IT Company OCS

The Setting
Industry: Healthcare
Company: Montgomery County Healthcare District
Location: Conroe, Texas
Founded: 1977
Employees: ≈ 260

Montgomery County Hospital District (MCHD) is a political subdivision of the State of Texas, established to provide healthcare for the needy residents of the county, located about 40 miles north of Houston.

Chief Operating Officer Kelly Curry manages a network with 50 Windows Server computers and approximately 215 workstations — 40 percent of which are mobile laptops — running Windows XP Pro and Windows 7 Professional operating systems.

Assisting Curry in his computer network management endeavor is Seth Montgomery of IT Company OCS, Optimum Computer Solutions, based in The Woodlands, TX.

The Challenge
“Ours is a decentralized workforce, we are dependent on mobile computing,” said Curry. “We have Emergency Medical Services (EMS) in the field, and patients all over the county. Remote laptops are used in the privacy of fire stations, in crew quarters, not all in one big building.

“Information we work with is special … government, healthcare … all computers contain sensitive documents, data closely regulated by the State of Texas, and at the federal level, by HIPAA (Health Information Portability and Accountability Act).

“The mission was to find a software program capable of documenting that what we do, we are doing correctly. We needed to add a layer of protection, so if criticism arose, our actions would be fully transparent. It was recognized that the software could act as a deterrent to inappropriate behavior, but we really had no misuse of bandwidth, for example, or patient records.

“Meeting the public’s trust was key. If our actions were addressed or questioned, we needed to be able to reply, and dissect the situation with facts, not emotions.

“We wanted to establish a level of confidence that systems are in place in the event of an outside attack or event … that we can prevent damage … that we can close the door, and find the issue of concern.”

Search for a Solution
Curry said that a few years back, MCHD authorized OCS to recommend a solution, and the decision to purchase monitoring software was “proactive from the CEO all the way down,” adding the intent was not “covert or overt.”

Montgomery commented: “We had previously used SPECTOR CNE Investigator as a solution for other companies tackling computer and Internet abuse, so when MCHD inquired, SpectorSoft was familiar to us. We have always received good reinforcement from SpectorSoft.”

Discoveries
“We recently had an incident where we believed a password was compromised,” said Curry. “Using SPECTOR 360’s Search function, and keyword alerts, we were able to determine if there was a breach. SPECTOR 360 gave us data quickly, and in this scenario, that was important.”

The Process
“Only the three Chief officers can authorize SPECTOR 360 investigation into an employee’s activities,” said Curry. “A manager can say to a Chief officer that he has concerns about someone, but that is it. From there, further action must be approved at C-staff level.

“For example, if a manager notes an employee electronically checked their bank account at lunchtime, that’s not a concern. If a patient care record got loose, and we are wondering where it went, that IS a concern. In short, a manager can express concern, but cannot authorize review.”

“Occasionally we will recognize some questionable behavior, investigate it with SPECTOR 360, and the story will get out that an employee made a bad decision,” said Curry. “We believe in storytelling, and folks have seen the results of misadventures.”

Working With Employees
“We have made it clear … nobody at MCHD has access to SPECTOR 360,” said Curry. “We use our trusted IT company, OCS, and it is well understood they are armed with a powerful tool. Not only do we trust them, but we trust them enough to say ‘here’s my dirtiest laundry, you can look at it.’ The relationship was fundamental to the monitoring process.

“The only time we interact is when there is an inquiry of concern. We don’t conduct general checks, such as random reviews per user.”

Montgomery added: “The keyword alerts feature of SPECTOR 360 is the only proactive tool we use. Even the IT guys are not allowed to drill down into details without legitimate concern.”

•”We have an extensive IT Guidelines document that takes a strong stand and clearly delineates what is acceptable use,” said Curry. “Included in this Board-approved document is our position on Social Networking, which is a key issue for all employers.”
Awareness

“They know,” said Curry regarding MCHD employees and monitoring. “Policy is communicated broadly. Everyone has been informed by memo and in meetings. The product is not mentioned by name, but we do call it a ‘robust set of security tools.’

