1) Turn on Full-Device Encryption
1) Turn on Full-Device Encryption
Using full-disk encryption is an amazing way to protect your clients and your practice from privacy breaches. Used properly, it also qualifies your device for the safe harbor in HIPAA’s Breach Notification Rule. Use it everywhere!
Good News!: There is no process necessary for turning encryption on with Chromebooks. All you have to do is set a passcode and encryption will come on with it! Mark your BYOD form as a yes (not N/A) to document you’ve confirmed FDE is in place
So for activating encryption with your Chromebook, you need only set a strong passcode.
2-Account.mp42) Make a user account for doing IPA business that is separate from your personal user account
2) Make a user account for doing IPA business that is separate from your personal user account
This one applies to laptop and desktop computers, and to Surface tablets. Other devices cannot make multiple user accounts.
If you have Windows 11 click this link to watch a video on how to add a local user.
3-Password.mp43) Make sure your password is strong
3) Make sure your password is strong
Your device’s password is also the password for its encryption. So be sure to set a strong one! Strong passwords are also a HIPAA standard.
We advise that you use this rubric for defining a strong password.
A strong password is one or more of the following:
A password that is at least 8 characters in length and contains at least one capital letter, one lowercase letter, one number, and one punctuation character.
A passphrase that is at least 4 words in length, where the words have no logical relationship with each other.
A passphrase made up of a sentence, but with at least 5 words and at least one number and one punctuation character.
4) Turn on or add anti-virus software
4) Turn on or add anti-virus software
Chromebooks do not have antivirus that you can activate. The function of antivirus is primarily performed by the special way that Chromebooks manage apps. Mark your BYOD form as a yes (not N/A) to document you’ve confirmed antivirus is in place.
5) Activate your firewall
5) Activate your firewall
Firewalls watch your Internet connection to make sure nothing suspicious gets through. They’re very important to keeping your devices clean and safe for managing client information. They are also an important part of complying with the HIPAA standard around preventing virus infections.
Chromebooks do not have a firewall that you can activate. The function of a firewall is primarily performed by the special way that Chromebooks manage apps. Mark your BYOD form as a yes (not N/A) to document you’ve confirmed firewall is in place.
CB_update.mp46) Make sure the operating system is updated
6) Make sure the operating system is updated
It is important that device software be kept up-to-date, because companies issue important security updates frequently. It is also a HIPAA standard that the system software be kept updated.
CB_autologout.mp47) Set the device to logout or lock after a short period of idle time
7) Set the device to logout or lock after a short period of idle time
HIPAA requires that devices automatically log out after you’ve left them idle for some short period of time. This prevents people from walking up to or picking up a device that you’re logged into.
8) Turn on remote tracking
8) Turn on remote tracking
This is not applicable to your Chromebook as remote tracking works best with smartphones because their cellular phone connections make them much better able to stay connected to the Internet as they move around. If you are working through security instructions for other device types, you may see a video or other instructions here.
9) Make sure your device isn’t sending client information to the manufacturer everyday
9) Make sure your device isn’t sending client information to the manufacturer everyday
For Chromebooks, that is the natural way of functioning and is permissible.
10) If needed, make a strategy for keeping the device backed up
10) If needed, make a strategy for keeping the device backed up
For Chromebooks, it is default and natural to back up data to the Google account(s) connected to the device. So long as the Google account the device is backing up to is a practice GSuite account with a BAA in place, you’re good to go!
CB_unsafe_apps.mp411) Make sure the device doesn't have any disallowed software on it
11) Make sure the device doesn't have any disallowed software on it
The Bring Your Own Device policy requires you to be thoughtful and careful about how you install software. You must not disable any settings that prevent the computer from warning you if you are about to run an app that was installed after downloading it from a webpage.
CB_dev_mode.mp412) Make sure the device’s basic security is not compromised
12) Make sure the device’s basic security is not compromised
This is not applicable to Windows computers, lucky you! If you are working through security instructions for other device types, you may see a video or other instructions here.
Report abuse