HIPAA Security – Workstation and Mobile Device Use and Security Configuration

Layout for printing
Policy Number:
UW-136
Old Policy Number:
8.13
Responsible Office:
Office of Compliance

University Policy

Rationale/​Purpose:

The HIPAA Security Rule establishes national standards to protect individuals’ electronic personal health information that is created, received, used, or maintained by a covered entity. The Security Rule requires covered entities to take appropriate administrative, physical and technical safeguards to ensure the confidentiality, integrity, and security of electronic protected health information.

Definitions:
Firewall
Hardware or software devices that are used to restrict the types and sources of internet traffic sent to a device. All internet traffic passes through the firewall, which examines the traffic data and blocks traffic that is not allowed by the firewall’s rules.
Managed device
A managed device is any device that is under UW Health or UW-Madison’s control and can be validated.
Mobile device
A portable computing device running a mobile device operating system, including, but not limited to, mobile phones, music players, and tablets. Common mobile device operating systems include Apple iOS and Google Android.
Mobile Device Management System (MDM)
A service used to secure mobile devices and the data stored on them.
Protected Health Information (PHI)
Any individually identifiable health information protected by HIPAA that is transmitted by or stored in electronic media. Health information or health care payment information, including demographic information collected from an individual, which identifies the individual or can be used to identify the individual. PHI does not include student records held by educational institutions or employment records held by employers.
Remote Desktop Services (RDS)
A software application that permits a user to take control, via a network connection, of another computer, virtual machine or application.
User
A person who has access to an organization's information systems. This includes workforce members, business associates, external research collaborators, and other external persons.
UW-Madison Health Care Component (UW HCC)
Those units of the University of Wisconsin-Madison that have been designated by the University as part of its health care component under HIPAA. See UW-100 Designation of UW-Madison Health Care Component for a listing of these units.
Virtual Desktop Infrastructure (VDI)
Hosting of desktop computing environments on a central server. A desktop image is run within a virtual machine on the server, and the output is delivered to the client endpoint over a network. A virtual machine is another name used to describe this asset type.
Virtual Private Network (VPN)
A private network that connects computers over the Internet and encrypts their communications.
Workforce
Employees, volunteers, trainees, and other persons whose conduct, in the performance of work for a covered entity, is under the direct control of such entity, whether or not they are paid by the covered entity.
Workstation
Any electronic computing device that is used to perform the work and duties for which a person was hired. Workstation devices may include but are not limited to laptop or desktop computers, virtual machines, or mobile devices.
Scope:

Applies to all members of the UW-Madison Health Care Component and members of the UW-Madison campus who serve as Business Associates to other covered entities.

Policy:

Policy Summary

The units of the UW-Madison Health Care Component (UW HCC) and each entity or person at UW-Madison serving as a Business Associate for a covered entity must ensure the confidentiality, integrity, and availability of all Protected Health Information (PHI) by establishing the following documentation and procedural requirements. 

Remote Access to PHI may be granted in accordance with the permissions and safeguards outlined in this policy.

Policy Detail Network 

  1. Workstation and Mobile Device Security Configuration

    Workstations and mobile devices used with PHI must be configured securely to protect the privacy, security, confidentiality, integrity, and availability of PHI. Secure configuration requirements may be found in the procedure document which supports this policy; secure configuration may be established and maintained by UW-Madison or the Unit within the UW HCC to which a user belongs or may be the responsibility of an end user when using a device not managed by UW-Madison or the UW HCC. Additional requirements exist for workstations and mobile devices used to remotely access PHI; please see UW-133 Remote Access to PHI. 

  2. Workstation and Mobile Device Use

    Workstations and mobile devices used with PHI must be used in a secure fashion. 

