Microsoft technologies. By default, non-HIPAA compliant?

[Anything But Microsoft]

The US health care system is the only industry where best network and
security practices are a federally mandated requirement.

In light of last weeks MS vulnerabilities with no known patches or
usable work around (text only mode in a browser, or security settings
that disable most usage, is not a suitable work around) I have a
question for everyone here with an answer for interpretation.

Are Microsoft technologies by default non-HIPAA compliant in regards to
protecting confidential patient information? If you are a health care
provider and use any Microsoft technology where alternatives exist, such
as for e-mail and web usage, is that exposing your PC/network to
unnecessary risks? (Thereby violating the spirit of HIPAA?)

When security experts en-mass suggest you find alternatives to IE, and
you as an information technology services provider to the health care
industry do not provide these Microsoft alternatives, are you not
providing HIPAA compliant services?

My view is that any health care provider using replaceable Microsoft
technologies is not HIPAA compliant, in regards to privacy or security
of patient data.

Your thoughts and comments?

<duck and cover...>

[Cameron, Thomas]

> -----Original Message-----
> From: Anything But Microsoft [mailto:abm@anythingbutmicrosoft.org]
> Sent: Tuesday, June 29, 2004 9:43 PM
> To: <@securityfocus.com BUGTRAQ
> Cc: secure@microsoft.com
> Subject: Microsoft technologies. By default, non-HIPAA compliant?
>
>
> The US health care system is the only industry where best network and
> security practices are a federally mandated requirement.

Um, no. I work in the banking industry and we are federally regulated and audited for security. I've never worked in the medical industry but I'd be surprised if their requirements are more stringent than ours.

> My view is that any health care provider using replaceable Microsoft
> technologies is not HIPAA compliant, in regards to privacy or security
> of patient data.

I've heard this type of comment about using MS products in banking. It is my understanding (and I am *not* an expert) that if an entity (banking, medical, whatever) reasonably attempts to keep up with security patches, AV updates and the like, that they
are compliant with federal requirements.

IANAL, and I don't work with the compliance team, this is just my understanding through casual conversation.

Thomas Cameron, RHCE, CNE, MCSE, MCT
Assistant Vice President
Linux Design and Engineering
Bank of America
(972) 997-9641

The opinions expressed in this message to not necessarily reflect those of my employer, Bank of America.

[Jeremy Epstein]

I'm no Microsoft apologist, but let's not go off the deep end.

HIPAA has very few direct requirements. A lot of what needs to be done
depends on the environment. For example, if I have a closed environment
with no Internet connections (yes, this happens in some places) and
sufficient controls to protect servers against insiders, then the latest IE
problems are of no concern at all. So saying that ipso facto you're not
HIPAA compliant if you use Microsoft products is clearly wrong.

A slightly less draconian configuration might have a filtering router that
only allows users to visit particular sites; in that case also, the IE
problems would be of no concern (since the redirect to the Russian and
Estonian sites could be prevented). Again, this may not be the average
network configuration, but I suspect these are used in places like call
centers to avoid having people off web surfing. And it's certainly the case
that some libraries limit sites that can be visited, in the (misplaced) aim
of preventing web surfing porno sites.

Some might say that any use of passwords for authentication (as opposed to
something stronger like a SecureID or a biometric) is in violation of the
spirit of HIPAA. But I'd disagree with them too: it's all about looking at
the total risk environment.

The latest set of attacks demonstrate some pretty bad problems, and
Microsoft deserves a lot of criticism. But let's not go overboard.

> -----Original Message-----
> From: Anything But Microsoft [mailto:abm@anythingbutmicrosoft.org]
> Sent: Tuesday, June 29, 2004 10:43 PM
> To: <@securityfocus.com BUGTRAQ
> Cc: secure@microsoft.com
> Subject: Microsoft technologies. By default, non-HIPAA compliant?
>
>
> The US health care system is the only industry where best network and
> security practices are a federally mandated requirement.
>
> In light of last weeks MS vulnerabilities with no known patches or
> usable work around (text only mode in a browser, or security settings
> that disable most usage, is not a suitable work around) I have a
> question for everyone here with an answer for interpretation.
>
> Are Microsoft technologies by default non-HIPAA compliant in
> regards to
> protecting confidential patient information? If you are a health care
> provider and use any Microsoft technology where alternatives
> exist, such
> as for e-mail and web usage, is that exposing your PC/network to
> unnecessary risks? (Thereby violating the spirit of HIPAA?)
>
> When security experts en-mass suggest you find alternatives to IE, and
> you as an information technology services provider to the health care
> industry do not provide these Microsoft alternatives, are you not
> providing HIPAA compliant services?
>
> My view is that any health care provider using replaceable Microsoft
> technologies is not HIPAA compliant, in regards to privacy or security
> of patient data.
>
> Your thoughts and comments?
>
> <duck and cover...>
>
>
>

