# Presentation: 392829

## LBNL Protected Information Training:  Privacy, Electronic, and Physical Security

- Owner: _[CPPM@lbl.gov](mailto:CPPM@lbl.gov)__Created by the UCOP HIPAA Team__Modified for the LBNL Environment_

## Welcome

- Welcome to the online version of the Privacy and Security Training for Individuals Processing Protected Information at LBNL.
- Questions and Feedback may be submitted to _[cppm@lbl.gov](mailto:cppm@lbl.gov)_

## This presentation focuses on two types of confidential information:

**PHI**** ****= Protected Health Information**
- Medical record number, account number or SSN
- Patient demographic data, e.g., address, date of birth, date of death, sex, e-mail / web address +
- Dates of service, e.g., date of admission, discharge
- Medical records, reports, test results, appointment dates
**PII ****= Personally Identified Information**
- Individual’s name or other identifier + (SSN number or Driver’s License # or financial credit care account numbers)

## Definition of “ePHI”

**ePHI **or electronic Protected Health Information is patient health information which is **computer based**, e.g., created, received, stored or maintained, processed and/or transmitted in electronic media.
**Electronic media** includes computers, laptops, disks, memory stick, PDAs, servers, networks, dial-modems, E-Mail, web-sites, etc.
_**Federal Laws**_**:**  HIPAA Privacy & Security Laws mandate protection and safeguards for access, use and disclosure of PHI and/or ePHI with sanctions for violations.

## Definition of “PII”

**“****Personal information”** – **Unencrypted computerized information** that includes an individual’s name in combination with any one or more of the following:  Social Security Number, Driver’s license number, or California ID card #, credit / debit in combination with their access / security code or password
_**State Law:**_  SB-1386 California, Privacy of Personal Information to Prevent Identity Theft.  SB-1386 requires mandatory notice to the subject of an unauthorized, unencrypted electronic disclosure of “personal information”.

## PII,PHI, and ? = PI

- While the requirements for protecting PII and PHI may be different, the principals you will learn in this training are the same.
- We will use the term Protected Information (PI) to refer to these and other forms of information at LBNL which require additional information security measures.

## Principals for Privacy Protection:

- Do what we should be doing! Protect the privacy of the individuals who entrust us with their information, wherever and however we store it.
- Maximize the **security** of that information within reason.
- Minimize the chances of “slipping up”
- Automatic Safeguards
- Removal of Data
- Minimize exposure to this information by following “need to know” principals.

## Understand your individual responsibility

- Always maintain a separation between your covered and non-covered activities and know what additional state or federal laws apply to the privacy of an individual’s health or personal information
- Never disclose PHI or PII to other non-covered entities (UC or third parties) without Authorization or unless required or permitted by law
- Always apply the Minimum Necessary Standard to uses and disclosures of PHI
- Security is your responsibility.  If you need help, ask for it.

**Notes:**
SR
Your responsibility includes: 
1.  Keeping a physical separation between your covered/non-covered activities.
     For HRB, this separation is a firewall between our HR and Benefit functions.
Familiarity with the various laws that protect your health information
   - laws exist that require cos sharing PHI with non-US offices to disclose what is being shared
  -  laws exist that allow the legislature to inspect carrier contracts on health plans and RX drugs.
3. And the MNS, we discussed two years ago limits your risk, keep only what is necessary to do your job
4. And a new rule, the 90/10 rule – This rule pertains to all of the above – 90% of the responsibility for HIPAA lies with you

So Mike remind us about MNS....

## Minimum Necessary Standard  

- Use or disclose only the minimum Protected Information that you need to know to do your job
- A Covered Entity should have in place procedures that limit access according to job class (for PHI)
- Limit access, use or disclosure of PI by others to the minimum amount necessary to accomplish the intended purpose
- “Think Twice” Rule:
- Is it reasonable?
- Is it necessary?

