Restricting Access

While having appropriate security software is important, computers may still be susceptible to unauthorized access. As such, a provider should consider if the computers are private or accessible to others. This consideration is important for those who share the technology with colleagues, or allow their children or other family members to utilize them for entertainment purposes. Even if the computer system has powerful hardware, others can impair it by downloading unnecessary programs, or place it at risk by inadvertently downloading malware. As such, it is suggested that the computers used for videoconferencing be restricted as best as possible, and not used for general internet “surfing,” to play games, or for other activities that are not professional in nature. It is also suggested that the computers are placed in locked areas to ensure physical safeguards.

For providers or patients who cannot physically restrict the computers, but still want to ensure the highest level of security and conformity with HI PA A, they can implement system-based features that limit access of the computer system to only authorized users. First, passwords can be required to log into the computer system itself (e.g., general password login to gain access to the desktop screen), and potentially implemented for individual programs. Password protection can be activated from most OS systems settings, including general password settings, in addition to the increasingly available parental lock programs. While predominantly intended to restrict child access, the parental locks can serve the same functions regardless of age, including restricting access without the primary user’s password to unlock the features. Further, such programs can inform the primary user of others’ activity and attempts to access aspects of the system that they have been restricted from. Should a provider or patient desire more specific, adaptable, or secure settings to suit their needs, third-party accessibility programs can be utilized.

To supplement passwords, the provider should consider the use of encryption programs of at least 128-bit or higher. Encryption programs can be used to encrypt specific files or folders, or entire disks (e.g., hard drives), meaning that one would need the “key” to decrypt the information (see Chapter 4 for more information on encryption). In doing so, even if a user gains access to the physical system, and can log in to the computer, they would still need to decrypt the system or file information with (ideally) a different password than what was used to log in before they are able to reasonable view or access the encrypted information. For a list of encryption programs for different types of data, please see Table 4.5.