Slashdot Mirror
Is Win2k + SP3 HIPAA Compliant?
Chris asks: "Our company deals with medical records in a peripheral sort of way (as they pertain to student loans), and due to new laws we are required to be HIPAA
compliant by April. After reading the discussion on here about the new EULA for Win2k SP3, I had a disturbing thought. As far as I can tell, if you use Windows 2000 then you're going to be out of compliance whatever you do. If you install the patch, then theoretically Microsoft could access those medical records (possibly by accident) without 'due cause or need' in the process of updating your machine. If you don't patch your system then you'll fail the security requirements of the law." If Win2k with SP3 is not HIPAA compliant (and I stress the if because no one has made a statement either way, yet) what can non-compliant Medical IT departments do?
Comment removed based on user account deletion
Additional thouughts:
Use a firewall to block all traffic into and out of your network, and make the machiens inside use proxy servers (for http) and relays (for smtp) to access the internet. In other words, disallow all traffic that is not explicitly permitted. Log what goes through the proxies and relays, and log attempts at initiation of direct outgoing traffic.
Napster-to-go says "Fill and refill your compatible MP3 player", which is a lie. It's not MP3. It's WMA with DRM.
Besides, would you really want to take legal advice from a group of people who are known to mistake duct tape and baling wire for building materials?
You can easily use Linux. If you deal with student loans, then it's possible you have an Engineering deptartment or CS department sitting around you somewhere. They probably already use some form of Unix, and could provide you with information on usabiliy and functionality.
Don't bet on Windows ever being anything that you might have to rely on. Regardless of how rhetoric is thrown around, Windows is everything bad that people say about it. If you'd already been using Linux, then you wouldn't be having this problem now, and if you switch now (whether or not Windows is HIPAA compliant) you won't have to worry about it in the future.
is the head title of this arcticle in The Reg.
basicaly it teaches how to deactivate this backdoor M$ is installing in every win2k box.
now, the original submiter could really consider an alternative.
if U don't like free (as in freedom) open source tools, why not a Solaris box with Oracle to keep the data ? Or an AIX with DB2 ? or PostgreSQL ?
does you REALLY need win2k ????
What ? Me, worry ?
Well I cannot speak for the author of the question but I can tell you that *I* was very intreaged when I saw this question. As an IT professional in a healthcare related field I am bombarded by questions re: HIPAA compliance. The HIPAA regs are in such disarry and so unclear that many people in the industry are anxiously waiting for the moment the regs are cleared up and complete so we can "sprint towards compliance".
Aren't we mister "Holier Than Thou" today. Ease up on the attitude...
Why stop the censorship? We need more, so more people will choose to quit Slashdot!
Microsoft Windows is not HIPAA-compliant and you legally may not be allowed to use any MS Windows as your O/S without facing severe legal ramifications if I'm understanding the HIPAA information site correctly. Although there can be many security-related concerns and issues surrounding MS Windows and MS products in general, I believe that it comes down to the EULA that MS has you basically agree to when you install MS Windows. Under the terms of the EULA, you agree that MS can access your system at any time. That totally violates the security and confidentiality requirements of the HIPAA legislation.
Anyone care to argue/agree?
pi=sigma{n:0-infinity}[(1/16)^n][(4/(8n+1))-(2/(8n +4))-(1/ (8n+5))-(1/(8n+6))]
Funny - HIPAA and 21CFR (part 11 I think) are the stated reason we didn't win a bid recently. I was told we 'don't understand the regulations'. I'd discussed the regs with this potential client and earlier we'd both come to the agreement that some of the regs are simply too unclear to be understood at this point. Then we lose. I'm glad others think they're also unclear. :)
I've got new for you. There's a more robust OS
out there. More secure. And you don't pay a per
seat license.
And you've got your choice! I prefer Linux myself!
Is it just me, or does the logo at the top left of the HIPAA web site look like the cover of an O'Reilly book?
--jdp Maintainer of VisEmacs
The problem is not the service pack or the auto-downloader, which can be disabled. The problem is with the EULA itself, where Microsoft reserves for itself the right to access your system at any time. Installing the service pack off-line still requires acceptance of the EULA.
sPh
First off, if you're storing the medical records on individual workstations instead of a centralized database, you're a moron.
Seond, if you let your servers auto-update and apply patches from *ANY* vendor without doing your own testing and verification of those patches before hand, you're an idiot.
And third, if you don't have proper egress filtering and logging in place to make sure this isn't happening and know who keeps hitting the damn Windows Update buttons when they're not supposed to...then you're a fool.
And a fool and his job are soon parted.
You run Microsoft Windows and you are worried about privacy.
Mwahahahaha!
You should have had a firewall running for the last 3 years, you should be using Netscape Navigator (or Mozilla now), and most importantly you should assume you have no privacy at all when running Windows.
STFW! *sigh*
Pixels keep you awake!
Put your cd rips in you medical records!! That way the RIAA can't hack them w/o breaking a law.
try { do() || do_not(); } catch (JediException err) { yoda(err); }
HIPAA is like any other oversight group and only it can decide this is "okay" or a "violation". However, since logic cannot be guaranteed to rule, you cannot guess which. Have your company, preferably through your legal consul, submit a binding request for clarification.
Be certain your lawyer understands he should ask for an exemption until this is clarified. (This will prevent them from sitting on it for two years and then you getting in trouble later.)
Later when HIPAA says it is okay to do "X" and you find MS (or anyone with such an EULA) has absorbed records, your company is in the clear. Do not presume you can later claim a technical solution that was "just as good as..."
This is an issue for your lawyer(s) to resolve, not Slashdot.
I don't see anyone else posting this... It's true. If you want to run an OS from a rape-you-in-the-ass company that has no respect for its customers, you better not do it with my goddamn medical data. MS products are not fit for important uses. Running personal web pages from MS products is probably OK, but for any actual business use you need a real OS.
I've had enough abrasive sigs. Kittens are cute and fuzzy.
http://www.euspirit.org/
Really. It'll clarify things right up. Dollars to donuts there's a clause in there, probably called "Severability" or something to that effect, which states that "if any clause in this EULA is found to be in violation of the law, then it is null and void with all the other clauses still in effect."
Contracts aren't allowed to violate the law. A contract to kill someone isn't legally binding, because murder is illegal. If Microsoft wants to claim they get remote access at will to your boxes, then you get to say "neener neener neener, no you don't, under HIPAA I'm forbidden from allowing you that access".
The proper Microsoft response? "Oh. Well, we're sorry about that. All the other clauses of the EULA stick, though."
So go ahead, get Windows SP3, and then figure out some way to disable remote-root.
Oh, and one more thing--
FOR THE LOVE OF GOD, TALK TO LEGAL COUNSEL. WHY THE FSCK ARE YOU ASKING LEGAL QUESTIONS ON `ASK SLASHDOT', ANYWAY?! DO WE LOOK LIKE HARVARD LAW GRADS?!
(Sorry, just had to get that knee-jerk reaction out of my system.)
Firewalls can block out going traffic and some are smart enough to block by specific hostname or use other types of filters. As a general rule of security freaks. The firewall should be restrictive and block all out going UDP ports and most TCP ports. Reguardless of windows 2K auto update, these things should be in place considering sensitive nature people's health records. Looks like the entire security system needs an audit, because these wouldn't be an issue in a well maintained secure network.
A vendor can say they are hipaa certified, but you have to certify HOW you are using the product.
Trust me on this, when it comes to the FDA you are guilty until you prove you are right. That is there usual operating procedure.....my opinion anyway.
"Nobody ever got sacked for buying IBM"
If you're just worrying about covering your behind, extent to "Nobody ever got sacked for buying Microsoft" and then to "Nobody ever got sacked for clicking through default Microsoft licenses."
I actually think that people should get sacked for doing this if they compromise their business for the sake of avoiding raising a thorny issue, but it's not going to happen in our lifetime.
If you were blocking sigs, you wouldn't have to read this.
As long as you're being anal-retentive, you should be aware that unencrypted instant-messaging protocols are frowned upon, because medical staff can circumvent all your hard work and simply send patient data back & forth over the IM.
Having said that, if either of these two represents your biggest problems, then you're probably safe for a while. I don't understand what you're trying to accomplish by asking Slashdot - maybe you should try checking with your MS rep first to at least get the company line. MS is wild about HIPAA - they produce a lot of BizTalk stuff for hospital EDI needs.
What's your damage, Heather?
How exactly would medical records relate in any way, shape, or form to student loans?
Where does the school board find them and why do they keep sending them to ME?
Furthermore, disable auto-updating and do it manually and the problem is solved, moot, and done.
This is not a technical issue, disabling Auto-Update is trivial. This is a legal issue, the real problem is by agreeing to the EULA they are giving a third party, who has no due cause, access to thier system. Whether or not Microsoft ever actually accesses thier system is not the point, the point is they have given consent and Microsoft could in theory demand access at anytime, say for example to check for unlicensed copies of software. I suggest you get a lawyer who can sort this out for you, it is also possible, however unlikely, a good lawyer could negotiate a different EULA with Microsoft.
"Our products just aren't engineered for security,"
-Brian Valentine,VP in charge of MS Windows Development
It looks like the ELUA problems might also cause issues with the data protection act in the UK.
I may allow company X to give other companies access to my personal data, without that permission company X would not be able to agree to Microsoft ELUA which could potentially give Microsoft access to you personal data.
thank God the internet isn't a human right.
Comment removed based on user account deletion
... if your own operating system is tunnelling through http to make requests from Microsoft's server to download patches without your knowledge?
(Unless, of course, you want to cut off MS's websites from your browsers as well.)
Note that disabling auto-updating is a technical solution that assumes that MS won't ignore that setting for any updates that it consideres to be "really critical", either to your security, or to MS's business needs.
Comment removed based on user account deletion
Well how else do you supose there going to be viewed/updated from a workstation they have to be stored there at some point, even if it's only a fraction of a second.
Medical records in the UK are de-centralised because of the inpraticalities of central storage (though this is being sorted out at the moment)
I'm a sysadmin for a hospital,
You will need to hire a GOOD consultant, and probrolly have a knowledgeable lawyer on hand.
