Best Data Storage for Confidential Information?

W

wicked_chicken

Limp Gawd
Joined
Nov 30, 2009
Messages
316
Hello [H],

I'm a doctoral student in a clinical psychology program at a major university and have recently been tasked with managing certain confidential information for my lab. Currently, the information in question is dispersed on multiple portable USB hard drives, with no systematic labeling or locating information to speak of. I brought up the possibility of creating a NAS specifically for the lab. Apparently, once upon the time the lab had a university sponsored share drive, but we were then told that we were using too much room.

So, my question is:

If we are permitted to integrate our own solution over the institution's network, what is the best method for storing large, confidential files in a redundant, error-resistant method?

I run a FreeNAS server at my house, and was thinking that would probably be fine as I'm familiar with it, it offers redundancy, and can be encrypted. However, there is a good possibility that the department IT people will want to get their fingers into whatever we deploy.

We probably don't need anything beyond the 12T range. Something self contained (e.g., not a rackmount) would be preferable.
 
I've used Seagate Blackarmour NAS boxes for some of my financial clients that require encryption.

Not the fastest but pretty robust and simple to use. Uses a USB stick in the back of the NAS box with an encryption key on it. Remove the key and the data is locked. You can have multiple keys too.

I must have rolled out about 9 or 10 of them over the past three years with no issues.

Just a suggestion.
 
If you care about data corruption, you need to use ZFS (which FreeNAS uses) or do a checksum of each file and periodically scan all files and compare the checksum to see if there has been any data corruption. ZFS does this checksum control automatically for you.

ZFS on Linux is often deployed, and the IT departement might prefer Linux over FreeNAS or OpenSolaris?
 
I do worry about data corruption. I also worry about disc failures. I actually really like ZFS from my use at home.

Another question regarding FreeNAS. Does it permit for SMB Packet Signing and NTLMv2 challenge-response authentication? In order for the institution machines to communication, this is a requirement.

EDIT: It appears that FreeNAS does infact offer SMPPS and NTLMv2.

Good news.
 
Last edited:
If you are collecting the data, both possibilities are your responsibilities.

Honestly since you are asking this question of this forum, I would say that you are not equipped to handle this situation, and should contact a contractor that handles healthcare data.

Multiple portable USB hard drives sounds like it may already be a violation of HIPPA.

I'm pretty familiar with research (3 years of psychiatry research at the VA) and healthcare and it really sounds like you guys are walking the line right now.
 
Seeing as I'm new to this particular game, I'm going to defer and figure out who to consult in the department and/or college on HIPAA. I appreciate the heads up.
 
mwroobel said:
Save yourself a HUGE amount of pain and possibly crippling fines.... Before you embark on your project know your HIPAA requirements and responsibilities.
Click to expand...

I was thinking the same exact thing.

Lets put it this way.. Someone walks away with the nas you setup, keys and all, and now 10K+ files of personal data, medical, first/last name and maybe SSN is now out in the wild. Do you want that on your shoulders or on the shoulders of the university?

I wouldn't touch this project with a 10 foot poll.
 
staticlag said:
If you are collecting the data, both possibilities are your responsibilities.

Honestly since you are asking this question of this forum, I would say that you are not equipped to handle this situation, and should contact a contractor that handles healthcare data.

Multiple portable USB hard drives sounds like it may already be a violation of HIPPA.

I'm pretty familiar with research (3 years of psychiatry research at the VA) and healthcare and it really sounds like you guys are walking the line right now.
Click to expand...

Remember 6 years ago the VA lost something like 26 million+ records due to a harddrive walkign away? http://www.consumeraffairs.com/news04/2006/05/va_laptop.html Yea.. I got a letter that my records were part of that cache.
 
kdh said:
I was thinking the same exact thing.

Lets put it this way.. Someone walks away with the nas you setup, keys and all, and now 10K+ files of personal data, medical, first/last name and maybe SSN is now out in the wild. Do you want that on your shoulders or on the shoulders of the university?

I wouldn't touch this project with a 10 foot poll.
Click to expand...

Right now they are using USB... that sounds worse.

If the IT dept is getting involved perhaps you can use enterprise licensing. That could give you access to Windows Server and BitLocker, but also incorporate the server into your school's AD structure... which IT would need to setup to allow access to only those in the lap. Some paperwork will probably need to go with this. I dont know HIPPA all that well.
 
JWill, yes, they already have USB drives and that may be a violation. On the other hand, from the POV of his covering his a**, he can prove 'that was before my time!', whereas if he architects a new setup that also is in violation, his a** is on the line...
 
Apparently, due to physical security (every door in our lab is two factor verification before access is granted) and the fact that the discs are password protected (unsure of crypto, didn't ask), we're in compliance.

It is safe to say that the NAS would be behind the same closed doors, hidden behind institution firewalls.

At this point, for political reasons, we're going to let it simmer. Apparently me asking questions made waves.
 
Since when do psych majors do IT's job? Who actually "tasked" you with this, or did you simply take it upon yourself?

No offense but leave the IT to the pros, my man.
 
HIPPA requirements don't appear to apply. (see the link above and read who HIPPA applys to.)

While it might be nice to ask the university IT staff for help, ignorance of the existance of the data is as good of protection as you can get. Keep the number of people who know about the data small.

Encryption of data is great, but universities have high turnover so too many people can learn the keys.

Keep the data off of any network or internet. Encrypt as little data as necessary. Keep as few copies as you can. Control access to the data. Collect as little data as possible.
 
This is not legal advice, particularly because I do not know what info you are storing or how you got it. You need a health information privacy officer. If you can not find one talk to HR and find out who they use to answer HIPAA questions. You might even need outside counsel.


Do not do anything until whoever it is signs off on what you want to do, in writing. HIPAA fines add up very quickly and you do not want to be the cause of a multimillion dollar fine. Just as an example, if you happened to lose a list with 300 names on it that is counted as 300 different HIPAA violations...
 
Franko said:
Just as an example, if you happened to lose a list with 300 names on it that is counted as 300 different HIPAA violations...
Click to expand...

Lists of names are not medical information. Losing a list of names is 0 violations.

But yes, we are not giving legal or compliance advice. If the OP needs advice, he can find it elsewhere.
 
You probably don't want to touch it. But having been consultant/liaison on some of these types of issues (do NOT read that as HIPAA compliance officer or expert) I would second exactly what J-Will said. In your situation I would first see how much the IT dept wants to lease secure storage space to you for (i'm assuming you use a mechanism like internal marketing since it seems like all the rage these days for "budget efficiency", not sure about inter-office relationships it engenders though) figure out a target and work on the price, let them make sure it's compliant.

Failing that, depending on what enterprise system you have in place I would strongly recommend using it; Server2012 w/ Storage Spaces and ReFS still seems to be in its infancy when compared to ZFS, but you cannot argue with its ease of integration into an existing Active Directory domain. Once joined to a domain, just use whatever enterprise encryption tool the institution uses, if any. If not available then go the bitlocker route or have the IT team look into an encryption solution for you. The domain can be used to control access and authentication and granting/removing privileges is trivial when using permission groups and group policy. Just keep in mind, if anybody with access falls for a phising scam you'd better hope the attacker doesn't realize what they've gained access to.

Physical security is a method of securing the data, but by no means should it be the only method. Keep in mind that all the data i have had to work with absolutely needed to be accessible from remote locations, if your data do not need to be accessed anywhere but in the office you may still benefit from a centralized storage system but either keep it detached from the network or configure a separate firewall device to only allow logon authentication to DC's and acquiring software updates.
 
Last edited:
You must log in or register to reply here.
Back
Top