CISOs Compare Notes at HIMSS

For example, one member of the audience said it was a "huge challenge" to ensure that when an employee is fired, their password is promptly deactivated so they cannot wreak havoc.

One of the workshop speakers, David Wiseman, information security manager at St. Luke's Health System in Kansas City, Mo., urged attendees to work closely with their human resources departments to make sure HR gives timely alerts to the IT department when someone is about to be terminated.

How does your organization handle deactivation of passwords when someone is fired? 

An attendee suggested having the termination form normally submitted to HR simultaneously forwarded to the IT department so security staff can prepare to deactivate passwords.

But another attendee said the "best case" scenario would be to set up the HR information system so that it's linked to the password management system and triggers an automatic password deactivation at a specified time.

How does your organization handle deactivation of passwords when someone is fired?

A subject of lively debate at the workshop was whether to encrypt electronic health records before giving them to a patient.

Wiseman said his hospital encrypts data on CDs it gives to patients who want an electronic copy of their records. But several audience members strongly disagreed with that policy.

"Handing them a CD is just like handing them a paper record," said one CISO in the audience, saying that encryption was unnecessary and could prove bothersome to patients.

But Wiseman said that patients at St Luke's have commented that they found the use of encryption reassuring.

That left some audience members shaking their heads, questioning whether the average consumer could figure out the instructions for accessing and reading the encrypted data.

Will your organization encrypt CDs or USB drives it gives to patients? We'd like to hear from you.