**Notes:**
MIKE: A standard under HIPAA Privacy is the Minimum Necessary Standard. In addition UC must be careful to maintain the security and integrity of all personal data regardless of whether it is specifically required by HIPAA. SB 1, SB 1386, and other California law require us to apply these same safeguards to any data we have on employees, retirees, or students. Therefore, you should...SLIDE

This concludes our overview on Privacy. Let’s take a look at the new Security Standards under HIPAA. Stephanie--

## What are the Information Security Standards for Protection of ePHI?

**“****Information Security”** means to ensure the confidentiality, integrity, and availability of information through safeguards.
**“****Confidentiality”** – that information will not be disclosed to unauthorized individuals or processes
**“****Integrity”** – the condition of data or information that has not been altered or destroyed in an unauthorized manner. Data from one system is consistently and accurately transferred to other systems.
**“****Availability”** – the property that data or information is accessible and useable upon demand by an authorized person.

## What are the Federal Security Rule - General Requirements? 

- _Ensure_ the “**CIA**” (_confidentiality, integrity and availability)_ of all electronic protected health information (**ePHI**) that the **covered entity** _creates, receives, maintains, or transmits_.
- Protect against reasonably anticipated threats or hazards to the security or integrity of ePHI, e.g., hackers, virus, data back-ups
- Protect against unauthorized disclosures
- Train workforce members (“awareness of good computing practices”)

## It can happen...

## What are the Consequences for Security Violations?

- Risk to integrity of confidential information, e.g., data corruption, destruction, unavailability of patient information in an emergency
- Risk to security of personal information, e.g., identity theft
- Loss of valuable business information
- Loss of confidentiality, integrity & availability of data (and time) due to poor or untested disaster data recovery plan
- Embarrassment, bad publicity, media coverage, news reports
- Loss of patients’ trust, employee trust and public trust
- Costly reporting requirements for SB-1386 issues
- Internal disciplinary action(s), termination of employment
- Penalties, prosecution and potential for sanctions / lawsuits

## Follow the principles of Integrated Safeguards and Security Management
Define the Scope of Work. Missions are translated into work, potential requirements identified, expectations set, tasks identified and prioritized, related security assets identified, and resources allocated. 
Analyze the Risk. Risks associated with the work are analyzed to determine applicable requirements. 
Develop and Implement Security Measures. Measures and controls are tailored and implemented to mitigate risk. Residual risk is accepted by line management. 
Perform Work within Measures and Controls.Authorized security measures are in place and work is performed accordingly.
Provide Feedback and Continuous Improvement.Feedback information on the adequacy of measures and controls is gathered. Opportunities for improving the definition and planning of work are identified and implemented. Best practices and lessons learned are shared. Report anything unusual – Notify the appropriate contacts if you become aware of a suspected security incident. 
If it sets off a warning in your mind, it just may be a problem!

**Define the Scope of Work. **Missions are translated into work, potential requirements identified, expectations set, tasks identified and prioritized, related security assets identified, and resources allocated.
**Analyze the Risk. **Risks associated with the work are analyzed to determine applicable requirements.
**Develop and Implement Security Measures. **Measures and controls are tailored and implemented to mitigate risk. Residual risk is accepted by line management.
**Perform Work within Measures and Controls.**Authorized security measures are in place and work is performed accordingly.
**Provide Feedback and Continuous Improvement.**Feedback information on the adequacy of measures and controls is gathered. Opportunities for improving the definition and planning of work are identified and implemented. Best practices and lessons learned are shared. Report anything unusual – Notify the appropriate contacts if you become aware of a suspected security incident.
- If it sets off a warning in your mind, it just may be a problem!

**Security **

## LBNL Provides Appropriate Network Protection for an open research environment.  

Generally, PI needs to be contained within the Business Applications of the Laboratory, within the ISS Security Enclave. 

Making shadow databases or duplicating data from those databases on your personal computer is a serious security risk. 

