# Is it okay for our IT support contractor to remote in without authorization?

We are a healthcare IT company. My machine has PHI on it. Our IT contractor verbally asked if he could remote in to fix my printer so I said sure. I expected some sort of prompt to allow it but he was just in. Some form of VNC I guess.

Is this okay? In regards to HIPAA?

• What might be highly questionable is the track log of what accesses and changes were performed on your computer. Just ask this log to check if you are HIPAA compliant. – dan May 10 '16 at 15:15
• I have no idea about HIPAA requirements, but note that the presumption of your question title "remote in without authorization" is not met: You did give him authorization verbally. – Hagen von Eitzen May 10 '16 at 19:44
• That's a bit pedantic. I could rename the question Is it okay for our IT support contractor to have the ability to remote in without authorization? – JOATMON May 10 '16 at 21:22
• Take note that just because you didn't personally authorize this person doesn't mean he wasn't authorized. He may have still been prompted to entered credentials in on his end as the authorization code for your PC - In other words, just because you didn't get a popup doesn't mean he didn't. – Numeron May 10 '16 at 23:37
• Numeron is right! As the question stands it implies what you want to believe. If the data on your PC is not in your ownership, someone else has the ability to give authorization, if the IT-Guy has a formal authorization to access your computer and gets a verbal authorization from you, that means he has authorized access. Your question should be "Is it ok if our IT support contractor has the ability to remote in without my confirmation" – Falco May 11 '16 at 9:52

HIPAA does not get to specifics of policy, the substance of it is that organization have to have sufficient controls in place to protect data. There's nothing inherently wrong with an unprompted takeover from a HIPAA perspective, as long as other controls (authentication, authorization, access control lists, access logging and auditing, antimalware on the support PC, legal agreements in place between the support organization and your organization, etc) are in place.

So without knowing what your organization has in the way of IT security policies, processes and procedures there's no way to tell.

As for whether unprompted take-overs are a good thing then no, they are not. You really want to have a warning when someone is taking over your PC for support, or even looking at your screen.

• I disagree with your closing statement. The IT contractor verbally confirmed before taking over. Also, if the contractor needs to get into the PC while the user is away then who will click "accept" when the prompt comes up? Unless of course you meant "just a warning" with no prompt nor confirmation. – MonkeyZeus May 9 '16 at 17:39
• @MonkeyZeus He did ask, but the fact that there was no prompt means he didn't have to ask. That's the scary part in my books. What if he chose not to ask? I'd have no way of knowing I was being monitored, much less that I may not be the only person with control. – corsiKa May 9 '16 at 17:57
• @corsiKa OP does not own the computer and should always be working as if they are being monitored, especially in the health field. If OP feels that his/her rights have been violated then they should bring it up with upper-management since they will have the final say in terms of what is allowed in their company or not. – MonkeyZeus May 9 '16 at 18:06
• @MonkeyZeus Sure, you should always be operating as if you're being monitored. However, when OP is at the computer, OP is responsible for the actions that take place on it. If someone else can act, that is a problem and OP needs to be aware that someone else may be entering data. – corsiKa May 9 '16 at 18:14
• @ToddWilcox: again, I think it depends on the surrounding process/policy/contracts. A contractor can "work for the entity that owns the computer", despite not being a permanent employee, because they still have a responsibility (potentially a fiduciary responsibility) to their client. I don't know whether HIPAA says anything about janitorial staff, but in the general run of business you can contract out cleaning and give the contractors keys. You just have to make sure the diligence is in place that would be there if it was in-house. – Steve Jessop May 9 '16 at 19:24

You haven't actually provided enough details to say one way or the other. The fact that you didn't see an authentication prompt doesn't preclude there from being one.

The remote access tools I use in my job (which also deals with HIPAA) both require me to authenticate with my domain admin credentials and do not prompt users to accept the connection, because I've configured them that way.

