Portable Devices: Convenience

and/or Conundrum

Kim R. Pemble, M.S.Kim R. Pemble, M.S.

Vice President IS and CIOVice President IS and CIO

SynergyHealthSynergyHealth

AgendaAgenda

Introduction Setting the Stage

Events from real lifePortable MediaTechnology and Workflow IntegrationPolicy and Procedure DiscussionQuestions and Answers

SynergyHealthSynergyHealth

St. Joseph’s HospitalSt. Joseph’s Hospital 80 inpatient beds80 inpatient beds ~4,900 IP admissions, HOV ~61,000, ECC ~4,900 IP admissions, HOV ~61,000, ECC

~16,000 ~16,000 Physicians in addition to WBCPhysicians in addition to WBC New replacement hospital August 7, 2005New replacement hospital August 7, 2005

West Bend Clinic and SatellitesWest Bend Clinic and Satellites 75 physicians75 physicians Office visits ~430,000 annuallyOffice visits ~430,000 annually

Breaking News…..Breaking News…..Austin, Texas, police are investigating after security Austin, Texas, police are investigating after security

cameras captured video of the thief carrying out a cameras captured video of the thief carrying out a laptop and a projector from a Seton Family of laptop and a projector from a Seton Family of Hospitals office.Hospitals office.

http://www.informationweek.com/showArticle.jhtml?articleID=197008711 http://www.informationweek.com/showArticle.jhtml?articleID=197008711

Health Care Firm Recovers Stolen Laptop Health Care Firm Recovers Stolen Laptop ““The data on the Dell laptop was encrypted and The data on the Dell laptop was encrypted and

password-protected, according to a statement from password-protected, according to a statement from William Beaumont Hospital in Royal Oak. But the car William Beaumont Hospital in Royal Oak. But the car theft, which occurred Aug. 5 in Detroit, caused theft, which occurred Aug. 5 in Detroit, caused particular concern among hospital officials, because particular concern among hospital officials, because the affected employee's ID access code and the affected employee's ID access code and password were written on a piece of paper that was password were written on a piece of paper that was taped to the inside of the stolen PC.” taped to the inside of the stolen PC.”

http://www.computerworld.com/action/article.do?http://www.computerworld.com/action/article.do?command=viewArticleBasic&articleId=9002765command=viewArticleBasic&articleId=9002765

Breaking News…..Breaking News…..

Sick Kids doctor loses data on Sick Kids doctor loses data on 3,300 patients3,300 patients

Six weeks after Ontario's privacy commissioner Six weeks after Ontario's privacy commissioner ordered the Hospital for Sick Children not to remove ordered the Hospital for Sick Children not to remove electronic health records from the hospital, a doctor electronic health records from the hospital, a doctor lost an external hard drive containing such records lost an external hard drive containing such records at the country's busiest airport.at the country's busiest airport.

The physician, who was traveling to a medical The physician, who was traveling to a medical conference, packed the external hard drive so he conference, packed the external hard drive so he could work while away. Though airport security was could work while away. Though airport security was notified and a search conducted, it was never notified and a search conducted, it was never recovered.recovered.

Aug 31, 2007 04:30 AM MEGAN OGILVIE HEALTH REPORTERhttp://www.thestar.com/living/article/251904

Is Portable Media Really AIs Portable Media Really A“New Problem”?“New Problem”?

Portable Media and Portable Media and “Today’s” Mobility“Today’s” Mobility

Technology Update…Technology Update…

Back in 2004, flash drives averaged about Back in 2004, flash drives averaged about a third of a gigabyte in capacity, according a third of a gigabyte in capacity, according to Semico Research Corp. That average is to Semico Research Corp. That average is now at more than two gigabytes and is now at more than two gigabytes and is expected to top 13 gigabytes by 2010. As expected to top 13 gigabytes by 2010. As storage space goes up, cost has come storage space goes up, cost has come down, making them even more popular to down, making them even more popular to use. use.

"Over time, we're going to see these flash "Over time, we're going to see these flash things increase in use, no doubt about it," things increase in use, no doubt about it," said John Emerson, information technology said John Emerson, information technology manager for the city of Ventura, Calif. manager for the city of Ventura, Calif.

By Allison Bruce, Scripps Howard News Service, August 01, 2007

http://www.scrippsnews.com/node/25835

State of the “Art”State of the “Art”

July 25 2007 – Apple reports selling July 25 2007 – Apple reports selling “… 9,815,000 iPods during the “… 9,815,000 iPods during the quarter, representing 21 percent quarter, representing 21 percent growth over the year-ago quarter …”growth over the year-ago quarter …”

((http://www.apple.com/pr/library/2007http://www.apple.com/pr/library/2007/07/25results.html/07/25results.html) )

10 More Stupid Things Smart IT 10 More Stupid Things Smart IT People Still DoPeople Still Do

1. Cast a jaded eye on emerging 1. Cast a jaded eye on emerging technologies and modes of delivering technologies and modes of delivering technology. technology.

