Digital Device Security at the School of Medicine
The School of Medicine is dedicated to encrypting all Stanford-owned computers used by Stanford employees who work at the school, and to encrypting all Stanford-owned or personally-owned computers and mobile devices used by Stanford employees and affiliates who work with High Risk Data (previously Restricted or Prohibited Data). (As of May 31, 2015, all computers on the Stanford network should be encrypted as well.)
FAQs Frequently Asked Questions
Data Security at the School of Medicine
The University Data Security Policy requires BigFix, Stanford's computer and security management tool, on all laptops and desktops used for School of Medicine business that can store or access High Risk (previously Restricted or Prohibited) data. This includes Stanford-owned and personally-owned laptops and computers and VM machines.
The policy also requires enterprise encryption of all computers used by University personnel for Stanford business. Encryption was required by February 28, 2014 for all Stanford-owned and personally-owned laptops and desktops that can store or access Restricted or Prohibited Data. The deadline to encrypt laptops and desktops used by individuals who do not access High Risk Data is May 31, 2015.
All faculty, staff, students, residents and fellows are required to complete an attestation process declaring their access to PHI and other High Risk data and that their computers and mobile devices are compliant with this policy.
Mobile Device Management technology (MDM) automatically enables encryption and strong password protection on mobile devices as well as supporting the ability to remotely erase a device if it is lost or stolen. Given the particular risk of loss or theft of smartphones and tablet computers, and the requirement to investigate each loss when the device is not encrypted, the School of Medicine requires that MDM be installed on all Stanford-owned and personally-owned devices that can store or access Stanford data.
Stanford provides MDM for iPhones and iPads, and for Android (OS version 4.0 and above, only) devices. If MDM is not available for a device, it must not be used to store or access Protected Health Information (PHI) or other High Risk Data.
Windows XP devices should be replaced or upgraded. Windows XP is an operating system that has reached end-of-life, and no support or updates have been available since April 8, 2014. This means that security patches are no longer available and any devices running this operating system pose a risk to your data and to other devices on the network.Exceptions to this requirement are devices that manage specialized research applications or equipment that either cannot support an upgraded system or are prohibitively expensive to do so. The School of Medicine has developed a more secure network to safeguard these specialized resources. If you need to maintain an XP device on the network (or have any other devices that cannot meet the data security requirements but are needed to support specific research equipment or applications), please submit an exception request at https://med.stanford.edu/datasecurity/exceptions/
Compliance with the policy requires the following actions:
All SoM Community Members
1. Everyone at the medical school will be asked to complete a Data & Device Attestation to identify whether you are exposed to High Risk (previously Restricted or Prohibited) Data and if so, the kinds of devices you use. Please only report the Stanford-owned and personally-owned devices that you use for Stanford business. You do not need to report devices owned by SHC or LPCH.
2. All iPhones, iPads, and Android (OS 4.0 and above) devices that can store or access Stanford data must be configured with the Mobile Device Management technology. See: MDM Installation information »
All SoM devices enrolled in MDM must have a Restricted MDM profile, and not a Basic profile. If you currently have a Basic profile set up for a device, the only way to get a Restricted profile is to unenroll and re-enroll the device.
3. BigFix, Stanford's computer and security management tool, must be installed on all laptops and desktops used for School of Medicine that are used to store or access High Risk (previously Restricted or Prohibited) Data. This includes Stanford-owned and personally-owned laptops and desktops as well as VM machines. For users who do not access High Risk Data, BigFix is recommended but not required. See: BigFix Installation guide »
4. Everyone with BigFix must complete a Device Identification Survey to identify the specific computers you use for Stanford business. This survey will be delivered to you via a BigFix pop-up screen on each of your computers.
Stanford employees who work at the School of Medicine
5. All computers and laptops used by Stanford employees for school business must be verifiably encrypted. This can be done by using the SWDE (Stanford Whole Disk Encryption) installer, which does include BigFix. Only individuals who do NOT access High Risk data will be able to use the new encryption tool called VLRE. Although using BigFix to report on encryption status is still recommended, VLRE will not include BigFix and instead will provide an alternate agent to verify encryption.
People who work with High Risk Data
6. All laptops and desktops (whether Stanford- or personally-owned) that may be used to interact with High Risk (previously Restricted or Prohibited) Data must be SWDE-encrypted. This includes all computers used to access EPIC at either Stanford Health Care or Stanford Childrens Health. See: Installation FAQs »
To support the encryption of devices which may contain or access High Risk Data, the School of Medicine provides multiple options for getting help. You can make use of the self-service materials on this site, your local IT support personnel, or the IRT Service Desk at 650-725-8000 or at our drop-in location in the Alway Building, room M108. See: Drop-in Location »
Data security is a critical priority for the School of Medicine and Stanford University. Stanford University policy requires that all computers and devices used for Stanford business on the Stanford network must be verifiably encrypted. Devices which may access High Risk Data must all be verifiably encrypted (using SWDE or MDM), even if they aren't used on the Stanford network.