I just fired the last consultant company, becouse
they said linux is not a hippa secure OS.
What hippa really means if its not patched then..well duh
As far as I can tell, If you disable the autoupdate (which you shouldn't have on anyway)
then you should be ok
You may also want to give microsoft a call.
Also you should have a firewall that can prevent this, If you don't then you need not worry what OS you have!
A firewall does not prevent the possibility of MS getting access by other means. If it is an agreed to part of the EULA, then they can take such steps as needed to effect the clauses. I would also be worried about the no cause software audits that some MS volume plans have. I mean obviously if you have a search warrant then you have to let them in, even if they might incidentally find some records, but by lowering the standard needed to perform an audit might have legal implications. I would ask your in house counsel, about both the EULA and the licensing agreements.
IANAL, and even if I was this would not be legal advice.
I'd do something interesting, but my server can't handle a slashdotting.
We're currently struggling with HIPPA where I work as well. I'm no expert, but a few things I'd look at:
- Your W2k workstations should not be exposed to the outside world. Firewall or NAT them (or both), and remove the WindowsUpdate icons from them and let your IT staff update them manually (or via pushed updates through your domain, if you have one).
- Ideally, the server with your HIPPA stuff on it should be hidden from view as well. Dedicate a server to nothing but HIPPA file serving if you have to. If it's absolutely necessary to access the information from remote locations (i.e., one's outside your lan/wan), consider serving that information up on a web page via an IIS/SQL type of solution of some kind, but with those services running on another server. I'm not sure if HIPPA guidelines provide for this sort of thing, though.
They're nice guys, I'm sure they would never abuse the privileges they grant themselves in the EULA. I just can't see them accessing anyone's medical records, can you? I mean, come on, now really.
Just check the "always trust content from Microsoft box." I'm sure the HIPAA does.
As soon as everyone understands that big corporations ONLY INVADE PRIVACY FOR THE PURPOSES OF SELLING YOU STUFF, all this tempest-in-a-teapot privacy hysteria will go away.
I write EMR software for a living. I'm a huge Linux fan and so is most of my development team. The reality is doctor's don't buy Linux systems. They buy Windows systems. So we offer a Linux DB server and Window's client. In the end, however, everyone still gets a Windows DB server...... In thousands of installs we have 2 using Linux servers. Just reality.
Comment removed based on user account deletion
Microsoft has the right to ignore all settings for auto-updating whenever they want.
Of course they can (and will) bundle the DRM-stuff with the next service packs anyway, so sooner or later they will get DRM into all Windows machines.
Comment removed based on user account deletion
The Microsoft Healthcare Users Group. This is a group of vendors that sit togehter on a board that define all standards for healthcare products that run on MS software. To be a member of this group or state that your software is compliant they certify you.
They strictly adhere to all governmental regulations for healthcare records including EDI and storing of sensitive medical records.
The medical industry is a huge economic buyer in the hardware and software industry and MS based vendors have always been in strict compliance with government standards.
1. Check to see if your software is HL7(health care 7) HL7 is a protocol for formatting, transmitting and receiving data in a healthcare environment.
2. Ask your vendor how they store the medical rcords, is it hl7 compliant. I think you guys have a homegrown product? IF your product is home grown it does'nt apply to the governmental standard for handling medical data, the EULA is the least of your worries.
3. IF the product is home grown. Cover your ass.
MSHUG is microsoft centric but a good start for you.
I did medical software for ten years and dealt with all these issues long ago. Your vendor should be able to point you in the right direction. BUT IF YOUR SOFTWARE CAME FROM A VAR, DONT ASK HIM, CALL THE ACTUAL HOME COMPANY! The developers will give you more of a straight answer than the var.
PUTO
The Revolution Will Not Be Televised
Questions like those can't be answered by /. readers -- you need a lawyer and some one who understand both the HIPAA and Windows domain to help you out.
/. will give you nothing but opinions on HIPAA and Windows and how /. views Windows and MS as evil.
...".
/. was news for nerds.
Asking such questions on
Slashdot is becoming "news for making news" (and it can easly be done by throwing MS in the mix) not "news for nerds
Gone the days when
Karma stuck at 50? Add 2-5 inches.. err.. 2-5x Karmas Count to your pen1es.. err.. Karma all naturally and private
It does not.
The root of the problem is the agreement that M$ CAN download software on your computer without prior notification. If you agree to that, it really makes no difference if you check a box that tells you machine not to do it. At any time, either pre-programed or by an addition that you make, M$ can uncheck that box without letting you know. Think about it, if you sign a document that states I have the privilage to do something (whatever it is) and then you (outside of that document) simply tell me not to do it, am I legally bound not to do it? It is possible that not even using SUS (software update server) will mitigate this.
Also don't feel secure about non-W2K products either. Most (and soon all, I suspect) products M$ releases contain that same provision. If you have updated MediaPlayer ( I believe it is one with the new verbiage) then you have already given consent for M$ to add software to your machine whenever they choose. NOT Maybe, NOT sometime soon, NOT only if you have W2K, but right now on the box you are currently using. And although I don't have it right infront of me now, I'm pretty sure that mediaplayer even specificly mentions that current features may be removed (playing MP3's) by the unannounced 'upgrades'.
Although we are still evaluating this with our legal staff, it looks very possible that we will be purging M$ products from the vast majority of our network.
oh, DARN ! ;)
And for the record, I am not a lawyer. Don't take this as legal advise. Heck, I could be dead wrong. Localities and Nationalities will obviously differ in their approaches.
___ I don't respond to Anonymous Cowards, and I Never Mod them UP.
Ah, but they are preventing users of pirated activation codes and Warez copies of XP from accessing the Windows Update site aren't they? Wouldn't that also preclude gaining access to the DRM "upgrade"?
All of a sudden that Windows XP .ISO and keygen I spotted on P2P seems a lot more appealing... ;)
UNIX? They're not even circumcised! Savages!
You mean having watched every episode of "Ally McBeal" doesn't make me a leading legal expert? Damn it!
I'm trying to teach myself to set people on fire with my mind... Is it hot in here?
One might argue that a EULA is more binding because someone agreed to it actively, instead of a law which one basically accepts passively. Oftentimes the laws may have been passed before you were even born, so there's not much realistically you can do, but you have every option of clicking 'accept' or 'do not accept' when the LA comes up.
Problem is, most companies don't accept the agreement themselves. A contractor installs stuff on their machines for them, clicks 'OK' 50 times, and leaves. Much like if we actually had to *pay* taxes, instead of most people having them withheld, if most people actually READ the LA with most software, there'd be a minor revolution.
creation science book
Cuz all the answers are by nerds with no nerdy jobs apparently. Ive seen several posts by people from Harvard on slashdot fuckyouverymuch.
Silly rabbit.
Microsoft is the rock around which the stream will flow.
On a proprietary system ?
...
Do you honestly believe that you can do this ?
I mean, sure there's some "disable remote r00t" clickety-click somewhere - as long as you cannot verify what the OS actually does about it, it means squat. Nobody promised you it would also disable the "remote w00t r00t", or the "hidden remote secret root", or the
There is one perfect solution: Keep proprietary OS machines off the network. Galvanic separation - no cable (and no antennas!) - works 100%
There is a less than perfect solution: Filter off all machines from vendor-X using products from vendor-Y. Make all machines from vendor-X resistant to attacks from the vendor-Y machines. Oh, and be damn sure that the two vendors are not affiliated, and are not controlled by the same government.
Sort of limits your options...
Unless you chose products where you can verify their operation. Note, this does not necessarily mean proof-reading the entire source, if the source is publicly available, the vendor is facing a mutual risk - *if* a backdoor is discovered he loses credibility and goes out of business, *because* there are alternative vendors available. Free Software is very clever in many ways that are not immediately obvious.
consider serving that information up on a web page via an IIS/SQL type of solution of some kind
:)
Cause we all know how secure *those* products are.
I'm not sure if HIPPA guidelines provide for this sort of thing, though.
That's the problem - I don't think *anybody* knows for certain at this stage. Things are too ambiguous (yes I've read most of the regulations)
creation science book
I can already imagine angry MS emergency support people waving EULAs and demanding access to your system to install the latest security patch....
Even As your company tries to implement HIPAA compliance your company will only strive to comply with HIPAA if and only if:
1. Its Easy and Inexpensive
2. Doesnt piss off your employees ( Trial and error)
3. There is An office politic that allows a newcommer ( IS security officer) to make the rules.
4. You can have a Guy named fred take all of the blame.
Most of which will not happen.
I agree with what you are saying, but I feel that these questions need to be asked. Well, they shouldn't need to be asked, because MS shouldn't be doing what they are doing, but I digress.
I work for a very large company and we are implementing HIPAA into our software now. We do all kinds of software for hospitals. The reason I think that this issue needs to be brought up is because most people don't even think about the holes that MS creates. I asked a very similar question to our director of operations a while ago, and he said basically that if the hospitals don't have firewalls, then they have bigger problems. While this may be true, I still think it is good to ask the question, so that people are aware of the "Microsoft issue". The people who maintain the firewall need to know about the autoupdate, so that they can block it at the firewall. They need to know about these vulnerabilitites, so they can plug them. I don't trust that they will be keeping up on these things. After all, who would have thought that the OS you run could create a huge gaping hole in your security and potentially hold you liable for violating federal regulations?
My beliefs do not require that you agree with them.
Use Macs or Linux?
I'm in the middle of upgrading a pharmacy's computers to privacy "compliant" software that is supposed to be secure. One of the perks of the new software is the ability to use the internet for data transfers instead of 56Ghey. While talking to the tech support guy on all the details I'd need to know, I asked him whether the transfer was done VPN and what sort of encryption I'd need to setup. He got back to me a few minutes later and said there is NO VPN, NO ENCRYPTION done at all. This pharmacy deals with hundreds of patients a day and for each one, a stream of data is sent CLEAR TEXT across the internet. Makes you feel secure doesn't it?
Last week I was told I am now on my department's HIPAA committee. Since I figured I should know what's going on, I hit Google and went here to read (and print) the actual act.