4. Look at security purely from a 4. Look at security purely from a technical standpoint.technical standpoint.

5. On that note, don't lock down 5. On that note, don't lock down laptops. laptops.

10 More Stupid Things Smart IT 10 More Stupid Things Smart IT People Still DoPeople Still Do

6. Consider remote users the 6. Consider remote users the exception rather than the rule. exception rather than the rule.

9. Keep evaluations of new 9. Keep evaluations of new technologies confined to the IT technologies confined to the IT department. department.

http://www.eweek.com/slideshow_viewer/0,1205,l=&s=27323&a=213625&po=11,00.asp?p=y

Work EnvironmentWork Environment Durable Medical Equipment sales and Durable Medical Equipment sales and

serviceservice Visiting Nurse and Home Health Visiting Nurse and Home Health

servicesservices Home HospiceHome Hospice E-PrescribingE-Prescribing Providers traveling and “being on-call”Providers traveling and “being on-call” Portable dictation with VR and e-signingPortable dictation with VR and e-signing

Management and Staff, business or Management and Staff, business or clinical “taking work home”clinical “taking work home” ““It's kind of neat we've got such dedicated It's kind of neat we've got such dedicated

people that want to work at home. We don't people that want to work at home. We don't want to discourage that," said John want to discourage that," said John Emerson, IT manager city of Ventura, Calif. Emerson, IT manager city of Ventura, Calif.

Executives and Management “traveling”Executives and Management “traveling” Various sitesVarious sites State and National “events”State and National “events”

Work EnvironmentWork Environment

Operational backups of dataOperational backups of data Business continuanceBusiness continuance

Portable Media as the “medical Portable Media as the “medical record” of the futurerecord” of the future Or now…. Or now….

Work EnvironmentWork Environment

Equipment To SupportEquipment To Support

LaptopsLaptops Workstations on Wheels (formerly COWs)Workstations on Wheels (formerly COWs) Tablet PCsTablet PCs Personal Digital AssistantsPersonal Digital Assistants Blackberry ™ and cell phonesBlackberry ™ and cell phones USB Memory SticksUSB Memory Sticks Digital & Analog recording (e.g. still, video, Digital & Analog recording (e.g. still, video,

audio)audio) In short, most of the items we reviewed In short, most of the items we reviewed

previouslypreviously

State of the ArtState of the Art

August 30, 2007 August 30, 2007 ComputerworldComputerworld -- A second line of -- A second line of USB drives sold by Sony Electronics Inc. that uses USB drives sold by Sony Electronics Inc. that uses rootkit tactics to hide files has been identified, and the rootkit tactics to hide files has been identified, and the devices' software remains on the Web, a researcher devices' software remains on the Web, a researcher said today. Hackers using just one of the package's said today. Hackers using just one of the package's files can mask their attack code from some security files can mask their attack code from some security scanners, said Mikko Hypponen, chief research officer scanners, said Mikko Hypponen, chief research officer at Helsinki, Finland-based F-Secure Corp. at Helsinki, Finland-based F-Secure Corp.

Technical Toy Choices… Technical Toy Choices… http://www.mobilewhack.com/reviews/portable_devicehttp://www.mobilewhack.com/reviews/portable_devices/ s/

http://newsfeedresearcher.com/data/articles_t35/idt2007.09.01.01.08.15.html#hdng0

Portable MediaPortable Media

Organizational ResponsibilitiesOrganizational Responsibilities Establish a policy on Portable Media Establish a policy on Portable Media Educate their staff on the appropriate Educate their staff on the appropriate

use of Portable Media – organizationally use of Portable Media – organizationally or personally providedor personally provided

… … and right of the organization to and right of the organization to require security guards and/or audit all require security guards and/or audit all such media. such media.

Reasons for and Goals of Reasons for and Goals of Policies and EducationPolicies and Education

Establish a frameworkEstablish a framework Minimize possible adverse outcomes from Minimize possible adverse outcomes from

loss or theft of devicesloss or theft of devices Establish an understanding of the Establish an understanding of the

opportunity and responsibility of opportunity and responsibility of appropriate use appropriate use

Outline options/guidelines for appropriately Outline options/guidelines for appropriately securing ePHI stored on portable mediasecuring ePHI stored on portable media

Protect the public trust in the event of loss Protect the public trust in the event of loss of ePHI on portable mediaof ePHI on portable media

Determine the organizational position Determine the organizational position regarding portable mediaregarding portable media