[Boring, Andrew]

Anything But Microsoft [mailto:abm@anythingbutmicrosoft.org] wrote:

> The US health care system is the only industry where best network and
> security practices are a federally mandated requirement.

Note the word "practices" and NOT the word "products".

Aren't financial institutions (banks, credit bureaus, etc) also subject
to similar requirements?

> In light of last weeks MS vulnerabilities with no known patches or
> usable work around (text only mode in a browser, or security settings
> that disable most usage, is not a suitable work around) I have a
> question for everyone here with an answer for interpretation.
> =20
> Are Microsoft technologies by default non-HIPAA compliant in=20
> regards to
> protecting confidential patient information? If you are a health care
> provider and use any Microsoft technology where alternatives=20
> exist, such
> as for e-mail and web usage, is that exposing your PC/network to
> unnecessary risks? (Thereby violating the spirit of HIPAA?)

Why does email/web access need to be performed from an
patient-information terminal? In other words, if Best Practices (as
opposed to "best products") are mandated and enforced, then web surfing
should NOT be available to anyone dealing with such information. All
internal systems accessing such information would likely be segregated
onto a separate "private" network not accessible to the Internet.
Presumably, there could be "email" and "web" terminals scattered or
concentrated elsewhere for those desiring access.

Unfortunately, this is not "convenient" for normal business operations.
Customer service reps may need web access to look up local doctor's
office address, sales personnel would need email for routine
communication, executives will want their pet video conferencing project
started up again, but the whole business-technology model might have to
be reworked from the ground up.

Other alternatives include developing in-house replacements for common
applications (wanna calculate the cost for that?) or heavy restrictions
on what is available on a patient-information machine (heavily-filtered
company email, no personal email, web access restricted to
b2b/extranet/application sites only, hardware firewalls sprinkled
liberally on every floor in every building between every department
workgroup switch with software firewalls on all machines, etc).

Note these are all "best practices" using best or "not-so-best"
products.

Best practices are also documented, scrutinized, audited, etc, and
change when necessary to accomodate the shifting technological and
social whims of the world.

Best and not-so-best products are purchased, leased or licensed, ideally
according to the audited and enforced Best Practices documents, and
eventually retired from service when they have reached end-of-life.

> My view is that any health care provider using replaceable Microsoft
> technologies is not HIPAA compliant, in regards to privacy or security
> of patient data.

What are the specific regulations? A case can be made either way
(remember, Windows NT did receive C-2 certification in certain
configurations and Mozilla, Eudora, Opera, Pine, "Linux", et al, have
all had their share of occasional security issues - some very serious).
Just because there is a replacement for Microsoft (or Linux or Solaris
or [insert favorite OS here]) doesn't necessarily mean it is more secure
or fits in with mandated Best Practices.

[Dave Paris]

Believe it. Banking is concerned with regulatory requiprements,
Medical/HIPAA is concerned with privacy of data on every level,
appropriate access to data, the ability to access data in an emergency
in a secure, aduitable manner, and all other variations of
complexities. The basic HIPAA electronic security guidelines consist of
mandatory and "addressable" components. How each company addresses the
"addressable" components is open to interpretation. Banking is
stringent, to be sure - but HIPAA takes accountability and privacy to a
whole new level.

Kind Regards,
-dsp

Cameron, Thomas wrote:

>>-----Original Message-----
>>From: Anything But Microsoft [mailto:abm@anythingbutmicrosoft.org]
>>Sent: Tuesday, June 29, 2004 9:43 PM
>>To: <@securityfocus.com BUGTRAQ
>>Cc: secure@microsoft.com
>>Subject: Microsoft technologies. By default, non-HIPAA compliant?
>>
>>
>>The US health care system is the only industry where best network and
>>security practices are a federally mandated requirement.
>>
>>
>
>Um, no. I work in the banking industry and we are federally regulated and audited for security. I've never worked in the medical industry but I'd be surprised if their requirements are more stringent than ours.
>
>
[....]

