Mobridge Regional Hospital
Monitoring Software Saves Money, Ensures HIPAA Compliance

---

The Setting

For more than 45 years, Mobridge Regional Hospital has provided medical care to communities surrounding the South Dakota town of Mobridge.

“It’s a busy environment,” said Information Technology Director Eric Skillingstad. “We’re a small-town community hospital with about 130 employees across a variety of departments and clinics.”

Skillingstad described the workforce as mature and conservative. “The majority of our employees are 40 to 55 years old,” said Skillingstad. “Some have worked here 30 to 40 years.”

Skillingstad oversees a computer network running Windows 2003 Server, with approximately 50 PC clients using Windows 98, 2000 Pro, and XP.

The Challenge

Compliance with the Health Insurance Portability and Accountability Act (HIPAA) is the primary driver behind Mobridge Regional Hospital’s attention to its IT system.

“HIPAA was the main push … the main reason we were looking at software,” said Skillingstad. “Email control is a critical issue when it comes to HIPAA. Communicating about a friend or family member who’s in the hospital … how they’re doing, what happened to them … that’s a BREACH. Plus, our basic stance is that email should be solely for work purposes … not for communications with friends and family.

“We also had a small problem with people abusing other IT services.”

Skillingstad said that even though frivolous and inappropriate PC and Internet activity SEEMED small, on closer inspection he recognized that if you added it up over a year, “the impact would be significant.”

“Eliminating just the abuse alone would justify an expenditure,” said Skillingstad.

Search for a Solution

Given HIPAA guidelines and standards, and Skillingstad’s position as the hospital’s HIPAA Security Officer, he took the initiative to find a way to help Mobridge Regional Hospital comply.

“I brought the idea of activity monitoring software to management,” said Skillingstad. “After a search on Google for auditing software, I found Spector CNE and saw what it claimed to do. Honestly, I thought it was a little too good to be true … there must be a catch.”

Despite his initial wariness, Skillingstad said he didn’t do much comparison shopping.

“Spector CNE stood out,” said Skillingstad. “And the price was really good compared to the alternatives … far superior to what I’ve seen. I said to myself, I’ll give this a try.”

After testing, Skillingstad confirmed the software did everything SpectorSoft said it would do.

“Everything was a go,” said Skillingstad. “It was the best choice.”

Discoveries

“We bought 10 licenses at first and tested it on six machines,” said Skillingstad. “We saw lots of IT services abuse. Management felt it was a surprise … they didn’t think the activity was where it was.

“We found one employee with seven personal hours over two days. We’ve seen people doing online banking. Also online shopping … from eBay to JC Penney. We’ve seen web-based email activity … all non-work activities.

“Spector CNE catches everything. Nothing is left to the imagination, and in an investigation, that’s critical. There’s no ‘he said, she said.’”

Skillingstad said Spector CNE reports showed that a great deal of the hospital’s inappropriate PC activity occurred during off hours. “We found a lot of abuse on the long overnight shifts … weekends also,” said Skillingstad. “That’s when people would really play around … the main daytime workforce, not as much.”

“Most of the staff uses IT services to perform their job functions,” said Skillingstad. “But with some employees, common sense goes out the window. Some find it really easy to kill time. It should be a common sense thing … especially when it’s hours and hours (of abuse).”

Since the arrival of Spector CNE, however, hours and hours have become scant minutes.

“With Spector CNE, we’ve seen non-work activities drop off to almost nothing,” said Skillingstad.

Awareness

“I manage the reporting,” said Skillingstad. “There was a scenario where somebody said how do we know what YOU’RE doing? I told them if they want to look, they certainly can. With Spector CNE it would be easy enough to install another Viewer.”

Working With Employees

During the testing phase, employees were not alerted as to the presence of activity monitoring software. But once Spector CNE was on all PCs, the workforce officially was informed of its presence.

“Everyone was updated via a memo from me,” said Skillingstad. “Management then met with department heads and relayed all the information.”

	Skillingstad said the company takes advantage of Spector CNE’s Logon Notice. Modified to best suit the hospital’s needs, the notice explains inappropriate behavior will be reported to management and all HIPAA policies will be enforced.
	The advent of Spector CNE prompted the development of an Internet Acceptable Use Policy (IAUP). “Along with many HIPAA policies, we do have a definitive Internet and PC use policy,” said Skillingstad.
	Skillingstad explained that Mobridge Regional Hospital management holds Audit Meetings, at which time activity reports and HIPAA guidelines are discussed. “These things can snowball, and you have to have proof, it’s essential,” said Skillingstad. “Spector CNE gives us that.”

Spector CNE: The Software of Choice

Skillingstad termed the purchase of Spector CNE “such a good business decision.”

“Spector CNE has so many features,” said Skillingstad. “For ease of use, I give it high marks.”

Skillingstad also gives Spector CNE a superior rating when it comes to return on investment.

“When I request a purchase, I try to attach dollars to it,” said Skillingstad. “I did the math and took that to management. I came up with a per-employee savings projection of $3,640 a year.”

With approximately 50 employees using PCs, the potential yearly bottom line savings equates to more than $180,000.

“It’s ballpark,” said Skillingstad, “BUT SIGNIFICANT.”

	“The product will pay for itself and also take us where we need to be with HIPAA,” said Skillingstad. “Spector CNE is a great tool. It’s a real good way to comply with HIPAA.”
	Skillingstad especially likes Spector CNE’s ability to log EVERY keystroke. “The keystrokes feature is really an excellent way to look at what employees have done,” said Skillingstad. “Are they working a program they’re not licensed for, and what data are they entering? It’s just an excellent tool to track data being entered.”
	“If someone is suspected of serious or criminal activities, we have what we need,” said Skillingstad. “With Spector CNE we can know EVERYTHING. The reports will tell us ANYTHING we ever wanted to know.”
	“Spector CNE has freed up bandwidth and the network,” said Skillingstad. “It’s so great for controlling email, Internet activity, installs, and downloads.”
	“Spector CNE was easy to get out on the system,” said Skillingstad. “And SpectorSoft’s Technical Support is excellent. I handled the installation myself and I did something wrong – one little interpretation – and they addressed it fast and efficiently.”

Added Skillingstad:

	“It’s stopping the inappropriate behavior. It shows me what’s happening so we can implement sanctions if policy is abused.”
	“It’s definitely something that works well for us. I have shared this with other HIPAA Security Officers. I have told them how happy I am with it.”
	“You’re ahead of the game with CNE. As far as work behavior, it makes money for you.”

“Spector CNE has done everything it’s advertised to do,” said Skillingstad. “Everything we expected it to do … it can do. I feel strongly that it is worth it. It’s worth the price and more … you could get more for it if you wanted to.”

For more information about Mobridge Regional Hospital please visit www.mobridgehospital.org.

For more information about Spector CNE, please visit www.spectorcne.com … or for more information about SpectorSoft and its other dependable, full-featured PC and Internet Activity Monitoring Software products, please visit www.spectorsoft.com.

-- -- -- -- -- --