Do you know the most common way Texas Children’s sensitive information is inappropriately disclosed?
Disclosure occurs when a workforce member sends sensitive corporate information to non-Texas Children’s email address. Sensitive information includes protected health information (PHI), social security numbers (SSN) and credit card numbers.
Why protect sensitive information? What are we doing about it?
As a regulated health care entity, Texas Children’s must comply with Federal and State laws related to data confidentiality and privacy. We use a Data Loss Prevention (DLP) system to detect and prevent potential data breaches. The system currently ensures sensitive information is stored and shared appropriately within our network and is auto-encrypted before leaving our network when sent to external parties.
What is changing?
We are planning an upgrade of DLP system that will enable blocking of sensitive information from being copied to or sent accidentally or intentionally to unauthorized parties external to our network. Examples of business workflows that will be affected:
- Emails containing SSN, credit card numbers, medical record numbers (MRN) or medical terms including PHI.
- Files loaded to a cloud storage that contain SSN, MRN, credit card numbers or medical terms.
- Documents being saved to a flash drive that contain SSN, MRN, credit card numbers or medical terms.
What is included? When?
All end users of the Texas Children’s Hospital and the Texas Children’s Health Plan are included. All corporate devices, network and emails ending in TXCH.ORG, TXCCC.ORG, TEXASCHILDRENS.ORG, TEXASCHILDRENSHOSPITAL.ORG and TCHP.US will be actively monitored. The DLP system will review Information sent to the Baylor College of Medicine as well.
DLP initiative timeline
Project activity
Texas Children’s Hospital
- Start pilot: Week 2 – September 2017
- Start rollout by organizational unit: October 2017
- Complete project: November 2017
Texas Children’s Health Plan
- Start pilot: Week 2 – October 2017
- Start rollout by organizational unit: November 2017
- Complete project: November 2017
More questions?
Expect monthly announcements from us. Departments needing to file an exception for a business purpose may post the request to dlp@texaschildrens.org. Exceptions will be vetted via the DLP governance process.