Why corporate IT should unchain our office computers

Re:Why corporate IT should unchain our office computers by tptacek on Thursday August 27, 2009 @01:08AM (#788674)

I think you have the HIPAA encryption requirement backwards --- from experience --- but your argument still stands.

[ Parent | on HN ]

Re:Why corporate IT should unchain our office computers by sokoloff on Thursday August 27, 2009 @07:52AM (#789037)

I think GP was saying roughly "IM provides a means for encrypted communication, including the transfer of files. By HIPAA, we have to prevent the transfer of files containing patient medical information. The firewall can't distinguish among that encrypted traffic in order to PERMIT text chat but PREVENT all file transfers, thus the ability to transfer files securely via IM is an exploit as far as HIPAA is concerned."

[ Parent | on HN ]

Re:Why corporate IT should unchain our office computers by tptacek on Thursday August 27, 2009 @02:05PM (#789681)

Yeah, this tangent is snowballing a little bit. I think the original post literally just had a typo.

Having said that, again, in several places I've worked where HIPAA is a constant presence, it hasn't killed IM. It's a dealbreaker for a lot of financials though.

[ Parent | on HN ]

Re:Why corporate IT should unchain our office computers by TomOfTTB on Thursday August 27, 2009 @01:24AM (#788704)

I honestly don't know what you mean by this but I'd be curious to hear an elaboration

[ Parent | on HN ]

Re:Why corporate IT should unchain our office computers by dkokelley on Thursday August 27, 2009 @01:48AM (#788731)

they allow for encrypted transfer of files and hence represent a risk to medical records

This could go either way, actually. Unencrypted transfer of files is obviously risky and if it's through a 3rd party provider (AOL, GTalk, etc.) then there is a risk of confidential medical information being intercepted.

Alternatively, maybe there needs to be internal records of who has sent or received which files. Encrypting files makes it harder for the administration to know who has what.

I'm leaning towards the first explanation of the danger of unencrypted file exchange, but I could be wrong.

[ Parent | on HN ]

Re:Why corporate IT should unchain our office computers by tptacek on Thursday August 27, 2009 @02:11AM (#788763)

HIPAA isn't like GLBA; it doesn't have the tracking requirement. It's just unusually explicit that PHI needs to be encrypted in flight.

[ Parent | on HN ]

Re:Why corporate IT should unchain our office computers by tptacek on Thursday August 27, 2009 @01:41AM (#788725)

HIPAA requires you to encrypt medical information.

(Also, lots of heavily HIPAA-regulated places allow IM.)

[ Parent | on HN ]