- Generally, PI needs to be contained within the Business Applications of the Laboratory, within the ISS Security Enclave.
- Making shadow databases or duplicating data from those databases on your personal computer is a serious security risk.

**At LBNL, Security is a Personal and ****Line Management Responsibility**

## “Good Computing Practices”10 Safeguards for Users

**User ID** or Log-In Name (aka. User Access Controls)
**Passwords**
**Workstation Security**
**Portable Device Security**
**Data Management**, e.g., back-up, archive, restore.

**Remote Access**
**Recycling Electronic Media & Computers**
**E-Mail**
**Safe Internet Use**
**Reporting Security Incidents / Breach**

## Safeguard - #1:  Unique User Log-In / User Access Controls

- _Access Controls:_
- Users are assigned a unique “User ID” for log-in purposes
- Each individual user’s access to system(s) is appropriate and authorized
- Access is “role-based”, e.g., **access is limited to the** **minimum information needed to do your job**
- Unauthorized access to ePHI by former employees is prevented by terminating access
- User access to information systems is logged and audited for inappropriate access or use.

## Safeguard-#2:  Password Protection

**To safeguard YOUR computing accounts,**** YOU ****need**
**to take steps to protect your password. When choosing a**
**password, follow RPM guidelines including:**
- Don't use a word that can easily be found in a dictionary — English or otherwise.
- Use at least eight characters (letters, numbers, symbols)
- Don't share your password — protect it the same as you would the key to your residence.
- Don't let your Web browser remember your passwords. Public or shared computers allow others access to your password.
- If possible, use unique passwords for PI systems.  In other words, don’t make your bank password, your home email password, and your PI systems passwords the same!

## Safeguard-#3:  Workstation Security – 

**“****Workstations”** include any electronic computing device, for example, a laptop or desktop computer, or any other device that performs similar functions, and electronic media stored in its immediate environment.
**Physical Security measures include:**
- Disaster Controls
- Physical Access Controls
- Device & Media Controls *(also see Safeguard #4)*

## 3-1. Workstations:  Disaster Controls

**Disaster Controls:**  Protect workstations from natural and environmental hazards, such as heat, liquids, water leaks and flooding, disruption of power, conditions exceeding equipment limits.** **
- Use electrical surge protectors
- Install fasteners to protect equipment against earthquake damage
- Move servers away from overhead sprinklers

## 3-2.  Workstations:  Physical Access Controls

**Log-off** before leaving a workstation unattended.
- This will prevent other individuals from accessing EPHI under your User-ID and limit access by unauthorized users.
**Lock-up!** – Offices, windows, workstations, sensitive papers and PDAs, laptops, mobile devices / media.
- Lock your workstation (Cntrl+Alt+Del and Lock) – Windows XP, Windows 2000
- Encryption tools should be implemented when physical security cannot be provided
- Maintain key control
- Do not leave sensitive information on remote printers or copier.

## 3-3.  Workstations:  Device Controls

- Unauthorized physical access to an unattended device can result in harmful or fraudulent modification of data, fraudulent email use, or any number of other potentially dangerous situations. These tools are especially important in patient care areas to restrict access to authorized users only.
**Auto Log-Off:**  Where possible and appropriate, devices must be configured to “lock” or “auto log-off” and require a user to re-authenticate if left unattended for **15 minutes** or LESS.

## Safeguard-#4: Min Sec Req

**Min. Security Requirements**
- Use an Internet Firewall and IDS (SCS 2.02 – Lab Virus Standard)
- Use up-to-date Anti-virus software (Daily Updates, Daily Scans)
- Install computer software updates, e.g., Microsoft patches (Auto Updates or Lab Management of Updates)
- No unnecessary services or programs.
- No Cleartext Passwords, No Proxying
- Max. Limiting of Credentials
**Encrypt **_**and**_** password protect portable devices and non-portable devices if appropriate**
- Lock-it up!, e.g., Lock office or file cabinet, cable
- Automatic log-off from programs 15 Min or Less
- Back-up critical data and software programs securely

## 4-1:  Security for USB Memory Sticks & Storage Devices

**Memory Sticks are devices which pack **_**big**_** data in tiny packages, e.g., 256MB, 512MB, 1GB. **
_**Safeguards**_**:**
- Don’t store ePHI on memory sticks
- If you do store it, either de-identify it or use encryption software/hardware
- Delete the ePHI when no longer needed
- Protect the devices from loss and damage

- Delete and wipe temporary ePHI files from local drives & portable media too!

