# Presentation: 060046

## Building Trust:Security and Confidentiality at Harvard Medical School and its Hospitals

- John D. Halamka MD
- CIO and CSO, CareGroup
- CIO, Harvard Medical School

## Agenda

- Overview of the environment
- Review of our security and termination policies
- Review of our technical security infrastructure and approach

## The context

- 12,000 Employees
- 100 Terabytes of healthcare data
- 200 Servers – all mission critical systems on Unix
- 15,000 Network ports
- 3000 Doctors exchanging PHI

## The staff

- CIO is Security Officer
- Privacy Officer and Business Conduct is a close partner
- 2 Dedicated security professionals
- 2 Staff support Privacy Office (patient relations, business conduct)

## The challenge

- Role-based access control to the level of the patient is an administrative nightmare
- It is very hard to predict which doctor needs access to which patients
- Automated audit methods are problematic

## Our approach

- Every doctor has access to every patient
- Monitored Notes for mental health/substance abuse data
- Every employee has access to their own audit trail
- Every patient has access to their own audit trail

## Termination policy

- Violation of the confidentiality policy results in sanctions, up to and including termination, regardless of role
- Enforcement is challenging for non-employed doctors and business associations

## Enforcement

- Unequivical use of termination across all employees for well-documented violations of policy
- Different processes depending on employee type
- Business Associate agreement to terminate clause

## Training

- Medical Students must be certified in HIPAA/Privacy policy before they can do rotations
- Researchers receive clinical trials/HIPAA compliance training
- Employed clinical docs receive compliance training

## Training

- Training reminders at key renewal and every 50th login
- Reaffirmation digital signature
- Patients also have training and consent for Patientsite

## Comprehensive Technology Policy

- Username/Password term and revocation
- Email policy
- Internet policy – surf control, auditing
- Network device policy – VPN, Anti-virus, patch management

## Security Classifications

- _Severe_– These applications contain highly sensitive, person identifiable data and possess one or more of these additional characteristics
- Internet-based access
- Contains roles that grant general access to clinical information
- A security breach would compromise the most sensitive patient or employee data  CareGroup maintains.
***Compromise of an account could lead to damaging publicity, identity theft, or business disruption.***

## Security Classifications

- _High_– These applications contain highly sensitive, person identifiable data, but access via the Internet is either not possible or limited to a select, few individuals.   As with “Severe” class applications, there roles that grant general access to clinical information.
- Compromise of an account would be damaging, but manageable with great effort   Damaging publicity and some risk of identity theft  would exist.

## Security Classifications

- _Moderate_– These applications may contain person-specific data, but it is not as highly sensitive as higher-level Classes.   Navigation is very limited within a single account.
- Compromise of an account would easily managed if discovered early.   No bad publicity would likely occur, nor would wide-scale identity theft.

## Security Classifications

- Low - ***These applications either contain no sensitive or access is limited to a very few individuals within the CareGroup firewall only.  ***

## Authentication

- Username/Password with enforced length, complexity and expiration
- Tokens
- Smart Cards/USB Cards
- Proximity Detectors
- Biometrics

## Access Control

- Role-based access to clinical applications
- Role-based access to databases
- Role-based access for patients

## Enterprise-wide authentication and access control

- Active directory and LDAP
- Migration of legacy applications
- Single sign on

## Auditing

- Clinical System audits
**What to gather**
**How to audit**
- Employee audits
**Web approach**
**Policies**

## Physical Security

- Secure Data Center
**card key access**
**video surveillance**
**halon fire suppression**
**robotic backup with offsite storage**
**environmental monitoring**
- Counterpane
- Hot backup servers and networks
- Cold backup data center

## Firewall Security

- ISS RealSecure, Snort, Demarc and other IDS tools
- As client access becomes increasingly browser based, objections to firewall port closings decreased to a minimum
- Over 99% 10.x private addressing
- Knowing your traffic patterns makes security easier to implement

## External Communications

- S/MIME Gateways
- Comprehensive Anti-Virus Program
- Strip .exe and .vbs at the border
- Eliminate dialup and PC Anywhere

## Lessons Learned

- How doctors and executives are disciplined for security breaches compared to mid and lower-level staff
- Build standard processes for each use case
- Be consistent and transparent

## Lessons Learned

- What healthcare has to learn from the ethical scandals of Enron, WorldCom and other high-profile organizations
- Invite the press, white hat hackers and audits to view the skeletons in your closet

## Lessons Learned

- What medical schools (such as Harvard) are doing to teach the doctors of tomorrow ethical privacy and security behavior
- Privacy and Security education is a mandatory prerequisite to patient care

## Lessons Learned

- What information security professionals need to do to gain high-level buy-in to security and privacy
- Make security and privacy prerequisites for employment
- Give everyone their audit trails

## Summary

- Security is an ongoing process
- Security involves everyone in the enterprise
- Security requires a plan, a budget and dedicated staff