    1. All users are responsible for protecting the privacy, security, confidentiality, integrity, and availability of PHI in the information systems in which they work at all times. Users must use workstations and mobile devices which have been secured in accordance with Section I of this policy when they access PHI from such workstations and mobile devices.
    2. Workstations, mobile devices, and applications on them used to access PHI must be used for authorized purposes.
    3. Workstations should be placed in physically secure areas when possible. Workstations located in public areas must be physically positioned to minimize the risk of incidental access to PHI and must be periodically reviewed by the appropriate Unit’s HIPAA Security Coordinator or the HIPAA Privacy or Security Officer. Where physical positioning options are limited, privacy screens should be used to limit the area of visual display.

  3. Mobile Device Security

    Unmanaged Mobile Devices must not be used to access PHI. Anyone who is a member of the UW HCC when accessing their UW email will only access their email via the Outlook client or Outlook web access on a device provided by their department or a device enrolled in an Approved Mobile Device Management (MDM) solution. If the department chooses to not support a certain type of device in MDM, then accessing email via a mobile device will only be done using the Outlook web access.

    As a member of the HCC these tools are expected to be used on devices issued or managed by UW Health or UW-Madison.

  4. Remote Desktop Services

    Physical and Virtual Machines enabled for Remote Desktop Service access must meet the requirements outlined in the UW-136 HIPAA Security - Workstation and Mobile Device Use and Security Configuration procedure.

  5. Servers Security

    Servers must be located in physically secure environments as described in policy UW-135 HIPAA Security Facilities Management, must be on secure networks with firewall protection as described below and must comply with requirements outlined in the UW-136 HIPAA Security - Workstation and Mobile Device Use and Security Configuration procedure.

  6. Security of Networks Used to Access PHI from Workstations and Mobile Devices

    Network devices must be located in physically secure environments as described in UW-135 HIPAA Security Facilities Management, and in the procedure supporting this policy.

  7. Automatic Logoff or Locking

    All workstations and mobile devices used with PHI must be configured to automatically log off or lock after a pre-determined period of inactivity, not to exceed fifteen (15) minutes. Where automatic log off or locking is not configured administratively by an end user’s IT department, the automatic log off or locking must be configured by the User of such workstation or mobile device. Prior to leaving a workstation or mobile device unattended, a user must assure no PHI remains visible or available to others and must use a workstation or mobile device lock function.

  8. Sanitization of Workstations and Mobile Devices Used with PHI Prior To Re-Use or Disposal

    All workstations and mobile devices used with PHI must be sanitized to remove such PHI prior to their re-use or disposal. Failure to sanitize workstations and mobile devices prior to their re-use or disposal may result in unauthorized access to the PHI on such workstations and mobile devices. For support with sanitization of workstations or mobile devices, users should contact their local IT department or refer to UW-130 Destruction/Disposal of Protected Health Information.

  9. Encryption and Decryption

    When PHI is accessed on any workstations and mobile devices, said device must be encrypted using a method of storage encryption appropriate for high-risk data.

  10. PHI transmitted over any network must be encrypted

    PHI transmitted over any network must be encrypted to an approved standard for high-risk data. Wireless transmission is covered in UW-133 Remote Access to PHI.

Consequences for Non-Compliance

Failing to comply with this policy may result in progressive discipline for the individual(s) responsible for such non-compliance.

Further, the US Department Health and Human Services (HHS) Office for Civil Rights (OCR) is responsible for enforcing the HIPAA Privacy and Security Rules, and an individual’s non-compliance may result in institutional non-compliance and/or an investigation by OCR. OCR attempts to resolve investigations by obtaining voluntary compliance and entering into Corrective Action Plans and Resolution Agreements. Failures to comply with HIPAA or cooperate with OCR in an investigation may result in civil and/or criminal penalties.

Related UW-Madison Policies:
External References:

Regent Policy Document 25-3 Acceptable Use of Information Technology Resources

Policy Administration

Approval Authority:
Vice Chancellor for Legal Affairs
Policy Manager:
HIPAA Privacy Officer
Contact:
HIPAA Privacy Officer -- Jack Talaska, JACK.TALASKA@WISC.EDU, (608) 265-4077
Effective Date:
10-20-2021
Revised Dates:

06-14-2022

Retrieved:
12-13-2024 06:13:21