From what I understand, HIPAA only requires reasonable precautions. Depending on how anal your compliance officer is (if you have one), this may or may not be a problem. I work for a group that owns three hospitals, one of them a teaching hospital, and our compliace officer is a lawyer, so she knows her stuff. In a meeting to all staff we were told to use "reasonable precautions". You don't have to be paranoid, just use some common sense.
Good luck with it.
Hospital medical records should never be on a system that is
connected, directly or indirectly, to the internet. _No_ OS
is sufficiently secure for that to be acceptable. We just
had an openssl vulerability a few weeks ago, in case you're
forgetting. Yes, it was patched right away, but it makes
the point clear that no OS can be known with certitude to
be absolutely secure.
Sure, the hospital needs _some_ systems connected to the
internet, but they absolutely SHOULD NOT be connected to
the systems that have the private medical information.
Cut that out, or I will ship you to Norilsk in a box.
And will someone please get rid of those OSDN John Wayne Gacy clown ads?
We are placing secondary firewalls, between the servers the desktop. We have found that most servers have extra ports open, then even if you them off, some thing will get them turned on again. Like a Patch "fixing" a break.
By placing isulating the servers from the rest of the network, we are able to control the port issues both ways. So ODBC and Remote Job Submits can be sent. The app is all green screen based.
Having the second firewall also prevents the servers "getting out" on the internet, becuase we removed the defualt route from the firewalls, so they do not know where the gateway to the internet is.
Discaimer: The poster of this message is not implying that Microsoft is trustworthy. The poster of this message does not trust Microsoft. This was a joke. :)
If Win2k with SP3 is not HIPAA compliant (and I stress the if because no one has made a statement either way, yet) what can non-compliant Medical IT departments do?
Simple use Windows NT 4.0 with SP6a
and exactly why did you switch from it to begin with? what extremely important feature that Windows 2000 has that you absolutely needed?
upgrading because you can is never a good reason.. Most of Big Corperate america is just now starting to roll out W2K servers.. and they Keep NT4 servers running becasue there is no reason to upgrade them. (up until last month the very large multi-national corperation I work for had a policy that NO Windows 200 servers were allowed on the network, anyone upgrading their servers to W2K will be fired without question.)
Do not look at laser with remaining good eye.
It seems to me that unacceptable changes to the EULA for a service pack might void the implied warranty usability of Windows 2000. By releasing the service pack, they are admitting that Windows 2000 has problems. If I cannot get access to fixes for those problems without agreeing to a contract substantially different from that which governed my license for Windows 2000, I think that I might have a good basis for a lawsuit to get a court order that Microsoft supply fixes to their software under the terms of the original EULA.
I highly doubt most hospital/health care facilities have "upgraded" to Win98, much less Win2K. So much legacy software, it's pretty near impossible to upgrade these big organizations and still get work done. This won't be an issue for a couple of years yet...
As part of the lockdown procedure, you should disable automatic updates. Isn't this obvious? Perhaps "locked down" has a different meaning w.r.t FDA part 11 - I'm not familiar with this regualation. But If I want an unchanging system, the first thing I'll do is disable autoupdate.
Look, I'm all in favor of crucifying Microsoft when they are wrong, but it's pretty obvious that people are reading too much into this. They have to put the clause in their EULA, or else people will crucify them for updating their machines without their consent.
I think MS should have their lawyers rewrite this section of the EULA to make it more clear that the computer will go out and look for updates and install them automatically, unless the end user disables this function.
I cannot believe a reasonable, unbiased person would believe that MS would feel entitled to snoop around anyone's machine at their whim as a result of this clause in the EULA. The gov't might feel such an entitlement, but not MS.
I use to be a hospital sysadmin and in my old job, we had a network full of Windows systems with NT servers. But the actual medical software pumped out through to the dumb terminals or emu software was Unix based (DG/UX or HP/UX) or Novell. You also have to realize that the biggest medical vendors use Unix, SIEMENS, GE, McKessonHBOC.
One of the problems hospitals face is going back to Y2K. Some of the companies were so far behind that they moved to Windows NT to "fix things later". I remember my fellow tech moving the Dictaphone system from an old pre-system V system to NT. We were just cringing because we knew we were going to have problems.
m.kelley
life is like a freeway, if you don't look you could miss it.
If your company is of any size whatsoever, you'll need more than just a lawyer who specializes in HIPAA compliance issues. You'll need to acquire the services of a HIPAA compliance and remediation consulting group. Our hospital is using Ernst & Young.
It sounds like you have multiple areas to look at -- your data storage, your data transmission (you aren't just creating those medical records from thin air, are you?), your partner companies, and how you handle the Patient Identifying Health Information on the desktop. Not to mention that your company should have been preparing for this for QUITE some time now.
First, you'll need to make sure that your data storage, transmission and handling (includes handing paper copies around), and desktop security are all compliant. Next you'll find that you are also responsible for making sure that any business partner companies are compliant. This task basically means getting your partner companies to sign "HIPAA Business Partner Agreement" contracts that means the partner company states that they are contractually obligated to handle any patient data of yours in a means that is also HIPAA compliant.
Finally, and most important of all, you'll need to be able to document all of the above, in a form that the government inspectors can easily use to check your compliance. Yay.
Get yer HIPAA-lovin' lawyers on the stick as fast as you can, and file for any extensions that may apply. You will need a complete inventory of any and all computing infrastructure (servers, workstations, network, and software) that touches identifying patient medical data. You will need to have this inventory so your CIO, lawyers, computer security experts and your HIPAA remediation consultants can check the compliance of everything on the list. Anything failing compliance, you'll need to fix or replace.
One last thing: you are also responsible for making sure that the source of your medical data is asking permission to use that medical data, and is asking that permission in a way that is compliant.
I hope this provides you with a decent starting point. Good luck, you have a hard task ahead of you.
The EULA states that MS has the right to install patches. it doesn't say anything about being able (legally) to transmit your personal data back to the mothership.
:-)
Can you imagine the cry that would be raised if someone discovered that MS was transmitting personal info or documents in Windows Update Requests? Do you remember Prodigy? Do you remember the Quicken scare? Compared to the number of installations of Win2k, those are tiny issues in comparison.
You (meaning the rabidly pro-linux crowd) should all be so lucky as to have Microsoft to this, it would virtually guarantee that the company would be regulated into oblivion. or Canada. Which is almost the same thing
Install Linux.
---
IMHO, of course.
May the SOURCE be with you.
OK...Like many of you, I was skeptical that this was an issue at all. How realistic is it, in this MS-paranoid forum, that really you're granting MS access to your system "at any time?" The Ask Slashdot sounded like FUD-baiting. But then, someone made the intelligent point that whether or not MS has real access to private data, the fact that the EULA may cause you to AGREE to give them some sort of access may violate HIPPA.
:) (OK, granted, the Win2K EULA which is a superordinate parent of the SP3 EULA, may include such a clause...)
Well, fight FUD with facts I say, so I downloaded SP3 and here's the actual supplemental EULA. Note bulleted point #3...it does not begin with the same "If you choose..."" qualifier as point #2. I'll leave it the legal scholars and armchair lawyers to talmudically wrangle over what sort privacy violation is inherrent in allowing "OS product" version checking and update installation. I know nothing about HIPPA.
And as for "Severability" clause the parent post referes to...Not there. So, I've never been clear, do I get Dollars or Donuts for winning the bet?
Long-ass EULA follows:
SUPPLEMENTAL END USER LICENSE AGREEMENT FOR
MICROSOFT SOFTWARE
IMPORTANT: READ CAREFULLY - These Microsoft
Corporation ("Microsoft") operating system components,
including any "online" or electronic documentation
("OS Components") are subject to the terms and
conditions of the agreement under which you have
licensed the applicable Microsoft operating system
product described below (each an "End User License
Agreement" or "EULA") and the terms and conditions of
this Supplemental EULA.
BY INSTALLING, COPYING OR OTHERWISE USING THE
OS COMPONENTS, YOU AGREE TO BE BOUND BY THE
TERMS AND CONDITIONS OF THE APPLICABLE OS
PRODUCT EULA AND THIS SUPPLEMENTAL EULA. IF
YOU DO NOT AGREE TO THESE TERMS AND
CONDITIONS, DO NOT INSTALL, COPY OR USE THE
OS COMPONENTS.
NOTE: IF YOU DO NOT HAVE A VALID EULA FOR
MICROSOFT WINDOWS 2000 PROFESSIONAL, WINDOWS
2000 SERVER, WINDOWS 2000 ADVANCED SERVER, OR
WINDOWS 2000 DATACENTER SERVER (each an "OS
Product"), YOU ARE NOT AUTHORIZED TO INSTALL,
COPY OR OTHERWISE USE THE OS COMPONENTS AND
YOU HAVE NO RIGHTS UNDER THIS
SUPPLEMENTAL EULA.
Capitalized terms used in this Supplemental EULA and not
otherwise defined herein shall have the meanings assigned
to them in the applicable OS Product EULA.
General. The OS Components are provided to you by
Microsoft to update, supplement, or replace existing
functionality of the applicable OS Product. Microsoft
grants you a license to use the OS Components under the
same terms and conditions of the OS Product EULA for the
applicable OS Product (which are hereby incorporated by
reference except as otherwise set forth below) and the
terms and conditions set forth in this Supplemental EULA,
provided that you comply with all such terms and conditions.
To the extent that any terms in this Supplemental EULA
conflict with terms in the applicable OS Product EULA, the
terms of this Supplemental EULA control solely with respect
to the OS Components.
Additional Rights and Limitations.
* With respect to the OS Components only, if the licensor of the
applicable OS Product was an entity other than Microsoft,
then for the purposes of this Supplemental EULA Microsoft
will be the licensor with respect to such OS Components in
lieu of the "Manufacturer" or other entity and support, if
any, for such OS Components shall not be provided by
Manufacturer. With respect to the existing functionality
contained in the applicable OS Product which is not updated,
supplemented, or replaced by the OS Components, the EULA
for the OS Product shall remain in full force and effect as to
that OS Product.
