Jun

23

TIP: Communicate your laptop security policies

By Dom Nicastro

Editor’s note: This is the second in a series of tips in HIPAA Update on laptop security. The excerpts are courtesy of the HCPro, Inc. newsletter, Briefings on HIPAA.

Organizations don’t always do a good job of communicating their laptop and portable device security policies, says Ali Pabrai, CISSP, CSCS, CEO of ecfirst, Inc., and CEO and cofounder of HIPAA Academy in Newport Beach, CA.

After conducting assessments and audits at organizations nationwide, Pabrai says that organizations often don’t enforce their policies and don’t articulate the requirement that information must be encrypted.

Encourage users not to store sensitive data on laptop computers, says Phyllis A. Patrick, MBA, FACHE, CHC, cofounder and managing director of AP Health Care Compliance Group, which has offices in Pittsburgh and Purchase, NY. Available technology allows users to access data from file servers or via wireless methods, so staff members don’t need to store sensitive information directly on laptop computers, she says.