Turning on Full Device Encryption
Using full-disk encryption is an amazing way to protect your clients and your practice from privacy breaches. Used properly, it also qualifies your device for the safe harbor in HIPAA’s Breach Notification Rule. Use it everywhere!
Create a Separate User Account on Your PC
This one applies to laptop and desktop computers, and to Surface tablets. Other devices cannot make multiple user accounts.
If you have Windows 11 click this link to watch a video on how to add a local user.
How to Change Your PC's Password
Your device’s password is also the password for its encryption. So be sure to set a strong one! Strong passwords are also a HIPAA standard.
Turn on or Add Anti-Virus Software
Anti-virus is a minimum must for all devices. Use of software to prevent virus infections is also a HIPAA standard.
Activate Your Firewall
Firewalls watch your Internet connection to make sure nothing suspicious gets through. They’re very important to keeping your devices clean and safe for managing client information. They are also an important part of complying with the HIPAA standard around preventing virus infections.
Make sure the OS is Updated
It is important that device software be kept up-to-date, because companies issue important security updates frequently. It is also a HIPAA standard that the system software be kept updated.
Set Your PC to Logout/Lock When Idle
HIPAA requires that devices automatically log out after you’ve left them idle for some short period of time. This prevents people from walking up to or picking up a device that you’re logged into.
This is not applicable to your Windows computer as remote tracking works best with smartphones, however, because their cellular phone connections make them much better able to stay connected to the Internet as they move around. If you are working through security instructions for other device types, you may see a video or other instructions here.
Set a Screensaver Password on Your Mac
If your personal device is holding on to information about client care that isn’t also held on devices or services elsewhere, you need to keep it backed up. Maintaining backups of all PHI is a HIPAA standard.
A few examples of data that is often found on personal devices:
Text messages with clients
Emails with clients
Clinical notes about clients
Written reports
Superbills
If using an external hard drive, or another physical device, to back up your Windows 10 PC, you’ll want to use the built-in backup software, called Windows Backup. A video explaining how to use Windows Backup will be coming in the future. In the meantime, use this tutorial from the Windows website.
If your backup strategy for the device includes an external hard drive, your external hard drive must also be encrypted; this can be done using the native encryption software that was used to encrypt the device itself. See here for tutorial.
The Bring Your Own Device policy requires you to be thoughtful and careful about how you install software. You must not disable any settings that prevent the computer from warning you if you are about to run an app that was installed after downloading it from a webpage.
This is not applicable to Windows computers, lucky you! If you are working through security instructions for other device types, you may see a video or other instructions here.