* If you choose to utilize the update features within the OS
Product or OS Components, it is necessary to use certain
computer system, hardware, and software information to
implement the features. By using these features, you
explicitly authorize Microsoft or its designated agent to
access and utilize the necessary information for updating
purposes. Microsoft may use this information solely to
improve our products or to provide customized services or
technologies to you. Microsoft may disclose this
information to others, but not in a form that personally
identifies you.
* The OS Product or OS Components contain components that
enable and facilitate the use of certain Internet-based
services. You acknowledge and agree that Microsoft may
automatically check the version of the OS Product and/or its
components that you are utilizing and may provide upgrades
or fixes to the OS Product that will be automatically
downloaded to your computer.
* If you have multiple validly licensed copies of the applicable
OS Product(s), you may reproduce, install and use one copy
of the OS Components as part of such applicable OS Product
(s) on all of your computers running validly licensed copies
of the OS Product(s) provided that you use such additional
copies of the OS Components in accordance with the terms
and conditions above. Microsoft, its subsidiaries and/or
suppliers retain all right, title and interest in and to the
OS Components. All rights not expressly granted are
reserved by Microsoft, its subsidiaries and/or suppliers.
IF THE APPLICABLE OS PRODUCT WAS LICENSED TO
YOU BY MICROSOFT OR ANY OF ITS WHOLLY OWNED
SUBSIDIARIES, THE LIMITED WARRANTY (IF ANY)
INCLUDED IN THE APPLICABLE OS PRODUCT EULA
APPLIES TO THE OS COMPONENTS PROVIDED THE OS
COMPONENTS HAVE BEEN LICENSED BY YOU WITHIN
THE TERM OF THE LIMITED WARRANTY IN THE
APPLICABLE OS PRODUCT EULA. HOWEVER, THIS
SUPPLEMENTAL EULA DOES NOT EXTEND THE TIME
PERIOD FOR WHICH THE LIMITED WARRANTY
IS PROVIDED.
IF THE APPLICABLE OS PRODUCT WAS LICENSED TO
YOU BY AN ENTITY OTHER THAN MICROSOFT OR ANY
OF ITS WHOLLY OWNED SUBSIDIARIES, MICROSOFT
DISCLAIMS ALL WARRANTIES WITH RESPECT TO THE
OS COMPONENTS AS FOLLOWS:
DISCLAIMER OF WARRANTIES. TO THE MAXIMUM
EXTENT PERMITTED BY APPLICABLE LAW, MICROSOFT
AND ITS SUPPLIERS PROVIDE TO YOU THE OS
COMPONENTS, AND ANY (IF ANY) SUPPORT SERVICES
RELATED TO THE OS COMPONENTS ("SUPPORT
SERVICES") AS IS AND WITH ALL FAULTS; AND
MICROSOFT AND ITS SUPPLIERS HEREBY DISCLAIM
WITH RESPECT TO THE OS COMPONENTS AND
SUPPORT SERVICES ALL WARRANTIES AND
CONDITIONS, WHETHER EXPRESS, IMPLIED OR
STATUTORY, INCLUDING, BUT NOT LIMITED TO,
ANY (IF ANY) WARRANTIES OR CONDITIONS OF OR
RELATED TO: TITLE, NON-INFRINGEMENT,
MERCHANTABILITY, FITNESS FOR A PARTICULAR
PURPOSE, LACK OF VIRUSES, ACCURACY OR
COMPLETENESS OF RESPONSES, RESULTS, LACK OF
NEGLIGENCE OR LACK OF WORKMANLIKE EFFORT,
QUIET ENJOYMENT, QUIET POSSESSION, AND
CORRESPONDENCE TO DESCRIPTION. THE ENTIRE
RISK ARISING OUT OF USE OR PERFORMANCE OF
THE OS COMPONENTS AND ANY SUPPORT SERVICES
REMAINS WITH YOU.
EXCLUSION OF INCIDENTAL, CONSEQUENTIAL AND
CERTAIN OTHER DAMAGES. TO THE MAXIMUM EXTENT
PERMITTED BY APPLICABLE LAW, IN NO EVENT
SHALL MICROSOFT OR ITS SUPPLIERS BE LIABLE
FOR ANY SPECIAL, INCIDENTAL, INDIRECT, OR
CONSEQUENTIAL DAMAGES WHATSOEVER (INCLUDING,
BUT NOT LIMITED TO, DAMAGES FOR: LOSS OF
PROFITS, LOSS OF CONFIDENTIAL OR OTHER
INFORMATION, BUSINESS INTERRUPTION, PERSONAL
INJURY, LOSS OF PRIVACY, FAILURE TO MEET ANY
DUTY (INCLUDING OF GOOD FAITH OR OF
REASONABLE CARE), NEGLIGENCE, AND ANY OTHER
PECUNIARY OR OTHER LOSS WHATSOEVER) ARISING
OUT OF OR IN ANY WAY RELATED TO THE USE OF OR
INABILITY TO USE THE OS COMPONENTS OR THE
SUPPORT SERVICES, OR THE PROVISION OF OR
FAILURE TO PROVIDE SUPPORT SERVICES, OR
OTHERWISE UNDER OR IN CONNECTION WITH ANY
PROVISION OF THIS SUPPLEMENTAL EULA, EVEN IF
MICROSOFT OR ANY SUPPLIER HAS BEEN ADVISED OF
THE POSSIBILITY OF SUCH DAMAGES.
LIMITATION OF LIABILITY AND REMEDIES.
NOTWITHSTANDING ANY DAMAGES THAT YOU MIGHT
INCUR FOR ANY REASON WHATSOEVER (INCLUDING,
WITHOUT LIMITATION, ALL DAMAGES REFERENCED
ABOVE AND ALL DIRECT OR GENERAL DAMAGES), THE
ENTIRE LIABILITY OF MICROSOFT AND ANY OF ITS
SUPPLIERS UNDER ANY PROVISION OF THIS
SUPPLEMENTAL EULA AND YOUR EXCLUSIVE REMEDY
FOR ALL OF THE FOREGOING SHALL BE LIMITED TO
THE GREATER OF THE AMOUNT ACTUALLY PAID BY
YOU FOR THE OS COMPONENTS OR U.S.$5.00. THE
FOREGOING LIMITATIONS, EXCLUSIONS AND
DISCLAIMERS SHALL APPLY TO THE MAXIMUM EXTENT
PERMITTED BY APPLICABLE LAW, EVEN IF ANY
REMEDY FAILS ITS ESSENTIAL PURPOSE.
Comment removed based on user account deletion
" . . . Microsoft could access those medical records (possibly by accident) without 'due cause or need' in the process of updating your machine."
Mod this offtopic or flamebait, but if nobody but MS has access to the source code, are you not already completely trusting MS not to access those medical records without due cause? I mean, even if you do prevent "automatic updating," there is no way you could prove these records aren't being sent out everytime your machine connects to the 'net, in theory. I know this doesn't help YOUR problem, but I can't help but think this policy is a bunch of BS created to make people ignorant of the situation FEEL better.
Sdelat' Ameriku velikoy Snova!
Could you block the windows updates and still let other http through though? I'm not a networking expert but if it uses port 80 then there is no way to stop it right?
Are we accelerating down the slippery slope? Files have to be open for copyright infringement monitoring and national security; files have to be closed because of privacy. One seeming solution is to have everyones' os and hardware enforce "good copyright citizenship", which I suspect is a technological and sociological impossibility. Or some entities could receive a government conferred license to look at everything, which means that some people's copyrights are more precious than others. Welcome to the weirdfest.
Do you know those little USB drivers which look like a pen? Well, they are better than floppies, and you can use them in your "legacy free, super secure" Compaqs, I think.....
HIPAA privacy standards (to this point, being that they most likely finalized until Oct. 2002) say that not only must you keep things from the outside, but also from other employees that are not supposed to see them. Now, knowing that, just sticking yourself behind a firewall is going to keep information in (in theory). That does not however, stop an employee from walking away with information. And until we can figure out what capabilities MS has to access things, we can't rule out that someone else won't figure out that method and exploit it.
Acording to the register article, the clause is: "You acknowledge and agree that Microsoft may automatically check the version of the OS Product and/or its components that you are utilizing and may provide upgrades or fixes to the OS Product that will be automatically downloaded to your computer" I'm really unclear what this has to do with accessing private data that has nothing to do with the OS. I think you have let the /. hype about "ms gets to own your computer anytime it wants" get to you.
It's rather amazing, but from my experience, especially in the healthcare field there are an amazing number of custom, legacy, older-than-hills-but-works-well software to support or handle. I should know, my company's product is one of them.
Mind you, after being in the industry this long, I can see WHY companies take so long to port to anything new, the regulations and codes are staggering.
Linux will take a long time, if ever, before it becomes a major player in healthcare. There's just too much stuff to move.
Blog,Twitter
WTF is the HIPAA? That nasty little ecronym isn't spelled out in the /. article, and the organization with that name doesn't even have an "about" section, or a masthead that would explain it.
Is the HIPAA the government agenty in charge of the black helicopters or something? Otherwise, why the secretiveness about what the organization's real name is?
Try for example OpenVMS (from HP), which gives superb security, clustering, runs on fast iron (Alpha now; IA64 soon) and does not have spyware built in by the vendor. Alternatively, OS/400 might do you. Intel uses VMS in fabricating its parts btw.
.net security model were implemented in third party products for VMS by 1995 and are still available (with source code for most of them, yet!). VMS has had the ability to mix languages in any application program since its beginnings...by having a calling standard that compilers adhere to so that every language can call every other and runtimes have been designed to work together.
The other alternative would be perhaps something like OS/400.
On Intel x86 iron, you might try NSA secure Linux, though there have been stories recently about NSA stopping development of this.
I should add that the tricks Microsoft speaks of in its
go ahead, get Windows SP3, and then figure out some way to disable remote-root.
No lawyer is going to recommend this because there's no guarantee that a technical fix will work or will not compromise some other clause or agreement.
A new contract needs to be drawn up in place of the EULA. I would recommend this for all IT licensing, not just for MS products - shrinkwrap EULAs are of dubious legality at best, especially in Europe.
defualt route from the firewalls, so they do not know where the gateway to the internet is.