**Notes:**
This applies to all portable devices & local drives on computers!

## 4-2.  Security for PDAsPersonal Digital Assistants

**PDA or Personal Digital Assistants are personal organizer tools, e.g., calendar, address book, phone numbers, productivity tools, and can contain prescribing and patient tracking databases of information and data files with ePHI. PDAs are at risk for loss or theft.**
_**Safeguards**_**:**
- Don’t store ePHI on PDAs
- If you do store it, de-identify it!; or
- Encrypt it and password protect it
- Back up original files
- Delete ePHI files -- from PDAs, laptops and all portable media when no longer needed
- Protect it from loss or theft.

## 4-3.  Security for Wireless Devices

**Wireless devices open up more avenues for ePHI to be improperly accessed.  To minimize the risk, use the following precautions:**
- Do not enable the wireless port that exposes the device, unless it has been secured and you need to use it.
- Use a Virtual Private Network (VPN), if making any wireless connection – at LBNL and everywhere else.
- Adhere to user / device authentication before transmitting ePHI wirelessly
- Encrypt data during transmission, and maintain an audit trail.
- Refer questions to CPPM, or your CS Liaison

## Safeguard-#5:  Data Management & Security

**Topics in this section cover:**
- Data backup and storage
- Transferring and downloading data
- Data disposal

## 5-1a:  Data Backup & Storage

- System back-ups are created to assure integrity and reliability. You can get information about back-up procedures from the Information Administrator for your department.  If YOU store original data on local drives or laptops, **YOU are personally responsible** for the data backup and secure storage of data:
- Backup _**original**_ data files with ePHI and other essential data and software programs frequently based on data criticality, e.g., daily, weekly, monthly.
- Store back-up disks at a geographically separate _and_ secure location
- Prepare for disasters by testing the ability to restore data from back-up tapes / disks
- Consider encrypting back-up disks for further protection of confidential information

## 5-1b.  Data Storage - Portable Devices

**Permanent copies of ePHI should not be stored for archival purposes on portable equipment, such as laptop computers, PDAs and memory sticks.**
- If necessary, temporary copies could be used on portable computers, only when:
- The storage is limited to the duration of the necessary use; _**and**_
- If protective measures, such as encryption, are used to safeguard the confidentiality, integrity and availability of the data in the event of theft or loss.

## 5-2. Transferring & Downloading Data

- Users must ensure that appropriate security measures are implemented before any ePHI data or images are transferred to the destination system.
- Security measures on the destination system must be comparable to the security measures on the originating system or source.
- Encryption is an important tool for protection of ePHI in transit across unsecured networks and communication systems

## 5-3.  Data Disposal

**LBNL Facilities Disposal is not sufficient for ePHI disposal.**
**Destroy EPHI data which is no longer needed:**
- Follow DOE guidance for hard-drives, CDs, zip disks, or back-up tapes before recycling or re-using electronic media (3 pass overwrite or media destruction).
- Have an IT professional overwrite, degauss or destroy your digital media before discarding – via magnets or special software tools; and/or
- Know where to take these items for appropriate safe disposal (Problem: LBNL does not have institutional disposal mechanisms for CDs, so don’t use them!)

