Research Computing

HIPAA Secure Workstations

Dedicated, HIPAA-compliant computing environments for authorized researchers handling Protected Health Information — with strict MDM, disabled USB ports, double MFA, and full SOC audit logging.

Unauthorized access to Protected Health Information is a violation of federal law.

HIPAA workstations are restricted to explicitly authorized personnel only. All access is logged, audited, and subject to compliance review. Misuse may result in disciplinary action and federal penalties.

Overview

CMC's HIPAA Secure Workstations provide a fully compliant computing environment for researchers and Health Services staff who handle Protected Health Information (PHI). These dedicated stations meet the Health Insurance Portability and Accountability Act's technical safeguards for electronic PHI (ePHI) and are physically and logically isolated from general institutional networks.

Supported through CMC's partnership with the Berger Institute for Health and the Aging Society, these workstations serve approved research projects involving student health records, clinical data, and other HIPAA-regulated information.

Security Architecture

Physical Security

  • Dedicated hardware — not shared with general use
  • Controlled access locations within Health Services
  • Monitor privacy screens to prevent shoulder-surfing
  • Clean desk policy — no PHI visible when unattended

Technical Controls

  • AES-256 full disk encryption at rest
  • Auto-logoff after 15 minutes of inactivity
  • Double MFA — CMC SSO + Duo required
  • Role-based access controls (RBAC)

Endpoint Hardening

  • USB ports disabled — no removable media
  • Strict MDM (Microsoft Intune) policy enforcement
  • Enterprise endpoint protection with real-time scanning
  • Approved software allowlist only

Network & Logging

  • Dedicated VLAN — isolated from general campus network
  • Strict firewall rules, TLS 1.2+ for all transmissions
  • SOC audit logging — every PHI access is recorded
  • No PHI transmission via email or external channels

What Counts as PHI

Protected Health Information is any health information that can be linked to an individual. The following categories must only be accessed on HIPAA workstations:

Medical diagnoses and treatment records
Mental health records and counseling notes
Prescription and medication information
Health insurance information
Immunization records
Any health data combined with identifying information

Who Can Use HIPAA Workstations

Access is strictly limited to explicitly authorized individuals. The following roles may be approved for access:

  • ✦ Health Services clinical staff with an active, role-based authorization
  • ✦ Approved researchers affiliated with the Berger Institute with IRB approval and a signed Data Use Agreement
  • ✦ ITS security staff for maintenance and troubleshooting only — never for data access

What You Must Never Do

  • Access a HIPAA workstation without explicit written authorization
  • Share login credentials for a HIPAA workstation with anyone
  • Access the PHI of an individual not under your care or study
  • Print or copy PHI without documented authorization
  • Store PHI on personal devices, USB drives, or personal cloud accounts
  • Leave a HIPAA workstation unattended while logged in
  • Attempt to bypass USB restrictions or MDM policy controls

Reporting a PHI Breach

If you suspect a Protected Health Information breach or security incident on a HIPAA workstation, act immediately:

1

Disconnect Immediately

Physically disconnect the workstation from the network. Do not attempt to shut it down or troubleshoot — preserve the evidence.

2

Contact the Privacy Officer and Help Desk

Call the ITS Help Desk at (909) 607-0911 and notify the CMC Privacy Officer without delay. Time is critical.

3

Cooperate with the Investigation

Provide a factual, detailed account of what occurred and when. The SOC team will pull audit logs and begin containment procedures.

Need HIPAA Workstation Access for Your Research?

All access requests require IRB approval, a signed Data Use Agreement, and CIO authorization. Our Solutions team will guide you through the compliance process.

Request Research Access →