[Nick FitzGerald]

"Anything But Microsoft" <abm@anythingbutmicrosoft.org> wrote:

<<big snip>>
> My view is that any health care provider using replaceable Microsoft
> technologies is not HIPAA compliant, in regards to privacy or security
> of patient data.

In general I agree with your comments, which should surprise no-one as
I have been advocating for a _very_ long time that it is simply wrong
to allow (far less, "require" as so many "corporate lock-down" desktop
designs/policies do) the use of IE on Internet-connected machines. In
fact, when I started such advocacy, I was widely seen as a bit loony,
or worse. I guess that tells us something about US-CERT -- it's either
a bit loony or very slow to see the light. Guess which I'm picking?

However, for systems with HIPAA concerns, there is an alternative to
not using IE...

Where is it written that machines with access to HIPAA-concerned data
_must_ have access to the Internet? In fact, I'd suggest that any
HIPAA-concerned applications must only be run on machines that never
have direct access to a public sewer of a network such as today's
Internet. The Internet that we have is so far from being adequately
auditable (in HIPAA-like terms) that you would have to ensure that no
HIPAA-concerned data were ever allowed near machines that are able to
access such a network _if_ you were trying to attain HIPAA compliance.

Of course, that position makes MS OSes quite unsuitable as server
platforms for many small-ish to medium-ish sized operations that have
HIPAA exposures because, by sworn admission of senior MS executives in
US court, "IE is part of the OS and cannot be removed", and worse
still, it is an intimate part of the MS-mandated update process for
such machines. Yes, you can get around the direct access requirements
but the nouse and other resources to do that are typically beyond small-
ish to medium-ish sized businesses, and why should they even consider
those approaches when there are much cheaper alternative systems that
do not have such ugly compliance overheads?


--
Nick FitzGerald
Computer Virus Consulting Ltd.
Ph/FAX: +64 3 3529854

[bob@dexis.net]

I must deal with HIPAA everyday.

In support of the claim that Microsoft is not HIPAA compliant, show me ANY Microsoft machine that actually does Healthcare and show me that I cannot recreate a patient from data stored on the computer in cache or other areas.

The machine does NOT have to be connected to anything in order to automatically violate the HIPAA mandate that patient data is secure and that a patient record of other information available on the system can reconstruct a patient record.

If the machine IS connected to anything, including an Intranet or Internet, then it is susceptible to virus and hacking attacks and data can be reconstructed.

Most machines connect to a clearing house via the Internet using a browser.

Clearing houses may include WebMD, ProxyMed, Medifax, and others.

The mere fact that a Microsoft browser is used, leaves the machine and all data vulnerable to attack and retrieval.

Even if certificates, which really are NOT used, are used, they merely encrypt the data to and from the websites, but do nothing to the data in the computer.

Simple forensic programs can retrieve all patient data and doctor records and this does not require a brain surgeon to perform this.

The machines NOT connected to anything are still vulnerable, as users, non-users, janitorial, and others physically in the same location of the PC can turn it on and run forensics against it and retrieve data.

I have tested the Microsoft products and cannot use them and feel secure in that the data is really safe.

I have many competitors out there who do use Microsoft, because they get to market fast. But, they will also CRASH fast too.

Sorry to say that abm may be correct in the statement that Microsoft is not secure.

Sure on the surface they appear to be, but simple hacking will crash the systems and simple hacking will retrieve patient data.