## Safeguard-#6:  Secure Remote Access

**Avoid working with ePHI from offsite locations whenever possible.**
**Minimum network security standards are:**
- Use of VPN
- Software security patch up-to-date
- Anti-virus software running and up-to-date on every device
- Turn-off unnecessary services & programs
- Physical security safeguards to prevent unauthorized access
- Host-based firewall software – running & configured
- Minimize unencrypted authentication
- No unauthenticated email relays to third parties
- No uncontrolled-access to proxy servers
- If you share your home computer, you are putting this data at risk.

## Safeguard-#7:  E-Mail Security

**Email is in no way, shape, or form a secure form of communication.**
**Use secure, encrypted E-Mail. Info available from **_[CPPM@lbl.gov](mailto:CPPM@lbl.gov)_** or your support person.**
**If secure E-Mail is **_**not**_** available**, and you need to send an attachment with ePHI:  password protect the file or encrypt it or _do not send via E-mail_!
**If you are sent ePHI by a client, remove the PHI from the response and the saved version of your email.  Delete the original email.**
**Do not forward E-Mails with ePHI **from secure addresses to non-secure accounts, e.g., HotMail, AOL.
- Remind Clients not to send you ePHI by email.

## Email for ePHI

- Use the Minimum Necessary Standard
- Do not send ePHI outside the department (scrub an email before replying to members and others)
- Destroy the original email containing PHI as soon as it is not needed

**Notes:**
SR
The new email policy is...
1. MNS -  whenever sending an email inside or outside, it just reduces your risk
2. And when you receive an email that contains unnecessary ePHI,,,
3. This is not a foolproof plan but one that minimizes your risk
Not all of you in the daily course of your work have incoming ePHI but some departments,
Ie. Policy, CS and Admin, do.  For those depts. That do, ISS will meet with you separately to walk thru your current practices and see how this policy will change how you do your work.

## Email for ePHI

**Response to a member sending an email with unnecessary medical information: **
**	**We have received your email requesting ____________.
-     We are working (have worked) on a resolution of your issue (and the status is______________).*For your protection, due to HIPAA and other privacy requirements, we may delete your initial email or the unnecessary personal medical information contained in your email, because we did  not require it to address your problem.  It is the policy of the University to use only the minimum necessary information to resolve our plan members’ issues.*

**Notes:**
SR
According to HIPAA, you are responsible for protecting the ePHI in an email the moment you receive it.
Because we get so many inbound emails filled with personal information, here is boilerplate language on how to address this.  Let’s do an example of scrubbing... an email

## Email Policy

**TO: **_[Customer.service@ucop.edu](mailto:Customer.service@ucop.edu)_
**From: **_[AnxiousAnnie@sbc.net](mailto:AnxiousAnnie@sbc.net)_
**Subject: I need an Operation**
**Dear Vice President Judy Boyette:**
**	****	****I retired from the University in 1998 after thirty-five years at UC Berkeley. I have always been with Health Net for my medical plan, and have had no problems with them until recently. They even took care of my treatment with Dr. Freud for severe anxiety disorder after my husband died in 1995. But now they have cancelled my coverage.**
**	****	****I have been seeing my doctor recently for back pain and back aches, which he has diagnosed as degenerative disc disease of the lower lumbar. He thinks I will need an operation in the next few months. The Percodan prescription he gave me for pain over the last few months is no longer working. I need surgery soon and can’t get it without my medical coverage.**
**Please help me.**
**Anxious Annie**

**Notes:**
SR
Anxious Anne included a lot of extraneous information, much more than you needed to resolve her medical coverage issue.  Instead of you trying to figure out what is ePHI, what is not ePHI, what’s your role in this email.....let’s get rid it and start over.  We recommend that you reply with the Subject line unless that is tainted also and remove the entire body of the original email and replace it with....

