Welcome to EMR and HIPAA

Look for similar articles under these categories: 

• EMR,
• EMR Security,
• HIPAA General,
• Security Rule

5 responses to "Securing Your HIPAA Controlled Computer Workstations"

1. # Rick G commented on November 10th, 2006:

   My organization is struggling with setting the time out on work stations. How did you come to the 25 minute recommendation?
   RG

2. # administrator commented on November 10th, 2006:

   We struggle with it too. It’s such an arbitrary number really. I think we got 25 minutes from some HIPAA template we found. I think we want to get to 15 minutes, but I’m not sure our clinicians can handle that short.

   Ideally, we’ll be doing biometric facial recognition within the next couple months. With facial recognition we can set the timeout to 5 seconds. Then, this really becomes a non issue. I should have a post about my implementation of facial recognition soon.

3. # Rick G commented on November 10th, 2006:

   We have a 15 minute network time out on work stations that are in “non-secure areas”, the providers hate it. Feel it is much too short and the definition of “non-secure” is too rigid. I will be interested to hear how the biometric devices work. We have tried proximity devices and pulled them out. If you require a PIN to entered you don’t gain much and there were a lot of other problems.

4. # Stonewall commented on November 16th, 2006:

   You guys need a security geek, by the hour….
   

   Workstations in public areas are a problem. If you password-protect the screensaver, and the original user gets locked out by the timeout, then only that user, or an admin, can unlock that workstation (because admin rights are required to force logoff another user). If Suzie walks away, and Charlie needs to use the workstation, Charlie is locked out. Unless you make everyone an admin, which is even more horrible an idea.

   Set the screensaver to 5-10 minutes, and don’t password-protect it. Train staff to “politely” guard workstations; also train them to minimize apps when not in use. If you have public workstations that are not in areas normally frequented or occupied by staff (which would be very unusual), then your users are going to have to log on, use the workstation, then log off. And yes, they are going to hate you for it. The alternative is for some passerby to find out that someone else is HIV positive…

   I am still looking for a biometric solution to this that integrates well with Active Directory AND alleviates the admin / user issue. By the way, to the original starter of this thread, Windows Active Directory and Group Policies make a great deal of HIPAA security measures possible.

5. # administrator commented on November 18th, 2006:

   Stonewall,
   The biometric facial recognition solution that I talked about integrates fully with Windows Active Directory and Group Policy. You should check it out. They have two ways to do it. You can extend the active directory schema or you can use the existing objects. I agree that any biometric solution needs to integrate with active directory. The biometric footprint needs to be available for all workstations or it would be misery.