S.W.O.T. for USB DevicesS.W.O.T. for USB Devices

With recognition to:With recognition to: http://www.itbusinessedge.com/http://www.itbusinessedge.com/

item/?ci=13938item/?ci=13938

StrengthsStrengths High-capacity network for work-at-home High-capacity network for work-at-home

transport, or traveling to a remote office transport, or traveling to a remote office without a laptopwithout a laptop

Users of a shared computer can store their own Users of a shared computer can store their own files on a USB flash drive. Multiple users of the files on a USB flash drive. Multiple users of the company laptop, for example, can each use a company laptop, for example, can each use a USB flash drive to store their individual filesUSB flash drive to store their individual files

A support technician can use a USB drive to A support technician can use a USB drive to carry several GB of diagnostic tools, recovery carry several GB of diagnostic tools, recovery tools, drivers, and critical system updates. tools, drivers, and critical system updates. They can also copy files to PCs and servers They can also copy files to PCs and servers that do not have floppy disk or CD drivesthat do not have floppy disk or CD drives

WeaknessesWeaknesses

The enterprise does not have a firm The enterprise does not have a firm grasp on the business processes grasp on the business processes required to manage a USB drive required to manage a USB drive initiativeinitiative

The enterprise is not fully aware of the The enterprise is not fully aware of the potential risks involved with a USB drive potential risks involved with a USB drive initiativeinitiative

The enterprise is uncertain of how much The enterprise is uncertain of how much productivity can be gained as a result of productivity can be gained as a result of purchasing USB drivespurchasing USB drives

OpportunitiesOpportunities

Cut hardware costs for transporting files. A Cut hardware costs for transporting files. A professional who is asking for a $2,000 professional who is asking for a $2,000 laptop to take project work home could laptop to take project work home could possibly be served by a $1,000 desktop possibly be served by a $1,000 desktop computer and a $50 USB drivecomputer and a $50 USB drive

Flash drives as a medium for portable Flash drives as a medium for portable support software toolkits. In some support software toolkits. In some configurations, a PC can be set to boot from configurations, a PC can be set to boot from an USB flash drive after a hard disk crashan USB flash drive after a hard disk crash

ThreatsThreats A user loses his or her USB deviceA user loses his or her USB device A user's USB device is stolen, the data A user's USB device is stolen, the data

on it is stolen, or it is sold by an on it is stolen, or it is sold by an employeeemployee

The network becomes infected due to The network becomes infected due to viruses, spyware, and other malware viruses, spyware, and other malware hiding in a USB flash drivehiding in a USB flash drive

Non-compliance with regulatory Non-compliance with regulatory requirementsrequirements

Some Guiding PrinciplesSome Guiding Principles Recognize and mitigate risksRecognize and mitigate risks

Introduction of malware/viruses from portable Introduction of malware/viruses from portable mediamedia

Policy that addresses user responsibility and Policy that addresses user responsibility and accountabilityaccountability Provide educationProvide education

Implement technical and policy solutions Implement technical and policy solutions that are technology neutralthat are technology neutral

Ensure that virus software scans all devices Ensure that virus software scans all devices attached to the networkattached to the network

Update physical security guidelines/protocols Update physical security guidelines/protocols to assess portable mediato assess portable media

Consider…Consider… Privacy/Confidentiality Statement be Privacy/Confidentiality Statement be

placed on each device as “read me”placed on each device as “read me” Establishing contact information in the Establishing contact information in the

event that the device is foundevent that the device is found Short of disabling all USB ports, they Short of disabling all USB ports, they

are impossible to defend against. are impossible to defend against. 

Some Guiding PrinciplesSome Guiding Principles

http://labmice.techtarget.com/articles/usbflashdrives.htmhttp://labmice.techtarget.com/articles/usbflashdrives.htm

http://processor.com/editorial/article.asp?article=articleshttp://processor.com/editorial/article.asp?article=articles%2Fp2810%2F33p10%2F33p10.asp&guid=&searchtype=&Wordlist=&bJu%2Fp2810%2F33p10%2F33p10.asp&guid=&searchtype=&Wordlist=&bJumpTo=TruempTo=True

Technology does not drive change at Technology does not drive change at all. Technology merely enables all. Technology merely enables

change. It’s our collective cultural change. It’s our collective cultural response to the options and response to the options and opportunities presented by opportunities presented by

technology that drive change.technology that drive change.Paul SaffoPaul Saffo

Culture eats Strategy for BreakfastCulture eats Strategy for BreakfastGlyn ElwynGlyn Elwyn

Next Steps…Next Steps…

White paper work continues and initial White paper work continues and initial posting is targeted for October time posting is targeted for October time frameframe

Draft policy will follow the white paperDraft policy will follow the white paper Thanks to all my colleagues working on Thanks to all my colleagues working on

these projects.these projects.

Questions and discussion…Questions and discussion…