Bob





At 10:43 AM 6/30/2004, Jeremy Epstein wrote:
>I'm no Microsoft apologist, but let's not go off the deep end.
>
>HIPAA has very few direct requirements. A lot of what needs to be done
>depends on the environment. For example, if I have a closed environment
>with no Internet connections (yes, this happens in some places) and
>sufficient controls to protect servers against insiders, then the latest IE
>problems are of no concern at all. So saying that ipso facto you're not
>HIPAA compliant if you use Microsoft products is clearly wrong.
>
>A slightly less draconian configuration might have a filtering router that
>only allows users to visit particular sites; in that case also, the IE
>problems would be of no concern (since the redirect to the Russian and
>Estonian sites could be prevented). Again, this may not be the average
>network configuration, but I suspect these are used in places like call
>centers to avoid having people off web surfing. And it's certainly the case
>that some libraries limit sites that can be visited, in the (misplaced) aim
>of preventing web surfing porno sites.
>
>Some might say that any use of passwords for authentication (as opposed to
>something stronger like a SecureID or a biometric) is in violation of the
>spirit of HIPAA. But I'd disagree with them too: it's all about looking at
>the total risk environment.
>
>The latest set of attacks demonstrate some pretty bad problems, and
>Microsoft deserves a lot of criticism. But let's not go overboard.
>
>> -----Original Message-----
>> From: Anything But Microsoft [mailto:abm@anythingbutmicrosoft.org]
>> Sent: Tuesday, June 29, 2004 10:43 PM
>> To: <@securityfocus.com BUGTRAQ
>> Cc: secure@microsoft.com
>> Subject: Microsoft technologies. By default, non-HIPAA compliant?
>>
>>
>> The US health care system is the only industry where best network and
>> security practices are a federally mandated requirement.
>>
>> In light of last weeks MS vulnerabilities with no known patches or
>> usable work around (text only mode in a browser, or security settings
>> that disable most usage, is not a suitable work around) I have a
>> question for everyone here with an answer for interpretation.
>>
>> Are Microsoft technologies by default non-HIPAA compliant in
>> regards to
>> protecting confidential patient information? If you are a health care
>> provider and use any Microsoft technology where alternatives
>> exist, such
>> as for e-mail and web usage, is that exposing your PC/network to
>> unnecessary risks? (Thereby violating the spirit of HIPAA?)
>>
>> When security experts en-mass suggest you find alternatives to IE, and
>> you as an information technology services provider to the health care
>> industry do not provide these Microsoft alternatives, are you not
>> providing HIPAA compliant services?
>>
>> My view is that any health care provider using replaceable Microsoft
>> technologies is not HIPAA compliant, in regards to privacy or security
>> of patient data.
>>
>> Your thoughts and comments?
>>
>> <duck and cover...>
>>
>>
>>

[Nicholas Weaver]

On Wed, Jun 30, 2004 at 01:43:11PM -0400, Jeremy Epstein composed:
> A slightly less draconian configuration might have a filtering router that
> only allows users to visit particular sites; in that case also, the IE
> problems would be of no concern (since the redirect to the Russian and
> Estonian sites could be prevented).

This would not be the case, as the trojaned sites could easily present
the malware directly, rather than contacting a third party site. That
it didn't is simply a sign that the attacker was less clever and
creative than he could have been. Thus all sites which can be
contacted need to be "trusted".

> The latest set of attacks demonstrate some pretty bad problems, and
> Microsoft deserves a lot of criticism. But let's not go overboard.

A better criticism is that, yeah, QA is important, but this is a known
critical exploit for over a WEEK now and there is no patch in sight.

That the crisis hasn't bloomed further with the simple hack:

Make the malcode modify any .html it can find, and include itself on
that site for download, combined with the continual attacks on IIS
sites, banner servers, etc...

is a mystery to me.

--
Nicholas C. Weaver nweaver@cs.berkeley.edu

[Anything But Microsoft]

Out of all the replies, both on and off-list, I believe this quote is
the best to work with at this point.

>>> "Alun Jones" <alun@texis.com> 7/4/2004 12:05:51 PM >>>
> Whenever you advocate a switch from Microsoft to another platform,
whether
> it's an operating system platform, or merely a browser platform, you
need to
> be providing technical reasons why the new platform is better than
the
> other. Wishy-washy arguments of the kind of "there are lots of bugs
found
> in Microsoft products" /don't/ wash. You have to make arguments of
the kind
> of "this entire class of bugs have been made impossible in the system
I'm
> proposing".

My decision making process as to what I interpret as HIPAA compliant
with my health care customers begins precisely by "providing technical
reasons" regarding an "entire class of bugs." (Please also note that I
understand even my strongest convictions and beliefs are interpreted
differently by others. I welcome all comments) But let's look at this
issue on a more micro level, the view most of us IT guys "in the
trenches" have of the problems we must face daily.

