframe environment than on a distributed basis," he said.
HIPAA includes measures for both the security and privacy of patient information. Penalties for breaches include severe fines and possible jail time. To avoid these consequences, many health care organizations said they will ramp up security measures to protect applications on home devices, such as using virtual private networks, encryption or public-key infrastructure.
To comply with the final HIPAA security rules, health care managers will have to authenticate who is accessing the data, said Patrick Grotton, CIO at Mercy Hospital in Portland, Maine.
Grotton said he's considering using a biometric device, such as an eye or fingerprint scanner, combined with various layers of password protection to ensure that unauthorized individuals can't access patient information.
But to a large extent, privacy measures will involve educating and training telecommuters and enforcing policies. Some health care IT managers said telecommuters who work in a home office rather than at a computer set up in the living room or bedroom are less likely to invite prying eyes.
Employees at Cook County Hospital in Chicago, including systems employees who access information from home, must sign a patient confidentiality agreement prior to employment, said Soloman Appavu, director of systems planning. But in order to comply with HIPAA, the hospital will also implement strict disciplinary procedures for any confidentiality breaches, he said.
To a certain extent, however, hospitals may have difficulty ensuring that telecommuters are keeping data private, said Appavu.
"If the person is not honest, then you're taking a risk," he said. It may be "beyond that person's control to secure a device."
Related stories:
- Medical privacy rules to take effect, but changes could follow, April 12, 2001
- HIPAA privacy rules under fire in Washington, March 22, 2001
- Survey: HIPAA tops health care IT agenda, Feb. 6, 2001
|
Print this Story |
|
Send Us Feedback |
|
E-mail this Story |
|
Digg this Story |
|
Slashdot this Story |
|
|
|
|
 |
|
All Zones Application Performance Zone Enterprise-Class Security Zone Enterprise Solutions Zone The File Data Management Zone Grid Computing on Windows Zone Security Management Zone ITIL Best Practices Zone The SAS Zone Storage Virtualization Zone The Data Center Management Zone |
 See your link here
|
 |
||||||||
| ||||||||
| ||||||||
| ||||||||
|
Critical Considerations for Data De-duplication
Download this whitepaper now.
Download this survey results white paper for free, compliments of Tealeaf.
Read up on the latest ideas and technologies from companies that sell hardware, software and services.
- Mozilla launches Firefox 3.0 RC1 early
- Microsoft: Don't misunderstand UAC, other Vista features
- HP confirms XP SP3 endless reboot snafu, promises patch
- More top stories
"Security Directions" virtual trade show2008's Code-Red Security Issues for Protecting the EnterpriseWebcasts, white papers, demos, and more. Presented in a unique 3-d environment. Enter our show right now! Click here to enter
|
Provide a Better Customer Experience
Register now for "Provide a Better Customer Experience," a live TechWise TV broadcast. This webcast is free to view, compliments of Cisco. Click here to watch now
|
 |
 Virtualized iSCSI SANs: Flexible, Scalable, Enterprise Storage for Virtual InfrastructuresDownload this white paper |
 Case Study: Simplified DR Planning and ImplementationDownload this case study |
 Webcast: Disaster Recovery Simplified – iSCSI and VMware Site Recovery Manager Deliver ResultsView this webcast |
 Webcast: Data Protection and Disaster Recovery with iSCSI and VMwareView this webcast |