Although is it is possible to access EPIC and other tools through secure portals, a computer that is owned by an individual or by Stanford that is used regularly for Stanford work has a high likelihood of storing Stanford's High Risk data, either now or in the future, and the potential consequences are severe, should that data ever be compromised. It is very common for an individual computer user to not be fully aware of all the data that is stored, even temporarily, on their devices, but such data can be discovered upon investigation. The University has therefore established this policy to protect patients; the Institution; and individual faculty, students and staff.
Data Backup Overview
No. While we recommend and encourage frequent and secure file backups, the former active requirement to utilize a managed backup system was suspended. The School of Medicine still provides—at no cost—a centrally-managed CrashPlan backup system to safeguard the data for School of Medicine affiliates who wish to use it.
The School of Medicine has created a tool called AMIE ("Am I Encrypted?") that will allow you to understand your compliance with the School of Medicine data security policies. The tool displays the information you supplied in your attestation and the BigFix, backup and encryption status of each of your computers. It also provides instructions to take actions to correct any issues that are detected. Please note that for a computer to report its status correctly, BigFix must be functioning properly and you will need to have completed the Device Identification Survey, which will appear as a BigFix popup on that machine. Please visit this site to see your current status: https://amie.stanford.edu
Yes. The School of Medicine's data backup system is encrypted, properly secured, and monitored in a School of Medicine Data Center facility. The data can only be accessed by authorized IT staff.
Installing Backup and Encryption
For most individuals at the school, these services can be deployed automatically to your computer via the BigFix management tool. Some installations may require the additional assistance of an IT staff person. See: BigFix Guide »
To support the encryption of devices which may contain or access High Risk (previously Restricted or Prohibited) Data, the School of Medicine provides multiple options for getting help. You can make use of the self-service materials on this site, your local IT support personnel, IRT Service Desk staff at 650-725-8000, or visit us at our drop-in location in the Alway Building, room M108. See: Drop-in Location »
See: Mac Self-Install Instructions
See: PC Self-Install Instructions
The school's automated process leverages the BigFix patch management software to seamlessly handle the complexity of each step of the installation.
1. Data Backup - On each computer with the BigFix software installed, you will receive a pop-up window alerting you that the process to back up your computer is about to begin. You will be able to defer the backup process for a period of time until you are ready to proceed.
During the actual backup, you can use the computer normally. A message will appear letting you know when it is complete. Expected times vary from hours to days.
Note: If you have personal information stored on a computer that you do not want to have backed up, you have two options for excluding this data from the backup process. For more info, see FAQ on data backup.
2. Disk Health Check - Once backup is complete, a series of tests will be run on your hard drive to be sure it is ready for encryption. This check will look for problems with your disk and data using diagnostic tools available natively within the operating system of your machine. This step can take anywhere from 15 minutes to several hours to complete and you may notice some degradation of performance while it is running.
If a problem is found the encryption step will not proceed. An IT specialist will contact you to assist with any required repairs.
3. Encryption - Following the completion of your computer's backup, you will receive another BigFix window alerting you that the process to encrypt your computer is about to begin. Once again, you will have the option to defer this process for a period of time until you are ready.
You may use your computer normally during the encryption process. If you shut down your computer or it enters "sleep" mode, the encryption will resume when your computer becomes active again.
To finish the encryption process, you will be prompted to restart the computer.
Note: You may notice some slowness during the encryption process. Once completed, most people report no perceptible difference in computer performance.
For more info, see FAQs on encryption.
The School of Medicine has created a tool called AMIE ("Am I Encrypted?") that will allow you to understand your compliance with the School of Medicine data security policies. The tool displays the information you supplied in your attestation and the BigFix, backup and encryption status of each of your computers. It also provides instructions to take actions to correct any issues that are detected. Please note that for a computer to report its status correctly, BigFix must be functioning properly and you will need to have completed the Device Identification Survey, which will appear as a BigFix popup on that machine. Please visit this site to see your current status: https://med.stanford.edu/datasecurity/amie/
BigFix Patch Management
The BigFix security management tool is a small software program that enables the enterprise management of software updates and provides a central mechanism for auditing compliance with School of Medicine policies. This is critical since a wide variety of data is used at the School of Medicine that carry legal requirements for rigorous protections and the consequences of not being able to definitively prove that protections are in place can have severe consequences. In the case of Protected Health Information, for example, HIPAA requires that proof of encryption be provided in the event a computer is lost or stolen. BigFix can provide such proof.