Removing the default route does not effectively prevent traffic from the servers getting out to the internet, nor does it effectively prevent traffic from the internet getting to the servers. A properly configured firewall can do that, but just removing default routes is not sufficient.
I trawled through the entire Win2K Pro Eula here in the Netherlands when I got it from a shop, then read through all the additions that came with updates (SP2, SP3 and other smaller patches). Nowhere in the whole EULA or its additions could I find any statement that allows MS any access to my system whatsoever. Is there a difference in EULA's here, or am I just cross eyed??
Learn from the mistakes of others. There isn't enough time to make them all yourself.
I'm not an American citizen and I don't know anything about HIPAA but...
As I understand it from this discussion, HIPAA specifies the hospital's obligations, not Microsoft's or in fact any other software vendor's.
If you install SP3 and Microsoft remotely accesses your PCs, Microsoft probably wouldn't be in violation of HIPAA (because it isn't bound by it). *You*, however would be in violation because you've potentially allowed a third-party access to confidential data.
So it seems to me that your only option is not to install the service pack (or get some kind of exemption from either the HIPAA authority or Microsoft).
But IANAL...
Opinions are like assholes, everyones got one and they all stink...
I'd say that you have a lot to learn about Slashdot. While most of the stories on here are technical in nature or have something to do with technology a large percentage of them have to do with the legal and political issues surrounding something technical.
Think about all the stories on copy protection for CD's. Yes, it has to do with a technical issue, but the discussions are certainly not technical. I've seen no code posted no how to defeat the copy protection. 99% of the posts are opinions about whether it is right for the producers to restrict use of purchased CD's in the way they want to, and the other 1% are First Post!
Why don't you just come out and say it? You are a Microsoft appologist that wants to ignore the issue with their EULA by making fun of the issue and calling it a waste of time. You say it's an invalid clause, but you don't indicate that you are a lawyer (and even if you were I doubt you'd be offering official legal advise). So you want us to just ignore the issue and "agree" to the EULA?
What happens if the EULA is allowed to stand and then Microsoft actually builds in more of this access that you granted them? What happens when it eventually gets installed on all Windows systems and then the crackers find out how to manipulate it and steal information off your computer? Then it wouldn't be Microsoft accessing the sensitive information, as I doubt they actually would do something like that, but because of the EULA they provide additional access methods for others.
There are plenty of valid discussion items surrounding this issue. Ignoring them is not going to make them go away, and they definately fall right smack into the favorite topic on Slashdot -- Microsoft bashing.
Every time I ask Google about this it seems like I end up bouncing back and forth between the same three or four sites never quite finding what I'm after -- kinda like pr0n, but not as fun. So here goes...
Does anyone know of any free/nonfree resources, documents or URLs that list the networking, server and policy encryption and configuration standards required for HIPAA compliance? Consider this from the point of view of a network administrator for a small health services company that buys all of its software from outside vendors (no internal development).
Please don't answer http://hhs.gov. I know about those, and I'm hoping to find a summary or sorts, not the original regs. I'm also aware that the rules themselves are vague and unspecific, and may or may not specifically mention networking and servers hardware software and practices, so I'd appreciate that someone confirm that if it is the case.
"Lawyers are for sucks."
- Doug McKenzie
Breaking confidentiality via the actions of authorized staff is a different risk. The question is about the act of assigning external parties privileges that itself breaks confidentiality agreements.
The only HIPAA can currently enforce its new guidelines is through non payment of medicare. For most doctors that accounts for 60% of their business. THAT is why they will comply. Granted companies on the skirts of the medical field that may handle medical data will have to be compliant there will be no way to enforce it with them.
Dissent from within the Slashdot ranks will NOT be tolerated! No post for you!
Here's the behemoth's tactic: Create crappy and buggy software and sell it. Distribute a service pack that makes their anti-piracy technology more strigent. This causes consumers to be stuck between a rock and a hard spot; if they don't upgrade their software becomes out-of-date and prone to crashes and hacks, or if they do upgrade, they give in to Microsoft's monopoly and have to go along with whatever MS cooks up. tomkit, long live puja mahtani and mankit li
You boys have a nice time.
what the fucking hell is this doing as the most moded up comment on HIPA compliance..
fucking mod it down as offtopic assnuts
just because you agree with the post is no reason to mod it up...
fucking idoits
hi, you work in the real world?
good, didn't think so
Not to mention this is a legal/social problem, not a technical one..
It's far cheaper to simply change the law and declare victory than it is to pretend you can sue Microsoft. Seriously, start lobbying your local Congresspersons explaining to them that your company might have to close and fire voters unless they intervene. That way they can simply pressure the agency to write an exclusion for W2K specifically. The law was created in the first place to pacify people who didn't want their records divulged. It has nothing to do at all with the industry itself or what is good for health care providers. So if you simply ignore the screams of the populace and change the law you're in a better place,
I'm sure some of you narrow minded twits will think this is backhanded MS bashing but it's not. It's simply reality. When was the last time YOU sued a multibillion dollar company?
Many quite large and busy sites are running on PostgreSQL or even MySQL (true SQL afficiondos are permitted a short vomit break at this point). As they've freely admitted, even Microsoft hasn't figured out how to undercut `free'. Yet.
But forget the server, Win2kSP3 on a workstation means that Microsoft have the right to installer a sniffer (diagnostic software) on the workstation and directly or indirectly pilfer all of your HIPPA data. You gave them that right when you agreed to the EULA. What's the real cost of that?
Meanwhile, IRL, W2k is likely to sooner or later also give every t0m, d1c| and |-|4rry the same ability, albeit not the right to legally employ that ability, as if they cared.
Got time? Spend some of it coding or testing
How? asuming:
- You need asp to work
- You need microsoft to deal with the patches
When the infamous dotdot bug popped up (think hotmail.com/../../winnt/repair/sam this is long after after the same bug was in the cifs/samba "server" code of win95) microsoft issued a patch, a couple of months later they issued a patch for the same bug with hexencoded dots (and then you guessed it nimbda does hex encoded hexencoded dots....I dont suppose...nah) I think somewhere beteen these patches a couple of hundred people thought up or knew about the next problem, however there was no patch!Now this example is about problems in the request handeling code of iis, if you know about a problem you can "solve" this with the same "solution" that microsoft has, a piece of code listening on port 80, checking the request (chopping up parameters to avoid overflows,keeping dots out and interpreting the hex codes, then procesing then hexencode it again.... and the relay the conection to iis, cut and pasting this code in the iis code has not yet been done iirc
People who know what they are doing cant keep iis as secure as apache, simply becouse microsft handeles bugs worse (far worse in my personal opinion, even if you think its just bad but managable, apache people patch faster and don`t "shoot the messanger"), no mather how good you (think you) are!
To be fair and conclude microsoft tries to clean up its trackrecord and get the prefered manufaturer for your trustworthy computing products, but it hasn`t handeled the ssl cert problem in a way that I would like
isn't the place to come for LEGAL Advice.
How many times will Slashdot post questions that should CLEARLY be going to the poster's lawyers? Slashdot is in no way able, to answer these questions, the people asking them should be talking to their own legal department, and whatever agencies they have to regarding the issue at hand, NOT SLASHDOT!
Yeah, um, so I checked out your site, and found this claim:
Slashdot-free since Leap Day 2000
Do you know what day it is?
Enjoy
I'd say your question could be moot... after all the hipaadvisory site is "already compromised".
Comment removed based on user account deletion
Comment removed based on user account deletion
If you want privacy and security....
.NET products. Many will feel that this statement is glib and unrealistic. Maybe.. But until companies who feel that they can get away with this kind of nonsense, begin to hurt from such actions, we will continually lose our privacy and security little by little. In my environment, we have stuck with NT 4.0, will not upgrade to 2000 or XP and are slowly replacing all of our Microsoft products with alternatives (IBM, Sun and Linux). Some of the alternatives don't have all of the features that M$ have, but you need to ask yourself if you really need that newfangled feature in Office XP that is used by 1 person in 100, once every year and how much it's really costing you. Realisticaly, Linux is not yet a perfect replacement, and has a long way to go (Linux bigots will say otherwise, but we have been running it in production environment for about 6 months). Sun's and IBM's pricing has come in line with the much of Intel camp, are much more robust than any Windows line, and don't have the nonsense that M$ is dishing out. We have converted our main applications into Web-based systems using web services and java. We have banned the use of M$ Visual Studio and M$ developer products, and are using instead Visual Age from IBM with a CVS add-in (for version control and change management). All of our web sites have been converted to Apache with Web Sphere, with an IBM DB2 database backend. This solution is orders of magnitude superior to anything from Microsoft. My feeling is that you can get away with HIPAA regulations and M$ products for the time being. But, it will catch up to you. Our conversion process has been a bumpy one, but we are succeeding in eliminating Microsoft from our environment. We estimate that in another 6-8 months we will have purged Microsoft completely.
Remove all Microsoft products from your environment, and don't use any of their
Comment removed based on user account deletion
Comment removed based on user account deletion
and it's so difficult to create a new user account that can post any number of times per day.
quit whining, please.
I work with the healthcare industry on a limited basis...as in a couple clients are dr's offices and the like.
:)
I have to agree with most of the others here:
get a good lawyer, and poor over the EULA. Talk with HIPAA, see what they have to say. This is a legal issue, and cannot be totally resolved by technical means. Sure, you can disable auto-updating, but those of us who actually installed SP3 will note that it in fact re-enables it (SILENTLY!!).
This goes beyond the regs according to HIPAA, we all have a right to privacy. Microsoft needs to take note of that. They do have a right to verify that you have a legit license for their software, they don't have the right to cruise through your hard drive.
Perhaps this little conflict will be the silver bullet to bring Microsoft's extremely bold EULAs back into line with reality as we know it.
The catch 22, of course, is that you're damned if you do, damned if you don't since you have to stay up to date with those security updates to keep HIPAA happy.
Even though we're all not lawyers here, I think we've gotten this person pointed in the right direction, eh?
So, you thought desktop/application firewalls were safe? Think again.
