Slashdot Log In
Is Win2k + SP3 HIPAA Compliant?
Posted by
Cliff
on Wed Aug 28, 2002 07:23 AM
from the EULAs-vs-government-regulations dept.
from the EULAs-vs-government-regulations dept.
Chris asks: "Our company deals with medical records in a peripheral sort of way (as they pertain to student loans), and due to new laws we are required to be HIPAA
compliant by April. After reading the discussion on here about the new EULA for Win2k SP3, I had a disturbing thought. As far as I can tell, if you use Windows 2000 then you're going to be out of compliance whatever you do. If you install the patch, then theoretically Microsoft could access those medical records (possibly by accident) without 'due cause or need' in the process of updating your machine. If you don't patch your system then you'll fail the security requirements of the law." If Win2k with SP3 is not HIPAA compliant (and I stress the if because no one has made a statement either way, yet) what can non-compliant Medical IT departments do?
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Full
Abbreviated
Hidden
Loading... please wait.
Waiting for clear definition (Score:5, Informative)
This is one of those standards that has yet to be clearly defined.
Re:Waiting for clear definition (Score:5, Informative)
Parent
Re:Waiting for clear definition (Score:5, Insightful)
I don't think the whole "trustworthy computing" thing is so much a standard waiting to be clarified as much as it is a purpose which is in direct opposition to the concept of well understood standards.
Micro$oft intends to remove you from concern over the security model of your computer, tracing paths of trust to a few "trusted authorities". HIPAA, and indeed any responsible security policy, requires you to know and be in control of what happens to your computers. The Win2ksp3 EULA makes that impossible, as does Microsoft's entire vision for "trustworthy computing".
Parent
Easy sollution really... (Score:4, Informative)
In stead you have a server running SUS, aka Software Update Services [microsoft.com]. It solves the problem of Microsoft accessing your workstations as you deploy the fixes from a central server of your choosing. This is what Microsoft recommends us to use, I spoke a few weeks ago with the Product Manager for the Finnish division and he recommended this.
Re:Easy sollution really... (Score:5, Informative)
Q. Does SUS support Service Packs?
A. No, it is not possible to use SUS to deploy Service Packs.
Parent
Re:Easy sollution really... (Score:4, Informative)
A. No, it is not possible to use SUS to deploy Service Packs.
Yes, but that's not the point of SUS, if you wish to deploy a service pack to a windows 2000 domain, you push it out via an Active Directory published package.
On a side note, I have realized a lot of people here don't realize the amount of control an adimistrator has with Active Directory. I suggest some of you read up on that.
Parent
HIPAA Compliance (Score:4, Insightful)
Besides, would you really want to take legal advice from a group of people who are known to mistake duct tape and baling wire for building materials?
Re:HIPAA Compliance (Score:5, Insightful)
However, when seeking assistance from a lawyer (or any similar professional) it is best to have a basic understanding of what is going on, and what you need, before you set up a meeting. You will get a lot more accomplished that way.
Similarily, lawyers aren't born knowing everything (even though they try to foster that impression!). If your hospital's legal dept. primarily handles malpractice and billing cases, and you bring an intellectual property / EULA problem to them, they are also going to have to do some research to get up to speed. Being able to provide background helps here too.
sPh
Parent
Re:HIPAA Compliance (Score:4, Insightful)
Parent
"How to defang Win2k SP3's auto updating" (Score:4, Informative)
basicaly it teaches how to deactivate this backdoor M$ is installing in every win2k box.
now, the original submiter could really consider an alternative.
if U don't like free (as in freedom) open source tools, why not a Solaris box with Oracle to keep the data ? Or an AIX with DB2 ? or PostgreSQL ?
does you REALLY need win2k ????
Re:"How to defang Win2k SP3's auto updating" (Score:3, Insightful)
Re:"How to defang Win2k SP3's auto updating" (Score:3, Informative)
Submit a request to HIPAA not /. (Score:5, Insightful)
Be certain your lawyer understands he should ask for an exemption until this is clarified. (This will prevent them from sitting on it for two years and then you getting in trouble later.)