## Email Policy

- To: _[AnxiousAnnie@sbc.net](mailto:AnxiousAnnie@sbc.net)_
- From: _[Customer.service@ucop.edu](mailto:Customer.service@ucop.edu)_
- Subject: Your Health Net coverage
- Dear Annie:
-    		We have received your email requesting reinstatement of your Health Net medical coverage. We are working on a resolution of your issue. You should hear from us in the next few days.
***     ******	******	***For your  protection, due to HIPAA and other privacy requirements, we may delete your initial email or the unnecessary personal medical information contained in your email, because we did  not require it to address your problem.  It is the policy of the University to use only the minimum necessary information to resolve our plan members’ issues.
-      UC Employee

**Notes:**
SR
Scrubbing an email means to hit reply and remove the entire body of the email from the original To/From/Subject line on down.  Replace with non-ePHI content.

The bottom statement reflects the HIPAA notice that should be added to outbound emails.  This is about education..for the carriers and for the members.  Their expectations need to be managed knowing that UC will not be keeping full documentation on every issue.  
Technically we mention a health plan in the Subject line, this falls under the MNS and is low risk.

## New Email Policy

- If you must send PHI to someone, this is what you should do:
- Use the alternate delivery method of:
- phone,
- dedicated fax machine,
- dedicated carrier line, or
- hardcopy.

**Notes:**
SR 
In certain situations you must send PHI...HN wants to know what date of services you are checking and was it the 5mg valium RX or the 10mg RX?

An ex of hardcopy is any emails coming to Judy Boyette’s office are copied and walked over to HRB, the original email destroyed.

## New Email Policy

**This is also acceptable for sending PHI**
- Send an email with the PHI in an attached password protected file
- Call the recipients and give them the password over the phone, or send a separate email with the password.

**Notes:**
SR
There is also an alternate email solution for sending PHI:
Cut and paste the original email into a Word doc
Password protect that doc and send to an authorized recipient

Mike is this difficult to do???

## 7-2. Should You Open the E-mail Attachment?

**If it's suspicious, don't open it! **
- What is suspicious?
- Not work-related
- Attachments not expected
- Attachments with a suspicious file extension (*.exe, *.vbs, *.bin, *.com, or *.pif)
- Web link
- Unusual topic lines; “Your car?”;  “Oh!” ; “Nice Pic!”; “Family Update!”; “Very Funny!”

## 7-3.  E-Mail Security – Risk Areas

**Spamming.**  Unsolicited bulk e-mail, including commercial solicitations, advertisements, chain letters, pyramid schemes, and fraudulent offers.
- Do not reply to spam messages.  Do not spread spam.  Remember, sending chain letters is against UC policy.
- Do not forward chain letters.  It’s the same as spamming!
- Do not open or reply to suspicious e-mails.
**Phishing Scams.**  E-Mail pretending to be from trusted names, such as Citibank or Paypal or Amazon, but directing recipients to rogue sites. A reputable company will never ask you to send your password through e-mail.
**Spyware.**  Spyware is adware which can slow computer processing down; hijack web browsers; spy on key strokes and cripple computers

## 7-4.  Instant Messaging (IM) - Risks

**Instant messaging (IM) and Instant Relay Chat (IRC) or chat rooms create ways to communicate or chat in “real-time” over the Internet.**
**Exercise caution when using Instant Messaging on UC Computers:**
- Maintain up-to-date virus protection and firewalls, since IM may leave networks vulnerable to viruses, spam and open to attackers / hackers.
- Every additional function on your system creates risks.

**Notes:**
SPIM = Unsolicited spam for instant messaging 
Students Develop Encryption For Instant Messaging"... To enhance the privacy and security of instant messaging, fellow UC Berkeley graduate student Nikita Borisov and recent graduate Ian Goldberg developed software that allows users to encrypt messages and verify the identity of chat partners while leaving no evidence that the conversation ever occurred. Off-the-Record, a plug-in available for free download from the pair's Web site, improves on existing security measures by providing authentication.“ 2/23/2005

