In recent years, many of our clients on the Lone Star VPACS Teleradiology Network^® have requested information on security for personal computers.

Many radiologists and referring physicians have upgraded personal computers at home or in their offices used for accessing studies and possibly performing reads for after-hours or holidays studies. Many of these doctors also have other users or family members who use the same computer to surf the web and use email when the doctor is away. These doctors are challenged to comply with HIPAA security requirements and keep their system in good working order.

We live in an age where 15-year-olds can hack into the computer system at Fort Knox. We must accept the fact that any security system can be compromised by the right hacker or the right user making critical mistakes. Most of us do not have the resources to erect and maintain perfect security, if there was such a thing. Instead, the best we can hope to achieve is that we are low-profile targets where it is simply too inconvenient for hackers to focus on access to our systems. To prevent user mistakes, there are a number of options to employ.

RECOMMENDED SECURITY STEPS

1. Personal Firewalls

A firewall is software that limits the type of communications that can be sent or received from a computer or network. Even if you are operating behind a group firewall, we recommend the installation of a separate firewall on each computer in your house or office. Group firewalls can be compromised.

There are many good choices, but we use the free version of Zone Alarm:
Zone Alarm

This software closes all communication to or from your computer unless you explicitly allow it. It is a user-friendly product that uses program names instead of port numbers.

In the first few days, you will need to train the software for your most frequently used programs. For example, if you use Microsoft Outlook as your email client, the firewall will ask you if you want to allow Outlook to access the Internet. If you answer Yes and check the Remember This Selection box, the question will not be asked again. You can always remove these permissions later if you decide not to allow it access.

Simply put, if you don’t know what the program is, don’t allow it to communicate.

2. Virus Detection

In today’s world, protection from viruses is a must. Virus detection programs download a database of all known viruses and use this information to prevent infection. 

Any files sent from or received by your computer are checked for viruses. The program also scans all files on your hard drive(s) on a regular basis to scrub any viruses from your system.

AVG Anti-Virus

The Virusscan program can be downloaded and installed from the Internet at no charge. Be sure that any firewall settings allow the Virusscan program to automatically update from the Internet. Your hard drives should be scanned at least every 4-5 days and can be set to scan at night when the system is not in use.

3.  Spyware Protection

Spyware programs can be installed on your computer from web pages, emails or installation of other programs. In their less dangerous forms, these programs gather and transmit data about your computer usage. Of greater concern are the spyware programs that provide access to other programs capable of allowing remote access or destroying system data.

Microsoft has released a series of articles about spyware with good information:

Spyware and Deceptive Software

Spyware detection programs also use database updates to scan incoming files and your hard drive(s) to detect and scrub any software that transmits data without your permission. We us a program called Microsoft Windows Antispyware. We do not recommend the use of any free spyware detection programs.

Microsoft Windows Defender

AntiSpyware updates its database regularly and can be updated manually. Scans will begin automatically when the computer starts and can be started manually. We scan all systems at least once every 10-14 days.

4.  Configuration Freezing

Freeze software can record your computer’s configuration. Any changes, including installed programs, viruses, accidental deletions, and so on, are automatically gone when the computer is re-started. Using this software, you simply take a snapshot of your computer by freezing it, then you get that snapshot back every time you re-start. This software is highly recommended for computers that are used by multiple users, especially children.  

To implement, segment your hard drive into a C:\ drive for programs and a D:\ drive for data that changes regularly. Then freeze the C:\ drive.

The freeze software we use is the Deep Freeze Home Edition from Fartronics:

DeepFreeze

Installation of any new programs will require that you unfreeze the computer, install the software, then freeze the system again. The unfreeze operation is password protected.

5.  Back Up Your Data

Hard drives crash. Registries become corrupt. All manner of occurrences can combine to cause the loss of your important data files. It is important to have your data available in two separate locations in the event that one location fails. For critical data, it is important to have data in two separate physical locations to guard against disasters, such as flood or fire.