Later when HIPAA says it is okay to do "X" and you find MS (or anyone with such an EULA) has absorbed records, your company is in the clear. Do not presume you can later claim a technical solution that was "just as good as..."
This is an issue for your lawyer(s) to resolve, not Slashdot.
Here's a couple of Linux Medical Sites (Score:5, Informative)
http://www.euspirit.org/ [euspirit.org]
Re:Here's a couple of Linux Medical Sites (Score:3, Informative)
Read the EULA. (Score:3, Insightful)
Contracts aren't allowed to violate the law. A contract to kill someone isn't legally binding, because murder is illegal. If Microsoft wants to claim they get remote access at will to your boxes, then you get to say "neener neener neener, no you don't, under HIPAA I'm forbidden from allowing you that access".
The proper Microsoft response? "Oh. Well, we're sorry about that. All the other clauses of the EULA stick, though."
So go ahead, get Windows SP3, and then figure out some way to disable remote-root.
Oh, and one more thing--
FOR THE LOVE OF GOD, TALK TO LEGAL COUNSEL. WHY THE FSCK ARE YOU ASKING LEGAL QUESTIONS ON `ASK SLASHDOT', ANYWAY?! DO WE LOOK LIKE HARVARD LAW GRADS?!
(Sorry, just had to get that knee-jerk reaction out of my system.)
Re:Read the EULA. (Score:4, Interesting)
Oh come on, we know why the question was put. It was a snarky little jibe whose only purpose was to claim that HIPPA prevented the use of Windows.
It is kind of like a 'proof' that 1 = 2. We are not meant to agree with the conculsion, we are meant to admire the devious application of logic.
It is quite obvious to anyone but a moron that MSFT is not going to enforce license agreements that prevent sale of their product for use regulated by HIPPA.
It should also be obvious that the EULA term was written very broadly by a lawyer who was attempting to minimize the probability of a lawsuit if someone complained about auto-update or the like.
And it should be completely obvious that Microsoft as a US corporation is obliged to comply with HIPPA. Microsoft is one of the few US companies that actually has a privacy policy and has agreed to be regulated under the EU privacy directive.
The other fact to consider is that the Clinton era HIPPA act has since gbeen gutted by the Bush administration who have issued 'guidance' that essentially negates the whole act. Under the Bush guidelines you lose the right to opt-out. Hospitals can refuse service if you don't waive all your rights to patient confidentiality which they can do in small print. So while the act may require hospitals to install firewalls etc. etc. none of it will make any difference because the hospitals can now sell all your confidential data to the people you least want to have hold of it.
Parent
Remember this? (Score:3, Insightful)
"Nobody ever got sacked for buying IBM"
If you're just worrying about covering your behind, extent to "Nobody ever got sacked for buying Microsoft" and then to "Nobody ever got sacked for clicking through default Microsoft licenses."
I actually think that people should get sacked for doing this if they compromise their business for the sake of avoiding raising a thorny issue, but it's not going to happen in our lifetime.
Don't forget about MSN Messenger (Score:3, Insightful)
Having said that, if either of these two represents your biggest problems, then you're probably safe for a while. I don't understand what you're trying to accomplish by asking Slashdot - maybe you should try checking with your MS rep first to at least get the company line. MS is wild about HIPAA - they produce a lot of BizTalk stuff for hospital EDI needs.
Red herrings R us (Score:3, Insightful)
A few thoughts (Score:3, Informative)
- Your W2k workstations should not be exposed to the outside world. Firewall or NAT them (or both), and remove the WindowsUpdate icons from them and let your IT staff update them manually (or via pushed updates through your domain, if you have one).
- Ideally, the server with your HIPPA stuff on it should be hidden from view as well. Dedicate a server to nothing but HIPPA file serving if you have to. If it's absolutely necessary to access the information from remote locations (i.e., one's outside your lan/wan), consider serving that information up on a web page via an IIS/SQL type of solution of some kind, but with those services running on another server. I'm not sure if HIPPA guidelines provide for this sort of thing, though.
