Re: Laptop encryption- Follow-up

[David Clift <David.Clift () UTAH EDU>]

We are requiring all Health Sciences / University of Utah Health Care staff, faculty, and students to have their 
laptops and USB flash drives encrypted.  The above individuals must certify through an online survey that their devices 
have been encrypted.  They can also opt out of encrypting their devices if they certify that they do not and will not 
store PHI on their devices.  However, everyone has been notified that they will not be indemnified by the University in 
the case of a lawsuit if they are found to have unencrypted PHI:

"Once the certification process is complete, maintaining protected health information regarding a patient or research 
participant on an unencrypted laptop computer, or on an unencrypted USB thumb drive, will be outside of the course and 
scope of University employment, and the University of Utah will not indemnify those employees in the case of a lawsuit. 
Additionally, all costs associated with a data breach will be borne by the individual. This includes the cost of 
notifying and taking calls from impacted patients."

We also have plans to use DLP software, but it is not yet in place.

David Clift
University of Utah
Information Security and Privacy Office
650 Komas Drive, Suite 102
Salt Lake City, UT 84108

Office: 801.587.6198
Fax: 801.587.9443
David.Clift () utah edu


-----Original Message-----
From: The EDUCAUSE Security Constituent Group Listserv [mailto:SECURITY () LISTSERV EDUCAUSE EDU] On Behalf Of Patria, 
Patricia
Sent: Tuesday, November 16, 2010 10:00 AM
To: SECURITY () LISTSERV EDUCAUSE EDU
Subject: Re: [SECURITY] Laptop encryption- Follow-up

For those that responded to the encryption thread noting that you are using Whole Disk Encryption for portable devices, 
would you mind sharing which group this applies to? Is it just your staff members? Or faculty as well?

We are in the process of rolling out Bitlocker whole disk encryption to all staff with laptops, but are planning to 
allow faculty to opt out of Bitlocker if they sign a waiver stating that they do not store sensitive data on their 
laptop per our Data Classification Policy. Is anyone doing something similar?

> From a breach standpoint, if the individual signs a waiver and states that they do not have any sensitive information 
> on their computer, do you employ other controls like Identity Finder or DLP software to ensure that is the case? Or is 
> their signed waiver enough?

Any feedback, or examples of how you address lost/stolen devices from a breach standpoint, is appreciated. Thank you. 

Patty


Patty Patria
Bentley University