My approach to these questions is always the same: I analyze what you want to protect, and what you want to protect against, and then select controls that accomplish these things. In other words, you start with a risk analysis. Sounds more complicated than it really is. Please follow along the logic I give you. If you come to different results, please note this down and adjust my conclusions accordingly. Obviously I can only try to guess what your situation is, so likely, some of my guesses will be a bit off.
1) Risk Analysis Part 1: What do you need to protect?
• Which data do you want to store on these computer(s)? Considering you mentioned HIPAA and Privacy, I assume that at least some of these data need to be protected.
• Are there any network applications that people are accessing through these computers which need to be protected?
• Does the network access itself need to be protected? (I assume you don't want anybody walking in to be able to surf around on the internal hospital network).
• Which network connection are you thinking about? It is generally easier to secure a wired network then a wireless network. But both can be secured. Whatever it is, you want to secure that network access/
Risk Analysis Part 2: What do you want to protect against?
• Outside hackers? Every computer administrator's favorite enemy. If you are behind a well secured hospital network, then outside hackers are probably not your number one problem. But you may want to verify that.
• Unauthorized internal people? In other words: folks who are physically inside the hospital, but don't have any business using your computer or your network. These could be hospital staff that does not have a real need for these computer resources, patients, visitors, etc. This is likely a group you want to protect against.
• Authorized internal people doing unauthorized things: in other words, insiders doing bad stuff. An example would be a nurse, who has legitimate access to the patient database, trying to hack into the hospital salary system to see how much money everybody else is making.
2) Controls
OK, what does this mean? It means you need a combination of computer controls and network controls, and both of these types of controls will be a combination of technical and administrative controls.
2.1) Computer Controls
If you have HIPAA data on these computers, or data that needs to be protected for privacy reasons, the single best thing you can do is to fully encrypt the data on the computer. Several companies are selling full-disk-encryption products, choose one, and implement it. If you have absolutely no experience in this, look for a product called PointSec, sold by a company named Check Point Software. It's the market leader. Not cheap, but it works well.
The next thing you need to implement is strict access controls: every legitimate user needs to have his or her own user account, and needs to be made responsible for whatever happens with this account. You need to implement policies and communicate them to your users. People need to be told that sharing their accounts with others, or making their passwords known to others, is an offense they can be fired for.
Each computer needs to be hardened: change all default passwords; install anti-virus and personal firewall software; make sure your operating systems are being patched; use group-policy objects (in ActiveDirectory) to prevent people from installing software (such as hacking tools), and to enforce things like password protected screen savers that jump in after 10 minutes of inactivity.
Other computer controls you should think about:
• Restrict the sharing of computers as much as possible. Securitywise it is normally cheaper to buy a separate computer for every legitimate user, than it would be to pay the penalties for even a singe security incident that requires you to notify the general public. However, if you make sharing of computers legitimate, prevent people from storing information on the local computer by re-directing personal storage folders to the network. Keep in mind: I am talking sharing of computers here, not accounts. Sharing of accounts should never be allowed.
• Do not locate computers in places where they are difficult to supervise, or where the person who is working on them can be easily spied on (e.g. through internal windows). Make sure the screens face away from glass doors or see-through partitions.
• Write clear and simple policies what people are allowed to do and what they are not allowed to do. Example: never share your password; use the computer for work related things only; do not try to install software yourself; when you are done with your work, or when you are called to a patient, log off; etc. Write these policies up, give everyone a copy, and have everyone sign that they read and understood these policies before they get their user account and password.
2.2) Network Controls
The single best thing you can do to protect your network against unauthorized insiders (e.g. patients or visitors bringing their own laptops and trying to hack into your hospital network) is to implement strong Network Access Control. Microsoft sells a turnkey solution for that (called "NAC"), so does Cisco (called "Self Defending Network"). If you have a small scale operation, you can simply use ActiveDirectory coupled with strong authentication. Not quite as sophisticated, but it might achieve what you are looking for.
The idea in all three cases is pretty simple:
- users get a physical token that they have to use to sign in (in addition to their passwords), and
- legitimate computers get a certificate file that is used to identify them to the network.
Anybody who tries to log in without such a token is rejected, and any computer that does not have an appropriate certificate is rejected. This protects you both against laptops that people bring into the hospital, as well as against people walking up to an unused legitimate computer, trying to log in there.
Be very careful in designing access rights. Create various user roles ("nurse", "doctor", "administrative worker", "receptionist", "IT", ...) and carefully assign them just the network resources they need to do their work. A "doctor" needs access to the patient database, and probably all the medical information you have stored. But he normally has no business going into the administrative databases. Only the "IT" people should have administrative access to the network and to each computer. Assign each user to one role, and have this assignment signed-off by their bosses. You can implement these roles via user-groups in ActiveDirectory.
Obviously you need a good outside firewall solution. Make sure you are not using the internal network to host Internet resources (if the hospital runs a website on the public Internet, this website should not be hosted on their internal computers).
Other network controls you should think about:
• Segment your network. Your administrative computers (billing, payroll, personnel information) should be on a different segment than operational computers (like the ones on nursing stations). You can use a firewall to regulate which traffic flows between segments. Simple to do, saves you a lot of headache.
• Use ActiveDirectory policy objects to log-off network sessions that have been inactive for more than 15 minutes.
• Use the "My Documents redirect" functionality (available via Windows 2000 and up) to direct personal folders to the network. Makes backup much easier, and goes a long way to prevent people from sniffing into each other's data.
• Install plenty of network jacks in the hospital, but activate only the ones you need. Assign somebody responsibility over each network jack to make sure you can de-activate a jack that is no longer needed.
This is not meant to be a complete list, but I hope it will get you started. The one thing you get most benefit from is doing the risk analysis that I started with. Since you know your situation better than I do, you will likely come to slightly different results. Document the analysis and the conclusions you draw from it. This will allow you to explain to any auditor why you do what you're doing. Good luck!