Although MS engineers are not really well-known for implementing clever and working solution, I fear that they might have come up with a similar or even advanced technique of establishing a "stealth" connection.
A corporate firewall/packet filter with some sort of IDS enabled and all MS IPs blocked _might_ work if used in conjunction with an application firewall on each individual machine. On the other hand it might trade in too much flexibility for security. If the individual machine depends on http availability your pretty much lost. You can piggyback/tunnel basically anything through that. Disabling IE and using Netscape might put a hold to that.
But there ain't no verification of that unless someone can produce the w2k sources... And if someone does MS will have a patch ready and automatically deployed in RECORD time...
+++ath0
Comment removed based on user account deletion
You've got three years to deal with the issue until they start fining you (if your company has under $5 million in annual revenue).
If over $5 million, you've still got two years to comply.
Either way, the max fine for non-compliance is $25K/Year, and they don't even know how they're going to find you...
I'm not saying you should slack on this, I'm just saying it's not a "huge,huge" crisis situation. Deal with basic, common sense security and do more research. You've got time to do this right.
Treatment, not tyranny. End the drug war and free our American POWs.
See my user info for links.
Crap, this has been in effect for awhile. I wish they would use dates, not just simple lengths of time.
Deadlines:
The Transactions Rule was published on August 17, 2000. So the compliance date for that rule is October 16, 2002.
The Privacy Rule was published on December 28, 2000, but due to minor glitch didn't become effective until April 14, 2001. Compliance is required for the Privacy Rule on April 14, 2003.
[These are the 24 month deadlines].
Treatment, not tyranny. End the drug war and free our American POWs.
See my user info for links.
I've read the entire discussion relating to the "HIPAA-Compliant"-ness of Win2kPRO+SP3/Autoupdate blah blah.
People, the privacy rule (which I'm assuming this is the rule that the poster is refering to as he gave a compliance date of 04/2003) does not tread into the technical, murky waters that this discussion is headed.
You're thinking of the proposed security rule which hasn't been finalized! Until the final rule is published in the Federal Register and a comment period of 60 days expires - you won't have to be compliant for ONE YEAR.
Since the security rule isn't finalized, you can only ASSUME that the proposed rule is the final rule and make your decisions from there.
Regarding the big discussion on Microsoft, you really need to read the wording of the proposed security rule. There are technical safeguard requirements that prohibit automatic updates to systems that access protected health information which HAVE NOT GONE THROUGH THE CHANGE CONTROL PROCESS dictated by your company network security policy. In other words, forget auto-update. Allowing Microsoft to remotely auto-install updates, software, etc also violates this rule.
Of course, this is strictly my interpretation as the Information Security Officer for $large_insurance_company, so I could be full of shit.
Okay, bucko, that's SIX times now you've posted that same excerpt from the EULA. Can we get some (-1, Redundant) modification in here?
Oh, and to answer your question: "you explicitly authorize Microsoft or its designated agent to access and utilize the necessary information for updating purposes."
Note that that says NOTHING about how they will access the information. By the letter of the EULA, they'd be within their rights (which you authorized) to just have a couple of goons march into your computer room and haul the machine back to Redmond for them to update there.
Improbable? Sure. But you explicitly authorized "access", period, not "access over a network connection using a specified protocol on a specified port".
Remember, this is Microsoft legalese we're talking about -- their view of contracts (of wich the EULA is one) is that anything not expressly forbidden to them is allowed.
-- Alastair
Reasonable Assurances... The writer who states that the covered entity need only take reasonable precautions. What is or is not reasonable depends on too many factors. I happen to think that if you disable the feature, that action seems pretty reasonable. I for one, am not worried about the EULA. I'm more worried about things like password protection, access to the file room and the like.
Illegal Contracts... As someone else correctly states, contracts that are contrary to law cannot be enforced (at least the illegal provision).
Covered entites... Chris, who wrote the original message may not need to worry about HIPAA. HIPAA covers mostly medical providers and insurance companies. It also covers self-insured companies and the like, but I don't think it covers loan applications. Of course, Chris could be a business associate of a covered entity.
Business associates... A covered entity must obtain satisfactory assurances from its business associates (accountants, lawyers, billing companies) that the health information is protected. As someone correctly notes, that requires an agreement known as a business associate agreement/contract.
As a side note, I've begun to draft an article about what HIPAA requires... the language in the law actually asks the covered entity to make sure that they have "satisfctory assurances" that the business associate safeguard personal health information ("PHI" although some call it "individually identifiable health information")
In Luxembourg the Banking secrecy legislation is very tight. It is, for instance, illegal to divulge any information regarding the client in the following situations:
;-). If they, however, choose to give out the specified information they will be (the actual clerk and possibly his/her manager) liable for a 5 year jail sentance.
...
/m
- Divulging information to other legal entities in the same concern (ie communication between the insurance arm and the banking arm of a financial institution).
- to give out information to anyone even though the client has approved or ordered that the bank gives out information regarding the client relationship.
An example: in most countries its perfectly legal to have an offshore account. In some countries its ruled ok only if that citicen (the client) agrees to instruct the bank to share all information with the taxation authorities in the clients home jurisdiction. If you send a letter to a bank in luxembourg with such an instruction - they will straight away file the instruction in the round cabinet (that goes to recycling every day
Privacy is ruled to be of the utmost importance in Luxembourg. Moreso than even the Swiss.
- Why am I ranting about this? - well, all these bankers use computers. They usually use Windows computers. Computers that sometime (quite often if you take a look at Zone alarm) choose to send information from the bank to an external party. What information that is being sent is not disclosed by microsoft. No one knows.
But more seriously:
- If you allow Microsoft to be root - by definition you give them unlimited access to information regarding the clients of the bank. So who would be guilty (who would get 5 years in prison) ? - well, if the EULA is valid i the EU (not entirely sure that it would hold up in a court of law ) it should be the sysadm that clicks through the EULA . Otherwise, you could possibly point the finger to the head of security, within the bank, who decided to accept the EULA
Its a question of time...
Absolutely true!!!
We had a multi-million-dollar solution go down the toilet because neither the software manufacturer nor the doctor's practice nor the local medical board could assure us we were going to be HIPAA-compliant.
Hell, even the US-friggin-government couldn't tell us we would be compliant. Bottom-line? The customer walked because there WAS no solution. No-one knows what HIPAA is right now; it is just a loosely-defined, vague, treatise on what you SHOULD be doing.
-PONA-
+that's funny...I don't FEEL tardy.+
we built so-called homegrown software, knowing about hipaa (in fact, i think i read the spec more than the hipaa compliance officer assigned to the task) and no, there was no HL7 -- we built the app as a client/server with firebird/interbase, so there was no control over the data transmission. most of the firebird team, in fact, views SSL on the connection as unnecessary, but we didn't know how to go about setting that up manually (i hear it can be done, never got around to it.) the fact that the reply to your post says that HL7 is cleartext actually worries me ... we had to share the network with non-medical staff, but at least we knew the internet access was nice and secure.
... and slowly accumulate data about our patients.) to be hipaa compliant, you must make sure nobody can get to the data (remember: this also means locking your console when you're away, logging out, closing the door, keeping the blinds shut, etc.) so in this case, i'd recommend the following: make sure the w2k machines are set -not- to do automatic updates, and make sure the firewall is setup such that nobody's going to get in from the outside ... as long as the machines don't automatically wake themselves up and decide to go looking for updates, you should be fine. nothing that comes with w2k should make the system insecure, and with no updates other than by your network admin/techs, nothing new should arrive to change that.
... (i know, unlikely, but ... core dumps for helping to fix things? memory dumps for entire system status at the time of a crash? that annoying feature in XP that asks you if you want to send MS a bug report about your own, home-grown app if it crashes while you're testing something unstable?)
our database server was running linux (slackware) so the EULA had no effect there. on the other hand, some of our machines were running w2k (dell) and were thus liable to have a EULA issue on the client end (MS could remotely install a listening patch gaining access to the DB data coming and going
even with SSL between the DB and our clients, we couldn't prevent an MS program from, say, gleaning data directly from RAM
I work for a pharmacuetical in the Buffalo area, the point is... is M$ compliant? If you are affected in anyway, your whole process needs to be compliant. I highly doubt that they are, because if they were, then all that cash in the bank would be wasted on paperwork. I don't blame them, but they basically sell information as they please to any old person on the street. Its been the M$ way for fucking years.
I'm amused by kids who think numeric lettering is cool and new slang. I've seen college freshmen every year reinvent it for 25 years...well, they've stopped reinventing it the past 10 years since they've encountered it by then.
His electronic Image must have been the one who read and posted here.
Our company deals with medical records in a peripheral sort of way (as they pertain to student loans)
"Mr. Peterson? This is your student loan officer. We note from your medical records that you still have both of your kidneys. We note from our financial records that you still owe us $40,000. Are you aware of how much a healthy kidney can fetch on the black market? Hello? Hello?"
Yes, a loosely defined treastise of laws to screw poor IT people over when someone fucks up. Don't worry, "risk management", aka your company's liaison to the insurance provider, will make all of you sign waivers after giving you a class that gives you just the vaguest notion of what HIPAA is. You will walk away confused, feeling like someone just screwed you and there will be nothing you can do about it. The purpose of all this is simple: Later on when someone fucks up, they now have some individual to blame and say "Hey, we're not responsible as an organization, he is!!!". And you won't have the first clue why they are putting you in jail. HIPAA is bureaucracy at its finest. HIPAA is Bill Clinton's legacy. HIPAA should die a quick and painful death before we all suffer its wretchedness.
Russian Russian Russian RussianDollSig DollSig DollSig DollSig
SIM Solution for HIPPA compliance
TriGeo Network Security
HIPAA is the Health Insurance Portability and Accountability Act of 1996, which is a regulatory nightmare that we will eventually be thankful for.
HIPAA is designed to accomplish three things:
1) Provide employers and employees with a standardized, useable system for transferring health insurance coverage (and/or the payment arrangement associated with that coverage)from one party to another. This would mostly be used to prevent gaps in insurance coverage when switching jobs.
