BYOD In Healthcare Organization: Case Study

Stanya Palmaro
ITM 350
Dr. Knapp
October 28, 2014
Risk Assessment:
BYOD in Healthcare Organization

Introduction:
For the past couple of years, a policy that allows employees to bring their own personal devices to work has become progressively popular. This policy is known as BYOD, an acronym that stands for “bring your own device”. One of the main reasons for the growing usage of the policy is the increase in employee productivity as they are already familiar with the equipment they are using at work. Although this reliance on technology is efficient and produces numerous benefits in the business sector, it also brings several problems along with it. Certainly, the risk of losing valuable data has become an imposing threat nowadays, making
They currently have 150 employees working for them; majority of which, are using their personal computers and devices on the job. According to SHHC, the company’s technological infrastructure is composed of 30% of laptops, 50% of tablets and 20% desktops. SHHC is currently benefitting from the BYOD policy as it allows employees to be more efficient and productive. The employees are already familiar with the devices they are using and can have the ability to use valuable third-party medical applications that companies do not know about and would therefore not be accessible with company-owned devices. An example of a third-party application as such would be UpToDate, which is a medical database that can significantly improve diagnosis of a disease as well as its treatment. Also, having personal devices makes it possible for employees to stay connected even if they are out of the office or on a business trip, which is especially important for the type of business SHHC is conducting, but also when the employees are on vacation or on sick leave. Despite all of the benefits and improvements in the business’s day-to-day operations, the security issues related to BYOD is still prominent and should be assessed if not
Increasing its security may include purchasing programs such as Absolute Software, which would allow the company to remotely wipe devices. Since employees may use more than one personal device on the job, the company will have to account the cost of the software for about 250 devices, the software costs about $100 dollars each; which would add up to $2,500. Also, SHHC may want to create a separate body in their organization that will monitor the devices. This body will help enforce the company’s new BYOD policy, by for example making sure that all the devices are protected and that the data on those devices are encrypted. It will also be responsible of locating the lost devices, remotely wiping the data on them, or even monitor the traffic emitted by the devices. Creating this completely different sector in the organization will have a cost that will amount to about $5,500 or $8,000 total. Due to these measures, the Annual Rate of Occurrence is expected to drop by 3%, making the residual annual risk to be of 7%. If we add the $8,000 to the $375,000, it will create the new SLE of $383,000. Therefore, the new ALE will be of $26,810. This would reduce the costs from the initial risk by $10,690 if an event were to