The Remote Workforce: Logged, Tracked, and Scrutinized?

Overview

The Security Rule does not have a smaller version for a practice with one remote employee. It applies to the records, not to the headcount, and it asks the same questions of a solo arrangement that it asks of a hospital system: who has been granted access, how is that access identified and controlled, and can you show what was done with it.

What it does not do is name a product. The rule is deliberately technology-neutral and scales to the size and capability of the practice, which is good news for a nine-person office and also the reason nobody can hand you a checklist and call it done. You are expected to make reasonable decisions for your own environment, and to be able to explain why they were reasonable.

Some of the pieces are required outright. Every person needs their own identified account, and there has to be a way to get to records in a genuine emergency. Others are what the rule calls addressable, which is the most misread word in the whole document. Addressable does not mean optional. It means you assess it, and either implement it or document why it was not reasonable for you and put an equivalent measure in its place. Automatic logoff is addressable. So is encryption. So is monitoring log-in attempts. A practice that skipped all three and never wrote down why has not made a choice. It has left a blank.

The Challenge

The difficulty with remote access is that it is invisible by design. In-office risk announces itself. You can see the unlocked screen at the front desk, the chart cart in the hallway, the person who should not be behind the counter. None of that is available when the work happens twelve miles away, and so the entire question collapses into a record of who signed in, from where, and when, which is exactly the record almost nobody looks at.

The second difficulty is that the arrangement was never designed, so it has no boundaries. The remote setup that started as one person on one system tends to grow sideways. Another staff member gets the same access because it was easier than deciding what she actually needed. A family computer joins the list because hers broke. A login gets shared during a vacation and is never unshared. Each step is small and reasonable in the moment, and the sum of them is an access footprint nobody could describe if asked.

The third is that when someone finally does go looking, the record often cannot answer. If two people use one login, the log shows an account rather than a person, and the whole apparatus of accountability quietly stops working. That is the reason unique accounts sit at the required end of the rule rather than the addressable one. Everything downstream depends on them.

Why It Matters

Four reasons this is worth an hour of a practice manager's time:

Remote access is the path that outlives the person. When someone leaves, the badge comes back and the desk gets cleared, because those are physical and visible. The remote path is neither. It is the one piece of access that can survive a departure by months simply because nobody remembered it existed, which is the same failure our piece on offboarding as a security event covers from the other end.

The record only exists if it was turned on before you needed it. Logs are not retroactive. Every question worth asking after an incident, which account, from where, at what hour, touching what, is answerable only if the answer was being written down beforehand. This is the cheapest control in the entire set and the one most often left in whatever state it shipped in.

Reviewing the records is its own requirement, not a bonus. The rule asks for regular review of system activity, separately from having the capability to record it. That distinction is the whole point. A log nobody reads is a control that exists on paper, and the review is where the actual security lives. It is also, in practice, the shortest task on this page and the one most reliably skipped.

Restriction has a real cost, and pretending otherwise backfires. Time and location limits are legitimate controls, and they are also the ones most likely to be defeated by the people you imposed them on. Lock someone out at six and give her a claim that has to go out tonight, and she will find a way around you. That way is always worse than what you blocked. The honest version of this control is one that matches how the work is actually done, with a path for the exception you know is coming.

What Organizations Should Watch For

• A shared login for the remote path. The single most damaging shortcut on this list. It is convenient exactly once and it removes the meaning from every log entry produced afterward. If two people can use it, it cannot tell you which one did anything.
• Logging you have never seen the output of. Ask to be shown last month's sign-in record for one remote user. If nobody knows where it lives, or it turns out the retention is seven days, or the answer is that the vendor has it, you have learned what your record would look like on the day you needed it.
• Access that was granted for a reason nobody remembers. Walk the list of who can reach records from outside and ask why for each one. Anything that gets an answer starting with "I think that was when" is worth closing.
• Sign-ins that do not fit the pattern. An account that has only ever appeared on weekday afternoons from one metro area is telling you something the day it appears at three in the morning from somewhere else. You cannot notice that if you have never looked at the ordinary version.
• The personal device with no boundary around it. A home computer that reaches records is part of your environment whether or not you supplied it. The questions are whether it is patched, whether the household shares it, whether the screen is visible to a room, and what happens to what is stored on it when the employee moves on.
• Sessions that never end. A remote session that stays open indefinitely turns any unattended laptop into an open chart. Automatic logoff is addressable rather than required, which means you get to decide the timeout, not that you get to skip the decision.
• The remote path that survived an exit. Pick someone who left in the past year and try their remote access. This takes four minutes and is the single most informative test on the page.

Recommended Actions

• Write the list. Everyone who can reach records from outside the building, what each one can reach, and why. It does not need to be elegant. It needs to exist, because you cannot review what has never been enumerated.
• End every shared login this month. One account per person, no exceptions for the front desk, the temp, or the owner. Everything else on this page depends on it.
• Turn logging on, then go read last month. Do the reading part now rather than filing it as a plan, because the reading is where you find out whether the logging is any good.
• Set the review cadence and name the person. Monthly is a reasonable starting point for a small practice. Write down who does it and what would prompt a question, then keep the short record of having done it.
• Decide the session timeout deliberately. Pick a number that fits the work, apply it, and write down the reasoning. That written reasoning is what the rule is asking for on an addressable item.
• Match any time or location limit to the actual job. Ask the person who does the work what hours she really needs before you set the window, and build in the way to handle the legitimate exception. A control that gets bypassed weekly is worse than no control, because it teaches everyone that the rules are decorative.
• Add the remote path to your offboarding steps in writing. Same list as the keys and the badge. Our piece on the systems you do not control covers what happens when access exists outside anyone's list.
• Put multi-factor on the remote path first. If you do only one technical thing from this page, do that one. Our piece on why multi-factor is not the whole answer anymore covers where it stops helping, which is a reason to configure it well rather than a reason to skip it.
• Ask your IT provider for the answers, including us. Who can reach what remotely, what is logged, how long it is kept, and who reviews it. If those questions produce a pause, that is the finding. Help translating what you get back is what managed IT is supposed to include, and the assessment is a reasonable place to start.