2) Force all medical service providers (such as hospitals and analytical labs) and insurance providers to conform to a single strongly defined set of transaction codes and formats.
3) Mandate proper security for sensitive medical records (defined as ANY medical records of ANY sort that could be used to identify an individual's state of health or medical treatments received).
HIPAA is a nightmare because most hospital data management systems have totally ineffective security. Meditech, for example, is appalling, and homegrown systems are usually worse (I know of one world-famous Oncology Centre where the passwords have not been changed in seven years - hundreds of ex-employees know them all). The most secure is probably SMS (which is slow, cumbersome, mainframe-based, and tremendously expensive) or possibly HBOC (same comments apply).
Adding to the futility is the unbelievably lame way the government has handled the specification, dissemination, and revision of the standards. All the transaction stuff is fine, but the security standards are vague and constantly changing.
We will eventually be happy because HIPAA's transaction standards will vastly decrease costs in the health care and insurance industries - currently millions of man-hours are wasted doing simple reformatting tasks, because medical software companies generally refuse to use anything but government-mandated (HL7, UB92, etc) or proprietary data formats, in order to prevent customers from easily switching vendors.
I am currently searching for a new job because I do not wish to be involved in HIPAA any more. I am a scientist, not a lawyer, and I find all this stuff tedious, especially the intransigence of vendors who simply don't care if their products are HIPAA-compliant.
Isn't there more than privacy legislation involved? Those computers are somehow part of the process of getting people cured, healed, fixed-up, life-saved. How can any systems manager in that situation not maintain complete control of the machines? I've heard that their is MS software on airplanes. Does MS have the right to replace the software while the plane is in flight? Isn't this an ethical and a safety issue instead of simply a legal issue?
The clause you've been debating interacts with this other clause, which says that if I don't accept everything Microsoft wants me to take (or give!) then my only recourse is to stop using their software. Microsoft is very close to making auto-update a condition of running their software. They haven't gone entirely to ``leasing agreements only'' but they're very close.
From the mouth of Microsoft:
Replacement, Modification and Upgrade of the Software: Microsoft reserves the right to replace, modify or upgrade the SOFTWARE at any time by offering you a replacement or modified version of the SOFTWARE or such upgrade and to charge for such replacement, modification or upgrade. Any such replacement or modified software code or upgrade to the SOFTWARE offered to you by Microsoft shall be considered part of the SOFTWARE and subject to the terms of this EULA (unless this EULA is superceded by a further EULA accompanying such replacement or modified version of or upgrade to the SOFTWARE). In the event that Microsoft offers a replacement or modified version of or any upgrade to the SOFTWARE, (a) your continued use of the SOFTWARE is conditioned on your acceptance of such replacement or modified version of or upgrade to the SOFTWARE and any accompanying superceding EULA and (b) in the case of the replacement or modified SOFTWARE, your use of all prior versions of the SOFTWARE is terminated.
SIM Solution for HIPPA compliance
TriGeo Network Security
I really wanna read the exact wording of this thing. I'm interested in seeing what I just clicked accept to. -Tim
Tim Smith - Ramblings from Nerd Land
SIM Solution for HIPPA compliance
TriGeo Network Security
People who say that are forgetting that MS issues the keys. MS can already have a database of all legal keys, which means keygen would also have to test for a valid key.
MS could require registration in order to be able to download patches, so it can detect duplicate keys in use. Just because it seems that MS is presently not comparing against its own generated keys doesn't mean they won't....nor that they won't retroactively compare to that list.
Nor do we know if MS is actually performing such tests but using the info for something other than online validation.
SIM Solution for HIPPA compliance
TriGeo Network Security
hehe the day before US Taxes are due.... that is going to be a VERY stressful year for many
SIM Solution for HIPPA compliance
TriGeo Network Security
Check out DataHive, who makes network servers that assist in many areas of HIPAA compliance. Their products are built upon OpenBSD, and have all the goodiest most companies need, out of the box.
Without knowing more details about how your operation handles medical records, let me tell you that a small medical office can have its IT department almost fully HIPAA compliant simply by installing a DataHive and following the install guide. Even down to the nitty gritty things like locking drives and offsite backup, DataHive has it covered.
Remember, a computer cannot make you HIPAA compliant, but it can ASSIST in achieving HIPAA compliance.
SIM Solution for HIPPA compliance
TriGeo Network Security
Contact your legal department and have them review the EULA and the law. If they can't find a law firm that can.
...there's a whole new disaster in the making...
Also, when talking about HIPAA it's good to be clear as to which parts of HIPAA you are talking about. HIPAA Security was finally published a few weeks ago...
Anytime you see an MS station in a medical setting from now on, admire their bravery for bucking the HIPAA rules.
Doctors don't give a damn about MS. They certainly don't understand that they might be non-compliant and subject to lawsuit. They will drop MS in a second if they find out that this is true.
Btw: My wife is a doctor that's newly entered practice and she's been having me look up this sort of stuff to educate her.
Great thread.
If I wanted a really secure system, I wouldn't hook it up to the internet. Not with *any* OS. Also no floppy drives or removable hard drives. Etc.
I'm not sure just what level of security you need, and what level of access you need, but consider having an intra-net that is disconnected from the internet. Any computer that really needed to access the internet would need to have two cable drops, and just manually switch between them as needed. (This wouldn't stop people intentionally breaching security, but it would be pretty effective against programs.)
Better still would be if the networks didn't share computers. Do you have any need for this data to go over the internet? Even VPNs are less secure than not having a connection. If you must, then use a server that is secure, and that doesn't mean MS. Novell, Unix, Linux, even, I've heard, Apple have good choices. With Apple though you will want to make sure that MSIE isn't installed. Perhaps the Apple version is safer than the Windows version, I wouldn't know, but I don't know, so I recommend against it. Of these, Novell is probably the safest (not really sure here, but that's what it looks like), but they're all pretty good choices with a range of prices and ease-of-use. (If you are new to a system, ease of use can be quite important. It can help you avoid mistakes.)
I think we've pushed this "anyone can grow up to be president" thing too far.
That the files that are on the HD are accessable by any program? Just sitting there unencrypted, waiting for anyone with a floppy to copy them off and read them? Anyone with a trojan to come in and get them. No backup so that by "accidental" update erasure or hardware failure the data isn't retreivable?
There's the real crime. Supposedly "secure" data relying only on the inaccessability of the machine or OS for it's security?
If those things were actually done right, then there is no problem at all. But of course, 99% of the time they are not, then you, us, no one has any hope.
SIM Solution for HIPPA compliance
TriGeo Network Security
the problem is not that someone will "sue microsoft",
the problem is that some doctor is going to be possibly
at risk for triple damages in a malpractice suit
because someone in his practice made this "Agreement"
with microsoft. The doctor CANNOT make this agreement,
because to do so is unethical and illegal.
so sure, you can "make anyone agree to any eula you want"
but you can't make it legal or ethical for them to
do so, and you can't take responsibility for the consequences to them
if they do. On the other hand, there aren't any alternatives in some cases --
if you need a machine which runs certain (windows-only) software,
and it needs to be connected to a network, you have problems
if you don't install the service pack, and you have problems if you
do.
Some people with deep pockets are affected by this, maybe
this will finally be the spark.
SIM Solution for HIPPA compliance
TriGeo Network Security
Comment removed based on user account deletion
As I understand it, as a beta tester, I cannot in good faith sign a NDA when testing a product and run that product on a machine where I have already agreed with current Microsoft EULA's. The EULA seems to force me to disclose whatever happens to be installed on that PC.
No Zen is good zen
Comment removed based on user account deletion
This whole issue is moot. The MS EULA is unenforceable (ie. illegal) in most states. The HIPAA is only one of the reasons why. Various Privacy acts are another reason and the whole click-through-licence thing is yet another reason and not least of all is the first-sale-doctrine and various sale-of-goods acts stating that if it looks like a sale, behaves like a sale and smells like a sale, then it is a sale, despite having a 'licence agreement'...
nuff said
Thanks! Why did it take so long for someone to reach this obvious conclusion?!
Comment removed based on user account deletion
Wow. Spamming Slashdot - this is the 2nd exact same reply and link to a commercial service / product. I'm not sure whether you're ballsy or an idiot.
Incidently - its a technical solution. It does nothing to address the legal issue being presented.
Comment removed based on user account deletion
...spam, perhapse?
Or drunk?
How many hurls do you need?
We assessed the "hurl vs hurdle" question a long time ago and decided overwhelmingly in favor of hurdles...
Comment removed based on user account deletion
Comment removed based on user account deletion
By your arguement, you couldn't connect your computer to the internet at all. Any program could inadvertantly look at data and send it anywhere. Unless you have hard evidence that MS is sending your data to Redmond, I don't think you have any real compliance issue. Doesn't anyone have anything more interesting to post than MS paranoia comments? Just take your meds, people, and get on with life.
Vote for Pedro
Folks,I work for a company who creates practice managment systems. I sent this link out and here is a snippit I got. Seems as if this guy has a valid concern, but he would need to keep in mind that software CANNOT be HIPAA-compliant. Since the security regulations have not been passed, then the user implementing this software would not be penalized if records were wrongly accessed. Not until the government hands down specific guidelines to protect user's technology can anyone really act. Not that I know much about how to implement security in a technology environment (or about win2k or SP3 for that matter), IT departments should make best efforts and be conservative in securing their hardware and software.
Talk about irresponsible.
-- Note: If you don't agree with me, don't bother replying. I won't read it.
Ok so you don't want to violate any agreements, but yet you feel letting Microsoft have access to your computer would also be bad. Well in this case either just install the patches like many companies already have.
You always do have the choice of switching to another OS like Linux or Apple, but they also have there problems too. This would eliminate the problem of Microsoft accessing your files. The bad part of course is throwing away the money that companies spent to for licenses for Microsoft, so most of the time it's not a logical option.
In the end, if you're so afraid of using the patch, then don't. (I wouldn't blame you; I would do the same thing.)
...not many people here have actually read the EULA now have they?
/. now isn't it?
The EULA *SPECIFICALLY* states that the only access MS is requesting is to the OS and even then only regards to the updater.
