"I would love to take credit for this idea," says Wes Wright, CIO of Seattle Children's Hospital. "It's worked out so well."
Desktop virtualization technology was already in place when Mr. Wright became CIO of Seattle Children's last August. Currently deployed across the 323-bed tertiary hospital, research center and foundation that together comprise Seattle Children's, the technology is the center of the hospital's "bring your own device" policy.
Desktop virtualization allows an end user to interact with data and applications hosted on a remote server through the use of software or an app. "The virtual desktop allows me to give an end user a desktop on any device that has the application on it," says Mr. Wright. "The user gets the desktop, does all the work they need to do using Windows 7, and when they're finished, they disconnect," he says, and return to their device's desktop.
The desktop virtualization application has led to a BYOD policy at Seattle Children's that's both secure and unrestrictive. "I can essentially allow all researchers and physicians to bring their devices and get hooked up to the network whenever they need corporate data," says Mr. Wright, without worrying about data being saved directly from the desktop onto a user's device. "By design, you can't save anything from one desktop to the other."
When employees do need hospital data on their computer or other device, Seattle Children's uses a HIPAA-compliant data transfer service to transfer files via a secured link. Using the software (Accellion), users use the virtual desktop to send an email to themselves with the data, which will arrive in their email as a link to a website where the data can be downloaded.
Seattle Children's also has the ability to track what data files were transferred and to where through Accellion, to stay ahead of potentially compromised data. With the transfer log, "if someone's laptop is stolen, we can go and see what files left the environment and see if there's a risk for data leakage," says Mr. Wright.
Mr. Wright has been making a few modifications to the system, including tweaking the security settings to allow users to send their work to a printer from the virtual environment. He says he can't see implementing a BYOD policy any other way than through virtual desktops.
"It would be a nightmare for a CIO to try and manage everyone's Macs and iPads and so on," says Mr. Wright, "because, inevitably, something you do may or may not actually be, but will be perceived as, doing something bad to someone's personal device."
Having all the necessary documentation in place to show the user agreed to the BYOD policy terms will not always help, he says. "When push comes to shove, if something happens to a user's device, you'll spend a lot of time proving it wasn't your fault, and if something you did actually affected something on user's device, you'll spend more time undoing it."
Beyond freeing him from trying to control employee's personal devices, desktop virtualization technology has allowed Mr. Wright to apply the same BYOD policy to clinicians and researchers alike, important as many employees take on both roles. "Having the data abstracted away from the device allows us to put the same policy in place for everyone at Seattle Children's," he says. Currently, 4,000 to 5,000 devices are linked to the network.
"Get out of the management of personal devices, and just virtualize everything," says Mr. Wright. "I think personally the presence of virtual desktop technology is going to make or break a hospital's BYOD policy in the future."
More Articles on BYOD Policies:
5 BYOD Best Practices From Jersey City Medical Center CIO Stephen Li
Tech Terms Cheat Sheet: The Health IT Vocabulary Non-CIOs Need to Know
89% of Healthcare Workers Use Personal Smartphones for Work