To support the need for auditing and rigorous data management, School of Medicine policy mandates the installation of BigFix on all laptop, desktop computers and VM machines used for Stanford business used by individuals who may access Restricted or Prohibited data. This includes both Stanford-owned and personally-owned computers that may store Stanford data.
BigFix will have no measurable impact on the performance of your computer.
More information on BigFix can be found on the ITS BigFix service page.
BigFix must be installed on all laptops and desktops used at the School of Medicine used to store access High Risk (previously Restricted or Prohibited Data). This includes Stanford-owned computers and personally-owned computers. If you use a Stanford or personally owned device to access the hospitals' Epic and Cerner systems, it is subject to the University Data Security policy and must have the required security suite. BigFix, however, should not be installed on computers owned by SHC or LPCH. See: BigFix Installation guide »
You can easily verify whether BigFix is installed on your computer by looking for the BigFix icon. On Windows, the icon will appear in the Windows task tray. On Mac, the icon will appear in the top nav bar.
There may be times when the BigFix icon may not appear on your computer though the software is installed. In these cases you can also verify installation by looking in your computer's Applications folder.
For MACS
- On your hard drive, navigate to Applications > Utilities > Activity Monitor.
- Be sure that All Processes is selected at the top of the window, sort by "Process Name", and look for the BESAgent (BigFix Enterprise Suite agent) in the list of processes.
- If you don't see the BESAgent listed, please install BigFix.
For PCS
- Open the Windows Task Manager by pressing CTRL + ALT + DELETE and clicking the Task Manager button.
-
Click the Processes tab and look for BESClient.exe in the list of processes.
Note: If you are using Windows 7 or Windows Vista, click Show processes from all users.
- If you don't see BESClient.exe listed, please proceed to Install BigFix.
If you do not have BigFix installed, you can install it yourself by visiting the BigFix Installation page. You can also get assistance by contacting IRT Help at 725-8000.
Computer Encryption Overview
Encryption is a technique that makes data technically inaccessible to those without valid permissions. University policy requires that all computers and devices used by Stanford employees for Stanford business must be verifiably encrypted. As a step toward encrypting all devices, all newly purchased computers at the School of Medicine must be encrypted using SWDE or the soon-to-be-released VLRE.
University policy also requires that all devices used by individuals with access to High Risk Data must be SWDE-encrypted. This includes not only Stanford-owned computers but also personally-owned and mobile devices that are attested to by these individuals. Using High Risk Data comes with personal accountability, so encrypting your data provides protection for both you and the University in the unfortunate event that your device is lost or stolen. While central backup up to the School of Medicine CrashPlan server is not a requirement, it is highly recommended for the protection and recovery of your data after such an event.
The School of Medicine tool AMIE ("Am I Encrypted?") will allow you to view your compliance with the School of Medicine data security policies. The page displays the information you supplied in your attestation and the BigFix, backup and encryption status of all the devices you attested to as being used for Stanford work. It also provides instructions to take actions to correct any issues that are detected. Please note that for a computer to report its status correctly, BigFix must be functioning properly and you will need to have completed the Device Identification Survey, which will appear as a BigFix popup on that machine. Please visit this site to see your current status: https://med.stanford.edu/datasecurity/amie/
No. Passwords are an important part of computing security, but passwords alone are insufficient. It is far too easy for someone to bypass a password.
Mobile Encryption Overview
MDM is a set of configuration and management tools for mobile devices that automatically enable encryption and strong password protection. It also supports the ability to remotely erase a device if it is lost or stolen.
Given the particular risk of loss or theft of smartphones and tablet computers, and the requirement to investigate each loss when the device is not encrypted, the School of Medicine requires that MDM be installed on all Stanford-owned and personally-owned devices used by individuals who can access Restricted or Prohibited Data for Stanford work.
All SoM devices with MDM must have a Restricted MDM profile, and not a Basic profile, regardless of whether you work with High Risk data or not. If you currently have a Basic profile set up for a device, the only way to get a Restricted profile is to unenroll and re-enroll the device.
Currently the University has an available MDM solution for iOS devices and Android devices with OS 4.0 and later. Devices that cannot be enrolled in MDM should not be used for Stanford work by individuals who attest Yes to working with High Risk (previously Restricted or Prohibited) data.
Any smartphone or tablet that might store Stanford data must have MDM installed.
Directions for installing MDM on iOS devices and Android devices with OS 4.0 or later are available on this site. Any device that cannot be enrolled in MDM must not be used to store or access High Risk data (including in email.)