This is because they need your permission to install the software.
But of course this was simply overlooked by
Comment removed based on user account deletion
Yeah, you're a real professional alright. You couldn't even spell intrigued or disarray properly. Do you even know what HIPAA stands for, or were you just trying to make yourself look good..in a decidedly bad way?
We thought of doing this.
We really did, working at a school, all the hackers are on the wrong side of an internet firewall.
The problem:
It's rather difficult to find a cost effective firewall product that'll work at dual gigabit ethernet speed.
I am a programmer updating software for a major pharmaceutical company so that they are HIPAA compliant. The update is being deployed onto Win2k SP2. So if you are worried about SP3 then certainly don't update to SP3, or roll back to SP2. I understand that rolling back could be a tremendous amount of work... but so can consulting lawyers. The best way to get around a EULA is don't agree to it.
Sadly, *BSD is dying, so there will be no one left.
OpenEMR is a modular, HIPAA compliant cross-platform electronic medical records system (EMRS). It facilitates efficient office management through automated patient record journaling and billing integration, and has been successfully integrated with third-party technologies including speech recognition, secure wireless access, touch screen portables, and biometric authentication. Interface screens are customizable and optimized for consistency, simplicity, speed of access to patient information, and minimum eye strain. OpenEMR is based upon widely-used public standards to achieve maximum compatibility with evolving technologies.
And then there are the HIPAA message formats.
Health insurance related transactions are not terribly complicated. But HIPAA has managed to create a foot thick pile of documentation JUST ON THE MESSAGE FORMATS. They are unbelievable complex, and of course, they are not XML!
Oh, and if you don't use them, you can get in big, big trouble and go to jail.
Sigh.
The only good weather is bad weather.
If you expect support where the software vendor has any access to your system, a software (or hardware) provider such as Microsoft is one of your many Business Associates, under the Privacy part of HIPAA. When dealing with real people and 2-sided contracts with Business Associates, you comply with HIPAA by having in your contract an agreement that the Business Associate will be bound by the privacy rules of HIPAA not to abuse or disclose any patient data, which now have a 1-year extension to April 2004. It is not automatically bound by anything in HIPAA, you are required to bind it in your contract. Also, such a provision probably would not override an EULA, especailly a subsequently accepted one, unless (a) it says it overrides any contrary provision of any EULA and (b) there is an actual contract, signed by an agent of Microsoft. The $64,000,000 question is, how do you get Microsoft (or any other shrink-wrap or download software vendor) to sign an EULA with you, assuming you are a small practice or hospital and not a mega-health-care provider?
What's more, Microsoft XP's UPnP implementation has an API that lets an application register port forwarding at the router (article here). I don't know if this is targeted more at the home market, but don't you ever depoly an UPnP-enabled firewall...
Karma: none (due to not believing in reincarnation)
At the moment I have 4 modpoints left and am working through this thread -- so I don't know if this will post (even anonymously).
:).
Although I didn't moderate the initial parent comment, I can see the sense. The first half is insightful, the second a little flamebait -- which is probably earning the downmod as opposed to your first half which raises a valid point. (This is coming from a Win98 user, BTW, so don't think that only anti-MS zealots get modded up).
Metamoderation will catch most renegade moderators, and you seem to have another moderator who agrees with your second post, so things aren't all that bad
Try Kuro5hin if you're sick of Slashdot's mod system perhaps. Or the User Discussions page to start a meta-thread.
- Anonymous Coward.
When the security regs come out, we pretty much expect the reasonableness standard to apply to everything there as well."
Yeah, What he said.
healyourchurchwebsite.com - WWJB?
Comment removed based on user account deletion
You can use SMS or other similar tools to make sure that all computers are up to date with the latest patches, and you can change the default security policy under Windows 2000 to prevent users from using the Windows Update or other features that might give Microsoft access to those systems.
At the medical center I worked at; security was extremely poor. We migrated from SMS to Cerner which had alot of NT servers involved though the database was Oracle on a Open Vms platform.
Things Are The Way They Are
Comment removed based on user account deletion
Comment removed based on user account deletion
The majority of what's been posted on this question as it relates to what HIPAA is and isn't, is incorrect (I won't comment on the EULA issues). As has been suggested, please contact a healthcare attorney, or a security consultant who has worked with HIPAA before acting on any advice posted here. The attorney can help you with what HIPAA is, but they probably won't be able to help much with the details of the HIPAA EDI and security regulations.
To clear some things up though (and I am a security consultant who has been working with HIPAA for 2 years and have performed over 50 HIPAA security assessments in the last 19 months):
1. HIPAA is a law, not a person, or gov't group; it stands for the Health Insurance Portability and Accountability Act of 1996; there were multiple provisions to HIPAA, but what this topic is dealing with is the Administrative Simplification provision, which has three parts: EDI (transactions and code sets), privacy, and security; these three parts have been implemented by the Dept of Health and Human Services as federal regulations; the compliance date for the EDI regulations is Oct 2002, however covered entities can file a one year extension (for EDI compliance only), that doesn't require a complete inventory of all HW/SW; the compliance date for the privacy regulations is Apr 14, 2003; the security regulations are not finalized yet, but when they are, the compliance date will be 2 years from when they become final (however, the privacy regulations pretty much imply that you should comply with the security regulations by 4-14-03 also); business entities required to comply with HIPAA are: all health plans (health insurance companies), all health care clearinghouses, and those health care providers who perform at least one standard health care transaction (as defined in the EDI regulations) in an electronic manner
2. The only SW that can really be deemed to be HIPAA-compliant or not will be applications used to perform the health care transactions defined in the EDI regulations, if done in an electronic manner; any HW, OS or other SW in use not dealing with these transactions will have to be evaluated to ensure that it has security features required by the security regulations (and only really, really old SW and HW won't have these features - ie. DOS-based SW that doesn't implement IDs and passwords)
3. The Proposed HIPAA Security Regulations were published in Oct 98; they are technology-neutral and define well-accepted security controls (technical and non-technical) that should be implemented in a "reasonable" manner to secure information that is determined to be PHI (Protected Health Information - this term is specifically defined in the privacy regulations); basically PHI is medical or financial information about a patient that is stored or transmitted electronically by a HIPAA covered entity
4. The Proposed HIPAA Security Regulations are not in disarray, but define security controls (with required features) in a general, but usable way (if you understand security) so that what is required can be implemented today, without waiting for the final regulations (with the possible exception of the Electronic Signature Standard, which is really a separate regulation, but gets lumped in with the security regulations); the final HIPAA security regulations should NOT be too different from the proposed ones, but may have some clarifications and more specific technical requirements (ie. encryption algorithms, key length)
5. The HIPAA security regulations are 70% policies and procedures and 30% technology; the documented policies required cover information, physical and personnel security in a pretty thorough manner
6. The technical security requirements of the HIPAA security regulations involve the following areas, with some specifics given in the regulations:
a. access controls (system and network)
b. audit controls (system and network)
c. data authentication
d. entity authentication
e. integrity controls during communication
f. message authentication during communication
g. encryption during communication
h. other network controls including:
- alarms, audit trails, event reporting
7. These technical security controls are vaguely defined, but can be implemented if you have a thorough understanding of information security and the security features of the HW/SW in use; they can be implemented now because the regulations do state that a covered entity can determine what is reasonable, as long as they cover what is required
8. The HIPAA Privacy Regulations will be enforced by the Office of Civil Rights (OCR), and will entail complaints being filed with the OCR on suspected compliance violations; there will be no gov't auditing done (from what the lawyers I work with tell me, and they also work with HHS - Health and Human Services - so they should know); the enforcement of the security regulations isn't clear right now, which hopefully will be addressed in the final regulations (it may also be OCR); enforcement of the EDI regulations isn't necessary, because if you don't comply, you basically can't stay in business; non-compliance with the EDI regulations will prevent you from performing the standard health care transactions with insurance companies and/or clearinghouses, which is why you couldn't stay in business, unless you don't accept insurance (if you don't do the standard transactions electronically, you aren't required to comply with HIPAA)
9. You (a HIPAA covered entity) are NOT required to ensure that your business associates comply with HIPAA (your business associates may not be HIPAA covered entities and therefore wouldn't be required to comply with HIPAA); you WILL be required to have a business associate agreement (HIPAA-specific legal verbage added to contracts) with entities determined to be HIPAA-defined business associates (this term is also specifically defined in the privacy regulations)
Hopefully that covers most of the misinformation posted here.
Enjoy!
Comment removed based on user account deletion
"You see? You are already hooked. Now we need to move faster so that dependance doesn't grow.
Don't create documents in a format where the only application that can read them is controlled by a company whose EULAs say 'We can do anything we like with your computer and you have to like it too'."
In the department of the German Government which deals with recommendations for IT infrastructure and software (for the rest of the state), this was discussed recently. And the outcome was, every time somebody mentioned special software, or access, or compatbility, that only works with Microsoft, the answer were like the one above.
No. I don't think they'll switch tomorrow. What they are going to do (probably) is for now, stick with their legacy apps. But the Government has decided it wants to be "e-Government" too, and so everything must be browser-based and acessible everywhere, internally and externally.
That is a huge advantage, for one thing, there is somebody who says "Things WILL CHANGE", no matter what the users say (so complaining about having to relearn won't do any good). Further, with web-based stuff you are efficiently removing the need for special client software (unless you are a stupid moron and rely on IE-only features). Third, the IT departments can (and they do want to) introduce open solutions in the server space without anybody noticing much, and that's exactly what they are doing now.
So, if the problem will fit into a web-based solution, advocate this instead of bullying the users with SuSE or RedHat CDs. Then, when they are used to using Mozilla or IE (in Windows) for almost all their stuff, the transition to an independant desktop system is much, much easier. They won't even notice the difference if you're clever enough (http://mozillako.hypermart.net/ieskin/).
Home Page
Solution seems simple, if you're a big enough organization. Have your attorneys demand that Microsoft sign an NDA and an indemnification contract prior to buying any more software or updating anything.
They won't sign it, of course, but if enough customers do this, they'll change the offending terms of the license.
Pete Clark