Re:A few thoughts (I agree, but...) (Score:3, Insightful)
I agree with what you are saying, but I feel that these questions need to be asked. Well, they shouldn't need to be asked, because MS shouldn't be doing what they are doing, but I digress.
I work for a very large company and we are implementing HIPAA into our software now. We do all kinds of software for hospitals. The reason I think that this issue needs to be brought up is because most people don't even think about the holes that MS creates. I asked a very similar question to our director of operations a while ago, and he said basically that if the hospitals don't have firewalls, then they have bigger problems. While this may be true, I still think it is good to ask the question, so that people are aware of the "Microsoft issue". The people who maintain the firewall need to know about the autoupdate, so that they can block it at the firewall. They need to know about these vulnerabilitites, so they can plug them. I don't trust that they will be keeping up on these things. After all, who would have thought that the OS you run could create a huge gaping hole in your security and potentially hold you liable for violating federal regulations?
Check Out MSHUG.ORG or HL7 (Score:5, Informative)
They strictly adhere to all governmental regulations for healthcare records including EDI and storing of sensitive medical records.
The medical industry is a huge economic buyer in the hardware and software industry and MS based vendors have always been in strict compliance with government standards.
1. Check to see if your software is HL7(health care 7) HL7 is a protocol for formatting, transmitting and receiving data in a healthcare environment.
2. Ask your vendor how they store the medical rcords, is it hl7 compliant. I think you guys have a homegrown product? IF your product is home grown it does'nt apply to the governmental standard for handling medical data, the EULA is the least of your worries.
3. IF the product is home grown. Cover your ass.
MSHUG is microsoft centric but a good start for you.
I did medical software for ten years and dealt with all these issues long ago. Your vendor should be able to point you in the right direction. BUT IF YOUR SOFTWARE CAME FROM A VAR, DONT ASK HIM, CALL THE ACTUAL HOME COMPANY! The developers will give you more of a straight answer than the var.
PUTO
Watch out for the 'disable' option (Score:5, Interesting)
It does not.
The root of the problem is the agreement that M$ CAN download software on your computer without prior notification. If you agree to that, it really makes no difference if you check a box that tells you machine not to do it. At any time, either pre-programed or by an addition that you make, M$ can uncheck that box without letting you know. Think about it, if you sign a document that states I have the privilage to do something (whatever it is) and then you (outside of that document) simply tell me not to do it, am I legally bound not to do it? It is possible that not even using SUS (software update server) will mitigate this.
Also don't feel secure about non-W2K products either. Most (and soon all, I suspect) products M$ releases contain that same provision. If you have updated MediaPlayer ( I believe it is one with the new verbiage) then you have already given consent for M$ to add software to your machine whenever they choose. NOT Maybe, NOT sometime soon, NOT only if you have W2K, but right now on the box you are currently using. And although I don't have it right infront of me now, I'm pretty sure that mediaplayer even specificly mentions that current features may be removed (playing MP3's) by the unannounced 'upgrades'.
Although we are still evaluating this with our legal staff, it looks very possible that we will be purging M$ products from the vast majority of our network.
oh, DARN ! ;)
And for the record, I am not a lawyer. Don't take this as legal advise. Heck, I could be dead wrong. Localities and Nationalities will obviously differ in their approaches.
Also facing this problem (Score:4, Interesting)
We're in the process of forwarding this off to our legal staff for review, but in IT, we're now giving serious consideration to a conversion to Macs on the desktop (which would still allow compatibility and ease of use while avoiding the problematic issues involved).
Perhaps a lawsuit would be appropriate (Score:5, Insightful)
It seems to me that unacceptable changes to the EULA for a service pack might void the implied warranty usability of Windows 2000. By releasing the service pack, they are admitting that Windows 2000 has problems. If I cannot get access to fixes for those problems without agreeing to a contract substantially different from that which governed my license for Windows 2000, I think that I might have a good basis for a lawsuit to get a court order that Microsoft supply fixes to their software under the terms of the original EULA.
