Using full-disk encryption is an amazing way to protect your clients and your practice from privacy breaches. Used properly, it also qualifies your device for the safe harbor in HIPAA’s Breach Notification Rule. Use it everywhere!
Good News!: There is no process necessary for turning encryption on with Chromebooks. All you have to do is set a passcode and encryption will come on with it! Mark your BYOD form as a yes (not N/A) to document you’ve confirmed FDE is in place
So for activating encryption with your Chromebook, you need only set a strong passcode.
This one applies to laptop and desktop computers, and to Surface tablets. Other devices cannot make multiple user accounts.
If you have Windows 11 click this link to watch a video on how to add a local user.
Your device’s password is also the password for its encryption. So be sure to set a strong one! Strong passwords are also a HIPAA standard.
We advise that you use this rubric for defining a strong password.
A strong password is one or more of the following:
A password that is at least 8 characters in length and contains at least one capital letter, one lowercase letter, one number, and one punctuation character.
A passphrase that is at least 4 words in length, where the words have no logical relationship with each other.
A passphrase made up of a sentence, but with at least 5 words and at least one number and one punctuation character.
Chromebooks do not have antivirus that you can activate. The function of antivirus is primarily performed by the special way that Chromebooks manage apps. Mark your BYOD form as a yes (not N/A) to document you’ve confirmed antivirus is in place.
Firewalls watch your Internet connection to make sure nothing suspicious gets through. They’re very important to keeping your devices clean and safe for managing client information. They are also an important part of complying with the HIPAA standard around preventing virus infections.
Chromebooks do not have a firewall that you can activate. The function of a firewall is primarily performed by the special way that Chromebooks manage apps. Mark your BYOD form as a yes (not N/A) to document you’ve confirmed firewall is in place.
It is important that device software be kept up-to-date, because companies issue important security updates frequently. It is also a HIPAA standard that the system software be kept updated.
HIPAA requires that devices automatically log out after you’ve left them idle for some short period of time. This prevents people from walking up to or picking up a device that you’re logged into.
This is not applicable to your Chromebook as remote tracking works best with smartphones because their cellular phone connections make them much better able to stay connected to the Internet as they move around. If you are working through security instructions for other device types, you may see a video or other instructions here.
For Chromebooks, that is the natural way of functioning and is permissible.
For Chromebooks, it is default and natural to back up data to the Google account(s) connected to the device. So long as the Google account the device is backing up to is a practice GSuite account with a BAA in place, you’re good to go!
The Bring Your Own Device policy requires you to be thoughtful and careful about how you install software. You must not disable any settings that prevent the computer from warning you if you are about to run an app that was installed after downloading it from a webpage.
This is not applicable to Windows computers, lucky you! If you are working through security instructions for other device types, you may see a video or other instructions here.