Computers

Security Software for Hand-Held Computers

Protecting the patient information stored on your PDA isn't just a good idea; it could be required under HIPAA.

K. Meg Morrison, MD

Covered in FPM Quiz

What five-letter acronym currently strikes terror in physicians' hearts? If you guessed HIPAA, the Health Insurance Portability and Accountability Act of 1996, you're correct. The very name evokes images of trying to see patients while carrying a HIPAA hippo on your back. Among other things, HIPAA requires that all health care organizations take specific physical, procedural and technological security measures to ensure the confidentiality of patients' medical information. If you own a personal digital assistant (PDA) and have downloaded medical software programs that contain patient-identifiable health data, you will be required to keep this information secure once the HIPAA privacy and security rules take effect. (The deadline for meeting the privacy regulations is April 2003; the security regulations haven't been issued yet.)

How can you protect the patient information and other private information you have stored on your PDA? Here are some options.

Built-in PDA security features

Most PDAs come with a built-in locking feature. PDAs that use either the Palm or Pocket PC operating systems have something called a "Lock & Turn Off" password protection feature, but it has two distinct disadvantages. First, it is difficult to locate, and, second, you must remember to activate it each time you turn off your PDA. If you have a PDA with a Palm platform, you'll find this feature under "Security" on the main menu. Selecting the Security icon brings up a screen (see figure 1) that will allow you to assign a password and lock the PDA to prevent further use. Re-entering the password unlocks it. The feature works the same way on the Pocket PC and can be found by selecting "Settings" on the main menu, then "Personal," and finally "Password." Some PDAs also come with an automatic locking feature enabling users to preset times they want to lock the PDA (see figure 2). This is a nice upgrade, preventing users from having to remember to activate the lock-out feature each time they turn off the PDA.

Figure 1

Figure 2

Shoring up your security

It's not that difficult to circumvent the built-in security feature on most PDAs. In fact, programs exist specifically to bypass this function. To boost PDA security, a host of new software programs have been designed (see "Security software programs"). These programs offer added security features, such as enabling users to preserve their password during soft resets and preventing transfer of information (by synchronizing or "beaming") to another computer during the lock-out times. PDAs with Palm operating systems prior to version 4.0 contained debugging shortcuts for software development purposes. Since these shortcuts work even when the PDA is locked, they can be used to breach the locking feature. Some security programs on the market will check for debugging shortcuts and delete them. Some of the security programs also feature limited password attempts. If the maximum number of attempts allowed is exceeded, the PDA will then permanently lock itself or delete all the information stored in it.

Even with these extra security software features, patient information stored in your PDA still isn't completely safe. Someone could still take apart your PDA to get to the information stored in its memory chip. Granted, the average thief couldn't do this, but that's not much comfort to people who want their medical information protected from even the most unlikely events.

Securing the information stored in memory chips requires encrypting it. In addition to encoding the memory chip, encryption also provides password protection for specific files and data. Encryption comes in a variety of types and bit sizes. The higher the bit size, the more secure the encryption and, usually, the more expensive the product. Typically, encryption software that uses higher bit sizes will also use more active memory and process more slowly. Some encryption programs also feature "transparent" encryption; use of the correct password automatically encrypts each data record when it is stored and decrypts it when accessed.

Complying with HIPAA

The HIPAA privacy and security regulations do not specifically identify what measures will need to be taken to protect patient-identifiable health information stored or transmitted on PDAs. But protecting this information from breaches of privacy will probably require more than the built-in security features that come installed on most PDAs.

If you're serious about patient privacy, choose security software that incorporates password protection and data encryption. As physicians, we have always honored patient confidentiality. Regulations aside, adding a little extra security to your PDA is just another way to show respect for that long-held value.

Dr. Morrison is a family physician and associate director of the Mount Carmel Family Practice Residency in Columbus, Ohio. She is also author and webmaster of The Family Physician's Guide to Handheld Computer Software (www.fphandheld.com). Conflicts of interest: none reported.