“It’s become a case of trust. We’ve said Dear Staff … we trust you to stay on the high road. However, they know we can archive and recall. Our message is clear, but not threatening.”
Spector 360: The Software of Choice

“We have our own critical infrastructure to protect and SPECTOR 360 is vital to that effort,” said Curry. “To us, it’s no different than Homeland Security. To us, our IT effort is just as important. We need to make sure, and with great confidence, that we are safe.

“In the beginning, the monitoring effort was lower profile. But when SPECTOR 360’s capabilities became apparent, that we could protect our community’s personal information, we knew it was time to let them know we could do more than provide good medical services.

“It became clear we had the ability to say when it comes to security, with SPECTOR 360 we have it nailed.”

•”We use SPECTOR 360 more to protect than to govern,” said Curry. “While employee actions and activities were not unreasonable before SPECTOR 360 implementation, I do believe we have seen behavior modification. Resources are used wisely.”
•”SPECTOR 360’s web filtering has been an especially important and valuable feature for us,” said Curry. “Particularly with our toughbooks and laptops, 80 percent of the time they are disconnected from the network and we must be confident that web controls are functioning.

“To be able to lock them down, with the exception of critical sites, gives us peace of mind but also saves us time and money because it permits us to do something we needed to do without purchasing another piece of software. This saved the District money because we had already paid for the SPECTOR 360 licenses.”
•”SPECTOR 360 has really evolved, I’ve been pleased to watch it grow,” said Montgomery. “Install was simple. One needs just a basic understanding of how to connect a database. Many of the obvious features, like the Dashboard, are clearly clean and intuitive, but we don’t often use those elements. We’re generally at the User Explorer level.

“We take what you might call the direct route, and that’s very simple to do. With SPECTOR 360, we get answers fast. We find information quickly. Time to learn? In my experience, it takes just 30 minutes to an hour to learn and understand.”
•Additional testimony to SPECTOR 360 excellence is the ability to operate with limited technical resources.

“We have SPECTOR 360 on a five-year-old server and it remains manageable,” said Montgomery. “Whatever we task it to do, it takes just a few seconds. Upgrades have been smooth. With many packages I’ve used, you begin to have problems when you update and upgrade, but we have yet to reinstall SPECTOR 360 or rebuild the server. Apparently, plenty of Quality Assurance goes into the software before it goes out the door.”
•Montgomery said he especially appreciates SPECTOR 360 when it comes to investigations.

“One of the things I love about SPECTOR 360 is that there is no way to falsely manipulate the data,” said Montgomery. “With the date and time stamp, there’s just no question. When you’re involved in grievances, that’s a key element. SPECTOR 360 delivers secure data.”
•”The social networking phenomenon is interesting to me,” said Curry. “The open sharing of personal matters … we were concerned with this, its viral nature, worried our employees would get hooked. With SPECTOR 360, I can be sure they are focused and on task. We cannot afford interference with productivity. Also, the community would not be tolerant of employees spending work time on things that are considered activities of low value. We run a tight ship … we work with productivity applications only. We do not have Instant Messaging. There’s no personal email. No resumes done at work.”

Given the environment, it’s not a stretch to suggest that SPECTOR 360 supports daily life-saving. To that, Curry said: “It would really be bad form to have an EMS worker posting on Facebook while someone is needing assistance in the back of an ambulance.

“As EMS professionals, as first responders, we are held to an ethical higher standard. We are in business because people are sick or injured. We are dealing with individuals who have been involved in accidents, maybe victims of violence, or suffering from abandonment of responsibility. There may have been instances of alcohol or drugs.

“These are perhaps our patients’ worst times, and it is paramount that they are cared for in exceptional fashion, and that the safety and sanctity of their information is protected.

“We look to SPECTOR 360 to help us pass this sniff test, to help us do the right thing. Thanks to SPECTOR 360, day after day we are able to say we can.”  Thanks to IT Company OCS for their help!