Get More Than Just a Lawyer (Score:5, Informative)
It sounds like you have multiple areas to look at -- your data storage, your data transmission (you aren't just creating those medical records from thin air, are you?), your partner companies, and how you handle the Patient Identifying Health Information on the desktop. Not to mention that your company should have been preparing for this for QUITE some time now.
First, you'll need to make sure that your data storage, transmission and handling (includes handing paper copies around), and desktop security are all compliant. Next you'll find that you are also responsible for making sure that any business partner companies are compliant. This task basically means getting your partner companies to sign "HIPAA Business Partner Agreement" contracts that means the partner company states that they are contractually obligated to handle any patient data of yours in a means that is also HIPAA compliant.
Finally, and most important of all, you'll need to be able to document all of the above, in a form that the government inspectors can easily use to check your compliance. Yay.
Get yer HIPAA-lovin' lawyers on the stick as fast as you can, and file for any extensions that may apply. You will need a complete inventory of any and all computing infrastructure (servers, workstations, network, and software) that touches identifying patient medical data. You will need to have this inventory so your CIO, lawyers, computer security experts and your HIPAA remediation consultants can check the compliance of everything on the list. Anything failing compliance, you'll need to fix or replace.
One last thing: you are also responsible for making sure that the source of your medical data is asking permission to use that medical data, and is asking that permission in a way that is compliant.
I hope this provides you with a decent starting point. Good luck, you have a hard task ahead of you.
Anyone know of and hard rules posted anywhere? (Score:3, Insightful)
Every time I ask Google about this it seems like I end up bouncing back and forth between the same three or four sites never quite finding what I'm after -- kinda like pr0n, but not as fun. So here goes...
Does anyone know of any free/nonfree resources, documents or URLs that list the networking, server and policy encryption and configuration standards required for HIPAA compliance? Consider this from the point of view of a network administrator for a small health services company that buys all of its software from outside vendors (no internal development).
Please don't answer http://hhs.gov. I know about those, and I'm hoping to find a summary or sorts, not the original regs. I'm also aware that the rules themselves are vague and unspecific, and may or may not specifically mention networking and servers hardware software and practices, so I'd appreciate that someone confirm that if it is the case.
Attorney's Take (Score:4, Informative)
Reasonable Assurances... The writer who states that the covered entity need only take reasonable precautions. What is or is not reasonable depends on too many factors. I happen to think that if you disable the feature, that action seems pretty reasonable. I for one, am not worried about the EULA. I'm more worried about things like password protection, access to the file room and the like.
Illegal Contracts... As someone else correctly states, contracts that are contrary to law cannot be enforced (at least the illegal provision).
Covered entites... Chris, who wrote the original message may not need to worry about HIPAA. HIPAA covers mostly medical providers and insurance companies. It also covers self-insured companies and the like, but I don't think it covers loan applications. Of course, Chris could be a business associate of a covered entity.
Business associates... A covered entity must obtain satisfactory assurances from its business associates (accountants, lawyers, billing companies) that the health information is protected. As someone correctly notes, that requires an agreement known as a business associate agreement/contract.
As a side note, I've begun to draft an article about what HIPAA requires... the language in the law actually asks the covered entity to make sure that they have "satisfctory assurances" that the business associate safeguard personal health information ("PHI" although some call it "individually identifiable health information")
Re:What a waste of time (Score:3, Informative)
Additional thouughts:
Use a firewall to block all traffic into and out of your network, and make the machiens inside use proxy servers (for http) and relays (for smtp) to access the internet. In other words, disallow all traffic that is not explicitly permitted. Log what goes through the proxies and relays, and log attempts at initiation of direct outgoing traffic.
Re:What a waste of time (Score:4, Interesting)
Parent
Problem is EULA not SP (Score:5, Insightful)
The problem is not the service pack or the auto-downloader, which can be disabled. The problem is with the EULA itself, where Microsoft reserves for itself the right to access your system at any time. Installing the service pack off-line still requires acceptance of the EULA.
sPh
Parent
Re:Problem is EULA not SP (Score:3, Interesting)
Re:Problem is EULA not SP (Score:5, Interesting)
At our company, we have NDA agreements like you've never seen before. We host legal documents for Law firms that are engaged in battle.
