Copier Insecurity Sideswipes HIPAA
If you haven’t watched this video on hard drives in copiers, take 5 minutes and have a look. It is a quick glimpse into how vulnerable the information that is stored on copiers really is, because they store nearly everything you do on a hard drive.
Watch CBS News Videos Online
After a few months of showing presentations out about the HITECH Act, this adds fuel to the fire of how loose our data control really is. As hospitals, or in my case non-profit health care providers work to comply with regulations, it shows how mis-applied the regulations are to preventing data loss.
How exactly does this affect HIPAA & HITECH?
This constitutes a breach of confidential information, putting you right in line with the provisions regarding secure data loss and your control of that information.
Anybody who has access to or deals with Personal Health Information, including vendors who support systems that control such information need to sign a business agreement, now holding them liable for the same extortion level fines that the covered entity. Before you run out and try to find your local HIPAA certified copier technician, I will give you a clue. The copier resale industry is not anywhere close to recognizing the impact of this. While I may retire from my job tomorrow to open a copier technician company revolving around securing and encrypting copier drives, the real copier industry just isn’t there yet.
That is not to say the copier companies themselves aren’t aware. In fact most manufacturers offer encrypted drives and systems that wipe the information from any form of buffer. The problem is that nobody buys a copier direct from Xerox any more and you will find that your local copier resale rep knows less about encryption or media sanitization than the Buffalo Police department.
How do we react, while we wait for the industry to mature enough to have this problem taken care of?
- Contact your copier lease company and inform them that all hard drives will be removed before returning the copier. Frankly at this point, you should’t care what the lease terms say regarding this. Run them through a validated media sanitization company, with the rest of your hard drives. Don’t rely on any claims that the copier company will handle the destruction, until they are a signed Business Associate, placing them in fiscal responsibility.
- Prepare you copier reseller for the discussion on a business vendor agreement surrounding the regulations of HIPAA, if they aren’t already.
- Keep a log of any support calls for the copier and approach each technician who shows up to work on that copier with legal disclaimers, ensuring the same HIPAA partner agreements.
- Possibly tag or mark the hard drive inside of the machine itself, taking inventory of it’s serial number for tracking reference.
- Wait for the same episode to come out regarding how insecure faxes and fax machines are, because we choose to ignore that too.





Number two has to be the pet photo. Becuase I am sure that if I haven’t seen you in 10 years, I will of course know that you have a white dog. What would make it even better is if you tag the photo with your name in it. Unless you are living proof that The Shaggy Dog does exist, keep the dog pictures in your photo section.
Number three is great, because I can clearly see that is you 500 yards off in the distance. This one applies to those awesome scenic pictures you also took on vacation. If I can’t recognize you in the picture, and I didn’t know you were on a vacation to the Grand Canyon or wherever, how can I know who you are?
Baby pictures come with a clause. If you are a new parent you have a month to show off your pride and joy before I call party foul. After that, you should be able to manage picking up the kid and take a picture of the both of you. I realize there is a lot of “he has your eyes” that happens with a newborn child. They all lie when that kid first comes out, and I can’t not recognize you by your baby.
Being a proud parent doesn’t go away. You will be tempted to fall into this clause. I can not blame you, after all most of the kids I know are pretty awesome. If you post the picture in your PHOTOS section however, we still all see it. Once you are past that infant clause of one month, I need to see you in the photo as well. 
Unless you are a celebrity, posting up a picture of one is just lame and somewhat creepy. Although it may not be as creepy as the octuplet mom Nadya Suleman’s obsession with that Angelina Jolie, it is still lame. These people are not real. If you haven’t come to terms with the way you look by now, you never will.
If you can’t take a picture of yourself, or something even related to you, why not take a picture of a completely inadament object? That helps a lot. I try and take great photos, and perhaps one out of every thousand is actually good. So when you have that moment of zen when the camera happens to look past your photogenic inadequecies, put it in your photos, not your profile.
The ultimate symbol of laziness and avoidance is to choose an actual symbol. This way you avoid the whole problem of posting a photo up of yourself. I definitely will recognize you by this one.