## Safeguard-#8:  Internet Use

- UC encourages the use of Internet services to advance the University's mission of education, research, patient care, and public service.
- UC's Electronic Communications Policy governs use of its computing resources, web-sites, and networks.
- Appropriate use of UC's electronic resources must be in accordance with the University principles of academic freedom and privacy.
- Protection of UC's electronic resources requires that everyone use responsible practices when accessing online resources.
- Be suspicious of accessing sites offering questionable content.  These often result in spam or the release of viruses.
**Be careful about providing personal, sensitive or confidential information to an Internet site or to web-based surveys that are not from trusted sources. **
**While incidental use is permitted, if you process PHI you have additional responsibilities!**

## Safeguard-#9:  Report Security Incidents

_**You**__** are responsible to**_**:  **
- Report and respond to security incidents and security breaches.
- Know what to do in the event of a security breach or incident related to ePHI and/or Personal Information.
- Report security incidents & breaches to _[cppm@lbl.gov](mailto:cppm@lbl.gov)_ and your privacy officer.

## 9-1.  Security Incidents and ePHI (HIPAA Security Rule)

**Security Incident defined:**
- "The attempted or successful or improper instance of unauthorized access to, or use of information, or mis-use of information, disclosure, modification, or destruction of information or interference with system operations in an information system.“ [45 CFR 164.304]

## 9-2.  Security Breach and Personal Information (SB-1386, Protection of Personal Information Law)

- “**Security breach**” per UC Information Security policy (IS-3) is when a California resident’s **unencrypted** personal information is reasonably believed to have been acquired by an unauthorized person. **PII means:**
- Name + SSN + Drivers License +
- Financial Account /Credit Card Information
- Good faith acquisition of personal information by a University employee or agent for University purposes does _not_ constitute a security breach, provided the personal information is not used or subject to further unauthorized disclosure.

## Safeguard-#10:  Your Responsibility to Adhere to UC-Information Security Policies

- Users of electronic information resources are responsible for familiarizing themselves with and complying with all University policies, procedures and standards relating to information security.
- Users are responsible for appropriate handling of electronic information resources (e.g., ePHI data)

## Security Self-Test Questions & Case Scenarios

## Case #1:  Shared Access Code

**Q:** **Your supervisor (a physician) is very busy and asks you to log into the clinical information system using her user-ID and password to retrieve some patient reports.   What should you do?**
- A. It’s your boss, so it’s okay to do this.
- B. Ignore the request and hope she forgets.
- C. Decline the request and refer to the UC information security policies.
_**Answer**_**:  C.**  User IDs and passwords must not be shared.  If accessing the information is part of your job duties, ask your supervisor to  request a user access code for you from the Information Systems data steward. If pressured further, call the Security Officer.

**Notes:**
Change to shared access sys

## Case #2:  Shared Workstations

**A co-worker is called away for a short errand and leaves the clinic PC logged onto the confidential information system.  You need to look up information using the same computer.  What should you do?         ***<Select all that apply>*
- A.  Log your co-worker off and re-log in under your own User-ID and password.
- B.  To save time, just continue working under your co-worker’s User-ID.
- C.  Wait for the co-worker to return before disconnecting him/her; or take a long break until the co-worker returns.
- D.  Find a different computer to use.
_**Answer**_**:  A or D.**  Never log in under someone else’s user name.  Remind the co-worker to log-off when leaving!

## Case #3:  E-Mail Attachment

_**Scenario**_**:  A workforce member with access to a patient database with ePHI wants to use the Internet to transmit the information to himself at an off-site server.  The off-site server was hacked into and the information was revealed.  How could this security risk and disclosure have been avoided?         ***<Select all that apply>*
- A.  Send the information in an encrypted file
- B.  Send the file over the internet unencrypted, so it will be easier to open.
- C.  De-identify the data before sending it.
- D.  Do not do send the file over the Internet
_**Answer**_**:  A, C and D** are all appropriate answers; however, option C (de-identify the data) is the ideal approach.  In addition, a VPN tunnel would also provide security.