No one. And I mean, NO ONE (other than the law firm), is allowed to see the documents that we host.
The EULA that Microsoft has attached is in absolutely direct violation of our agreements with our clients.
Ergo, we haven't installed SP3 and doubt that we will.
Parent
Re:Problem is EULA not SP (Score:3, Interesting)
Re:What a waste of time (Score:4, Interesting)
Furthermore, disable auto-updating and do it manually and the problem is solved, moot, and done.
This is not a technical issue, disabling Auto-Update is trivial. This is a legal issue, the real problem is by agreeing to the EULA they are giving a third party, who has no due cause, access to thier system. Whether or not Microsoft ever actually accesses thier system is not the point, the point is they have given consent and Microsoft could in theory demand access at anytime, say for example to check for unlicensed copies of software. I suggest you get a lawyer who can sort this out for you, it is also possible, however unlikely, a good lawyer could negotiate a different EULA with Microsoft.
Parent
A Technical Forum??? (Score:5, Insightful)
I'd say that you have a lot to learn about Slashdot. While most of the stories on here are technical in nature or have something to do with technology a large percentage of them have to do with the legal and political issues surrounding something technical.
Think about all the stories on copy protection for CD's. Yes, it has to do with a technical issue, but the discussions are certainly not technical. I've seen no code posted no how to defeat the copy protection. 99% of the posts are opinions about whether it is right for the producers to restrict use of purchased CD's in the way they want to, and the other 1% are First Post!
Why don't you just come out and say it? You are a Microsoft appologist that wants to ignore the issue with their EULA by making fun of the issue and calling it a waste of time. You say it's an invalid clause, but you don't indicate that you are a lawyer (and even if you were I doubt you'd be offering official legal advise). So you want us to just ignore the issue and "agree" to the EULA?
What happens if the EULA is allowed to stand and then Microsoft actually builds in more of this access that you granted them? What happens when it eventually gets installed on all Windows systems and then the crackers find out how to manipulate it and steal information off your computer? Then it wouldn't be Microsoft accessing the sensitive information, as I doubt they actually would do something like that, but because of the EULA they provide additional access methods for others.
There are plenty of valid discussion items surrounding this issue. Ignoring them is not going to make them go away, and they definately fall right smack into the favorite topic on Slashdot -- Microsoft bashing.
Parent
Re:A Technical Forum??? (Score:4, Informative)
Here is the relevant piece from the EULA:
* If you choose to utilize the update features within the OS Product or OS Components, it is necessary to use certain computer system, hardware, and software information to implement the features. By using these features, you explicitly authorize Microsoft or its designated agent to access and utilize the necessary information for updating purposes. Microsoft may use this information solely to improve our products or to provide customized services or technologies to you. Microsoft may disclose this information to others, but not in a form that personally identifies you.
So okay, maybe a lawyer has a different piece of advice on that. But read it. What people are saying does not jive with what the EULA states! All it says is that if you choose to use auto-update MS can access the information on your PC to determine what files to update! Thats it!
Read it!
If you dont choose to use the feature - ie blocking it like I said - then you do not give MS permission to access the PC, and everything is fine!
All I want to do is ignore the stupid shit that people are making up about what the EULA supposedly does.
Parent
How will a firewall help... (Score:4, Insightful)
(Unless, of course, you want to cut off MS's websites from your browsers as well.)
Note that disabling auto-updating is a technical solution that assumes that MS won't ignore that setting for any updates that it consideres to be "really critical", either to your security, or to MS's business needs.
Parent
Re:How will a firewall help... (Score:3, Insightful)
1. Firewall. FIREWALL.
This does not address my point that permitted protocols may be used to do the job.
2. Auto-update uses a service called "BITTS". Disable that. Auto-update offers a way to disable it. IF you dont trust it, shut it off and hitch the box to a packet sniffer. Prove to us and the world that its not actually off. You'd be a hero. But of course that's not going to happen.