• Authentication <> Authorization. I could have been viewing sensitive patient material. A simple "Do you want to allow support to connect?" would give a chance to close anything important. Also, we have no domain here, nothing to authenticate against. Also I like that your justification is the configuration you set up. I worked for a large health system for 15 years. Our internal support tools always prompted us. Even if there is no malicious intent, we don't want help desk employees accidentally seeing colonoscopy images or something... – JOATMON May 10 '16 at 13:34
• @Devil'sAdvocate OK. None of that changes anything. He got authorization verbally from you (which is something you shouldn't have done if you actually were viewing sensitive materials at that particular moment), and you have have no idea what authentication is being used here (yes, domainless/workgroup computers authenticate users), what logging or auditing is being done, or even what protocol or program the guy used for remote access. You're just guessing at everything, so, not enough information to say. – HopelessN00b May 10 '16 at 13:42
• I currently work for a health care system, and our general IT guys, and specifically the one assigned to our group, remote into desktops all the time. They have two options for doing it, one gives me a pop up allowing me to authorize the connection, one doesn't. In both cases, I've given verbal permission before the connection is made. No matter who I've worked for in the past, I always close, or at least minimize, any window that I don't want the remote connector to look at, PHI or otherwise (like *.SE while at work...). – FreeMan May 11 '16 at 12:02

Using the author's preferred restatement in the comment:

Is it okay for our IT support contractor to have the ability to remote in without authorization?

Under normal circumstances, Yes.

Let's talk about the specific key words.

Contractor: Many contractors work as an extension of the company, and have to sign NDA's, HIPAA disclosures, attend training, and follow the same rules and laws regarding security, privacy, and ethics that all of the employees do. Even in a situation where a contractor was not asked to sign anything, that would not grant them permission to break the law.

Note: these statements are generalizations which may apply to the healthcare industry, but don't necessarily apply to all industries. For example in the defense industry you might not allow an IT person to remote into a machine without user interaction in case the user is viewing a document that is above the clearance level of the IT person. (Though this isn't a problem if there are dedicated rooms with machines specifically for viewing top secret documents.)

• Ignoring the body of my post removes a lot of context and many of your assumptions are wrong. – JOATMON May 10 '16 at 23:18
• @DevilsAdvocate: I have answered the question in general. Your particular scenario obviously could be different from that, but I didn't see anything in your question that would lead me to believe it definitely is in violation of HIPAA. Which part of the question do you feel is relevant which I ignored? – TTT May 11 '16 at 2:05

It strongly depends on the country you're living in, as this is more of a legal question. In some states this approach is legally correct if you signed it in your employment contract, others forbid this proceedure completly owing to privacy policy.

I completely disagree with the answer stating: "HIPAA does not get to specifics of policy". While they won't tell you how to write, or create a policy, they do get into VERY specific guidance. Here is the unbiased, facts to answer your question. The rules on HIPAA requirements administrative, physical and technical safeguards mandate basic requirements for security and privacy are as follows:

• Identification and authentication
• Audit controls

Identification and Authentication

It is fundamental that healthcare facility IT personnel know who is accessing their network, software, and systems, and that the person or entity gaining access is the one claimed. HIPAA, 45 CFR Part 164.312(d).3

Your vendor, and your organization violate the HIPAA mandates, since HIPAA requires the use of unique user IDs. You stated he logged in without credentials. This answers your question without needing to go further, but further we shall go.

Audit Controls

A healthcare IT professional will want to create, store, and protect appropriate log files of all security sensitive activities that take place during a remote session. HIPAA, 45 CFR Part 164.312(b).6 In addition, HIPAA requires a covered entity “to regularly review records of information system activity, such as audit logs, access reports, and security incident tracking reports.” HIPAA, 45 CFR 164.308 (a)(1)(ii)(D). Under the HITECH Act, a patient can request a disclosure accounting from a covered entity basically asking “who has viewed my health information” for up to the prior 3 years. HIPAA, 45 CFR 164.528(a) and HITECH Act, 13405(c). … must provide an audit trail of logins and logon attempts. HIPAA, 45 CFR 164.308(a)(5)(ii)(C)

You stated a vendor logged in without credentials, outside of verbal notes (which mean nothing in a court of law) what kind of auditing was done via way of logs? Even if you DID have a log of the event, who are you going to associate it with?

Well, no. If he can get in without authorization than anybody can get in without authorization. However,

1) You did provide him with legal authorization. This is not the same thing as technical authorization. If I called somebody up and asked for help and he up and did it remotely and I don't know how he got in to do it I would be nervous too.

2) Your IT support probably has some kind of remote access already set up. This is convenient for many reasons. Here it is most important to know how it works though.

3) If the remote access method provides no logs it does not satisfy HIPAA.

• Your 3rd point is valid but I would like a source. – JOATMON May 10 '16 at 21:23
• They name you correctly. I cannot source the material I have because corporate firewall; nevertheless it is accurate. – Joshua May 10 '16 at 22:20