## Case #5:  Special Screensavers

**Q:** **Your sister sends you an e-mail at work with a screen saver she says you would love. What should you do?**
*	**<Select all that apply>*
- A.  Download it onto your computer, since it’s from a trusted source.
- B.  Forward the message to other friends to share it.
- C.  Call IT and ask them to help install it for you.
- D.  Delete the message.
_**Answer**_**:  D.**  Never put unapproved programs or software on your work computer. Your work computer is for _work use only_.  Some screen savers may contain viruses.

## Question #6:  Blackberry Hacked

_**Scenario**_**:**  **The entire contents of celebrity’s mobile phone (Blackberry) have appeared on the Internet, including private emails, addresses and phone numbers from the phone address book.  The T-Mobile network appears to have been hacked.  A physician has similar information on her Blackberry including a photo of a patient (with patient consent) to download into an educational presentation.  How can this MD best protect this information?**
- A.  Download the photo of patient immediately after taking, and delete the image from the phone.
- B.  Don’t take photos of patients on this type of device.
- C.  It’s okay, the patient gave written consent.
- D.  Only keep information on your mobile phone that you have no problems being posted on a public site.
- E.  B & D only.
_**Answer**_**:  E.**  Patients must give consent for photography, but do not use camera phones for this purpose. Use only secure digital cameras, and secure the digital file as you would any other ePHI.

## Question #7:  PC Safeguards

**Which workstation security safeguards are YOU responsible for using and/or protecting?:  ***<There may be more than 1 correct answer**>*
- A.  User ID
- B.  Password
- C.  Log-off programs
- D.	Lock-up office or work area (doors, windows)
- E.  All of the above
_**Answer**_**:  E**, All of the above

## Question #8.  E-Mail Oops!

_**True Story from Florida (Feb 2005):**_**  An E-Mail attachment with an unencrypted list of HIV patients (names, MRN#s, SSN #s, diagnoses) was sent in error to 10 individuals outside the organization.  What actions should be taken?**  *<Select all answers that apply>*
- A.  The user notified Computer Services immediately.
- B.  Computer Services staff knew what to do and acted on the notice immediately. Add’l training provided to the user to prevent re-occurrence.
- C.  Computer Security Official notified the 10 recipients and requested that the file be deleted.  Incident & corrective actions were documented.
_**Answer**_**:  All of the above.**  The user made a mistake when attaching a file to an e-mail, but knew what to do and did it immediately.  Computer Services staff also acted immediately to reduce the risk of further re-disclosure.  In addition, if this breach had occurred in California, SB-1386 reporting to the subjects is required because name + SSN were disclosed without authorization to unauthorized individuals.

## Question #9:  Personal Information

**A data analyst has been working on an analysis of insurance coverage for HR’s Benefit Office.  At the end of the day, she saved the excel file on a CD, since her network drive was full.  The data included employee SSN#s, dates of service, diagnosis codes, etc.  She left the CD on her desk without encrypting the file.  The next morning the CD was missing.  What should she do?**  *<Select all answers that apply.>*
- A.  Report a potential security incident to the Security Officer.
- B.  Report it to the SB-1386 Coordinator, since SSNs were on the file.
- C.  In future, she should only store data on a CD if the file is encrypted.
- D.  Lock the CD or floppy disk in her desk and lock the office
- E.  A, C and D.
_**Answer**_**:  E.**  The incident should be reported as a security incident; however, SB-1386 reporting is not required since patient names were not on the file.  Data stored to non-network devices should be encrypted, and removal media physically secured.

## Complete.

- Thank you for taking the time to complete this training module.If you have additional questions, please contact _[itpolicy@lbl.gov](mailto:itpolicy@lbl.gov)__, or visit the LBNL Privacy website, __[http://www.lbl.gov/CIO/Privacy/](http://www.lbl.gov/CIO/Privacy/)_
- We must be good stewards of the information entrusted to us.  Your dedication to protecting this information is the core of that stewardship.