We use BackUp for Workgroups:
BackUP

Many backup software systems are good, but BackUp for Workgroups provides a user-friendly interface that allows data to be compressed to save drive space and encrypted to prevent unauthorized access. It also allows data to be burned to CD or DVD for off-site storage.

6.  Use Password Access Control

All Windows systems allow password access control. This access control also allows each user to be assigned to a user group, such as Users, Power Users or Administrators. Different groups have different privileges. For example, only Administrators can install software.

A good article on setting password protection is found below:
Article

For users with children, each user should have their own password. Children and less advanced users should be in the Users group.

7.  Use a Password Protected Screen Saver

We do not recommend screen saver software that is not a part of your operating system. Third-party screen saver software can contain spyware and can pose conflicts with other software on your system. If you feel the need to decorate, do it somewhere else.

On a Windows system, right-click on an open area of your desktop and select Properties. Select the Screen Saver tab, select a screen saver, set the wait timeout period to 15 minutes and check the Password Protected checkbox. Hit OK to close the dialogue box.

Please also note that HIPAA security requires user access control via password and also requires that a password protected screen saver be set to engaged after 15 minutes of inactivity. If you have patient data on your computer, we recommend you comply with these requirements.

SECURITY ERRORS TO AVOID

A number of steps can be taken to prevent the compromise of your security once it is in place. Here is a brief list of thinks to avoid at all cost.

1.  Never Download Free Programs

Unless you are well familiar with the software, downloading free programs from the Internet is a major source of computer infection. Known software, such as WinZip, or trial software from reputable manufactures can usually be installed without concern.

If someone has taken the time to develop, test and make software available for download, they seldom do it for nothing. If they are not hoping you will purchase software in the immediate future, they often offset their costs by adding hidden programs, such as spyware or shopping programs.

In one recent mistake, a free software download and install contained 16 hidden programs that required a computer expert over 4 hours to remove from the system. You will find the reasonable price of purchased software to be much cheaper than the cost of computer experts or system rebuilds.

2.  Never Open Unknown Email Attachments

While most email is safe to open, attachments can be program installations that install spyware, remote access programs, send infected emails and start many other malicious actions that may compromise your system integrity. Files with the suffix .vbs or .exe are especially dangerous.

The rule to use is simple: If you don’t know what it is, don’t open it and don’t forward it to someone else.

If MS Word documents are attached from an unknown source, open them with Wordpad (Start --> Run --> Wordpad). MS Word documents can contain macros that could damage your system. Wordpad does not allow macros to run. 

3.  Never Use Automatic Software Updates

The latest rage among software suppliers is automatic software updates. Companies like Symantec and Microsoft install a separate program on your computer which checks for new updates and patches for your software and automatically downloads and installs them.

While the concept is good, the results produce a major security problem. Any program designed to automatically install software can be hacked and compromised. Instead, download updates directly from the manufacturer’s web site. The site for Microsoft updates, for example, is shown below:

Microsoft Download Center

There is no problem allowing the update software to search for updates and alert you that updates are required, as long as you can prevent it from downloading and installing automatically. Use your firewall to control what the software can and cannot do.

The exception to this rule is virus or spyware detection software. For these systems, the degree of protection you receive is directly related to the concurrency of the database on your computer. In other words, your protection software cannot stop a threat it does not recognize from the local database. You must allow this software to download updates as soon as they are available from the supplier.

4.  Never Install Software Updates Attached to Email

Software suppliers do not supply upgrades as attachments to emails due to the high security risk. Any email you receive suggesting that you open an attachment to install a software upgrade is not from the original supplier. Please read the Microsoft advisory on email upgrades by clicking on the link below.

Microsoft Software Distribution Policies

5.  Never Install Wireless Networking without Expert Assistance

In the hands of trained networking experts, wireless technology can be installed with proper authentication and encryption that protects your network. Without these safeguards, users outside your network can access your network, use your Internet connection in ways that may not be safe, and possibly access information on your computers.

Although wireless connections are convenient, they pose a major security risk. If expert assistance is not available for installation, we suggest you use only hard-wired connections. 

One single source for all your teleradiology needs. Contact us today.