HIPAA password policy: Managing Windows stored usernames and passwords

HIPAA password policy: Managing Windows stored usernames and passwords

Would a decision to collect and store Windows domain usernames and passwords of all employees (IT inclusive) in a company bound by HIPAA regulations constitute a potential violation of those regulations? All employees have access to HIPAA-sensitive information.

    Requires Free Membership to View

    Login

    SearchSecurity.com members gain immediate and unlimited access to breaking industry news, virus alerts, new hacker threats, highly focused security newsletters, and more -- all at no cost. Join me on SearchSecurity.com today!

    Michael S. Mimoso, Editorial Director

    By submitting your registration information to SearchSecurity.com you agree to receive email communications from TechTarget and TechTarget partners. We encourage you to read our Privacy Policy which contains important disclosures about how we collect and use your registration and other information. If you reside outside of the United States, by submitting this registration information you consent to having your personal data transferred to and processed in the United States. Your use of SearchSecurity.com is governed by our Terms of Use. You may contact us at webmaster@TechTarget.com.

Before jumping into the HIPAA arena, let's begin by stating these foundational security principles:

  1. Deny access by default.

  2. Only give access to those with a demonstrated need to know.

As the second sentence of your question states that all employees have access to HIPAA-sensitive information, the first step in this process is to examine if that is necessarily the case.

Essentially, going back to the foundational principles I noted above, my question is: Why do all these employees need access to HIPAA-sensitive information? Secondly, if they do, what are the policies, procedures and expectations for the employees surrounding their access to this information? Essentially, how can you be sure you are protecting the company from any abuse of this access by way of administrative, logical and physical controls?

Back to your question, I would need to have a better understanding of the surrounding circumstances. For instance, your Active Directory program definitely maintains domain usernames for all users, so part of the information in question is already stored.

So, the question becomes: Why is there a need to store user passwords? If an employee forgets his or her password, there should be an established process to allow for controlled reset, rather than a spreadsheet of sensitive credentials.

So, I'm not sure that collecting the passwords and usernames is necessarily a violation of HIPAA; however, when considering HIPAA password policy best practices, having username/password combinations stored together could be a violation, or could lead to a violation if such information fell into the wrong hands. This should be reviewed immediately by your security officer and possibly by legal counsel (i.e., your expert HIPAA attorney).

This was first published in March 2010

Back to top