I wasn't suggesting that MS was likely to do this. Rather, that they'd be ALLOWED to do this, because you gave them permission when you clicked-through the EULA
3. On a LAN of any size, use SUS from MS to distribute your patches[...]
Yes but you're missing the point. Even if you do that, you've already given MS permission to update through any backdoor mechanism they like.
Re:What a waste of time (Score:3, Interesting)
IANAL, and even if I was this would not be legal advice.
Re:What a waste of time (Score:3, Interesting)
Microsoft has the right to ignore all settings for auto-updating whenever they want.
Of course they can (and will) bundle the DRM-stuff with the next service packs anyway, so sooner or later they will get DRM into all Windows machines.
Re:What a waste of time (Score:4, Insightful)
Ah, but they are preventing users of pirated activation codes and Warez copies of XP from accessing the Windows Update site aren't they? Wouldn't that also preclude gaining access to the DRM "upgrade"?
All of a sudden that Windows XP .ISO and keygen I spotted on P2P seems a lot more appealing... ;)
Parent
Re:Morons, Idiots, and Fools...Oh My! (Score:3, Informative)
If so, I guess I would be a bit slower to call other people "morons & idiots". Because the fundamental problem is in the EULA, not in the service packs or download mechanism. One could take all the steps you have described and (potentially) still be in violation of the privacy statutes, since by agreeing to the EULA you have agreed to allow Microsoft access to your systems under circumstances controlled only by Microsoft.
sPh
Re:Morons, Idiots, and Fools...Oh My! (Score:3, Informative)
That said, I'm almost certain that Win2k, with or without a service pack, will be HIPAA compliant since many, many medical and scientific organizations use it for their main operating system, and coordinating an upgrade to something else in the next 7 months would be near impossible. We really don't have much of a choice in what OS to use, though, since if all the programs we need are only available in Win32 versions, that's what we'll use.
Re:Morons, Idiots, and Fools...Oh My! (Score:3, Insightful)
Re:Time for your company to dump microsoft. (Score:3, Insightful)
Elitist IT Moron: We have decided that Microsoft products are no good, and we're going to switch all of our operations to Linux-based solutions.
Docs: Well, OK, just as long as we can still get our work done. Will we still be able to send our grant applications and other records to the various governmental agencies, other hospitals, and such without and problems?
Elitist IT Moron: Well you'll be using this open source word processing program that is designed to be compatible with Word, but there is a chance that some places won't be able to view it properly, or it will look slightly different. Medical companies aren't sticklers for complete and total accuracy, are they?
Docs: What about these hundreds of legacy DOS and Windows applications that do one thing for us, but do it incredibly well, that we absolutely have to have? Will they still run?
Elitist IT Moron: Umm...No. But there may be 0.85 pre-beta versions of comperable apps up at SourceForge we could try! Or we could maybe try Wine and see if we can get a few of them to work.
Docs: So basically you're telling us that by switching to Linux, we won't be able to properly communicate with the people we need to, and we won't be able to use the applications we need to.
Elitist IT Moron: Uhh....W1nd0ze suxxor?
Re:MS Windows EULA not HIPAA compliant (Score:4, Informative)
It doesn't matter if Windows systems are a monopoly, and everyone has them. They will find everyone they audit to be out of complience. Auditors are looking for a score, they don't give a shit about your ability to do business.
BTW: This EULA aslo is not FDA part 11 compliant either. Locked down systems would need to be revalidated after any and all autoupdates.
Parent
Re:Locked down != autoupdated (Score:3, Interesting)
Perhaps the answer is yes today, but will this always be the case? Remember, because of Microsoft you have a "license" to use the software, you do not own it. I believe there will come day when you will need to pay to continue to use the operating system or it will disable itself. For corporations, it might not be so harsh, but may involve sending billing information to Microsoft to provide a count so they can bill the corporation, a large lump sum.
This kind of activation system will also, I'm sure update the system with at least the keys to run for another year and more than likely many more updates, and it WON'T be optional.
Re:I still think this is all one big troll (Score:3, Interesting)
You don't remember that hue? Neither do I. Yeah, they agreed to pay a 500k "settlement". Big whoop. Your data was "repurposed" and you had no say. Too bad!
sPh