Let's start with an analogy: Microsoft Office is to Macro Virus, as
Anything But Microsoft Office is to Immune To Macro Virus. I have
searched high and low, and have yet to see anything even resembling a
macro virus in any non-Microsoft document format. In fact, I have more
than once deliberately opened Microsoft Macro Virus infected documents
in Corel Word Perfect, Lotus SmartSuite, and OpenOffice without any harm
to the PC or spread of the virus. In most cases the document can be
modified and saved in MS format and the offending MS Macro Virus is no
longer present in the document. So by your own definition, an "entire
class of bugs" is eliminated by never using Microsoft Office. In my 15
years of providing IT services to health care professionals I have yet
to see one instance where a non-Microsoft Office solution does not fit
the needs of my clients both large and small. Therefore, my conclusion
is that installing Microsoft Office on a health care provider's PC under
the circumstances I face disqualifies that PC/Network from HIPAA
compliance regarding system security. The counter argument I look to you
for, is to define a situation where having Microsoft Office installed
instead of an alternative is required to provide health care services.

Are the non-MS alternatives immune to all security issues? No, I never
said that and never will. But as I stated above, we both share a similar
definition of what is HIPAA compliant. Now, please tell me where I went
wrong in the interpretation of our shared methodology using only the MS
Office example above. As much as I would love to now similarly discuss
LookOut and IE, let's move on...

> If you don't make those arguments, then the only argument you're
making is
> to move to a system that the hackers aren't _yet_ as interested in.
That's
> a security by obscurity argument. It may help you survive against
> broadcast, scattershot attacks, that don't care where they're aiming,
but it
> won't help you against an attacker that has chosen to target your
> organisation.

This and other similar statements to the effect of "Microsoft is a big
target, that is why hackers find so many security holes" I not only find
amusing (off topic for here) but I interpret as all the more reason to
avoid MS products while striving for HIPAA compliance. I hate to sound
like my Mother, but "If everyone was jumping off a bridge, would you
jump too?" Think of it this way, does putting your customers in front of
that MS target when alternatives exist meet this criteria? (as quoted
from Adrian Marsden) "You have to be able to show that, within your
environment, you did the best you could to maintain the security and
privacy of the data you hold." In the IT environments I maintain my
actions are based on the meaning of that quote. With any client I first
investigate the feasibility of the client's app running in wine on
Linux. If that fails and the Windows OS is required, I will hide IE
icons and configure the LAN settings to proxy a non-addressable IP
address preventing the use of IE.

If everyone drops using IE in favor of Mozilla, and next year two other
people are having this same conversation about Mozilla's browser,
e-mail, etc. I'll be one of the first to argue that if Mozilla is the
target of choice, it is time to move on. The CCIA's CyberInsecurity
Report, for instance, points more at the dangers of a lack of
'biodiversity' in IT more than MS itself being the problem. And if that
happens, you can address me as AnythingButMozilla.

Lastly: "But the cost of having that feature custom coded is beyond
what most small offices would even consider when MS's 'X' is built right
in..." What part of HIPAA states "But if it is too difficult or costs
too much, just forget the whole thing"?

[Tina Bird]

> Lastly: "But the cost of having that feature custom coded is beyond
> what most small offices would even consider when MS's 'X' is built right
> in..." What part of HIPAA states "But if it is too difficult or costs
> too much, just forget the whole thing"?
>
Actually, that would be embedded in the definition of "addressable"
specifications:

http://www.medical.philips.com/main/.../hipaa_securit
y_rule.html

"To meet these requirements a Covered Entity must implement administrative,
physical and technical security standards. Implementation specifications for
the standards are categorized as being "required" or "addressable".

Required - The implementation of these specifications is mandatory.
Addressable - Covered Entities will need to do one of the following:
Implement one or more of the addressable implementation specifications,
Implement one or more alternate security measure,
Implement a combination of both; or
Decide not to implement either an addressable implementation specification
or an alternate security measure (If it is not reasonable and appropriate,
the entity must either implement another equivalent measure or, if the
standard can be met another way, choose not to implement the specification
or any equivalent specification. The Covered Entity must document the
reasons for its choice.)"

....or in plainer English, if the covered entity is willing to put down on
paper that the proposed security mechanism is unreasonably expensive or
difficult, they don't have to do it. I'm pretty sure that a LOT of
healthcare organizations are going to claim that switching to a browser that
is >not< embedded in their desktop-operating-system-of-choice is
prohibitively expensive, and they'll get away with it for at least a while.

ie., the final version of the Security Rule, released in April 2003, is more
of a guideline than a rule. In the best pirate spirit.

cheers, tbird