The title almost seems silly, doesn't it? You're taking your group into the back country - off the grid or otherwise away from our always-connected world. How could information security possibly play into your duties?
As an expedition medical provider, you are going to be entrusted with a variety of medical information before the trip starts-typically as pre-participation medical forms. Unless you're collecting paper forms, you're going to have other people's private health information in an electronic format and will be responsible for keeping that sensitive information secure.
The three core principles of information security are straightforward:
* Confidentiality: Only people who need to know it should be able to view protected information.
* Integrity: Only people who need to update it should be able to change protected information.
* Availability: Information should be accessible to authorized people whenever they need it.
Confidentiality is the most obvious aspect of information security, dating back to Cold War, espionage-focused computer security. When it comes to medical records, no one is expecting James Bond-level threats, but you should take reasonable precautions to keep your team's medical records secure while they are in your care. It's certainly an ethical obligation, and may be a legal one as well, depending on your relationship to your team.
Integrity is not typically relevant to a wilderness expedition's medical records.
Availability is a paramount concern in medical settings: what good is having data if the medical provider cannot get to it in case of emergency?
If you are collecting pre-participation forms from your team, arrange to get and store them securely. Be aware that electronic mail is more like a postcard than a letter: every service provider who handles an email can read the contents. Securing email is a difficult problem and it is usually simpler to avoid it. Instead, it is a good idea to collect protected data face to face. Virtually all computers and many other mobile devices can use USB thumb drives to transfer data files, and many more can use device-to-device file sharing, which avoids extra copies being uploaded to servers by sending the file directly.
It is even more secure to collect paper forms, whether printed out by you or the participant, rather than electronic copies. Once you have paper copies, a home scanner can be used to quickly convert them into PDF files, a universally readable format. If you do make electronic copies of your participants' medical forms, make sure you keep them from being backed up, synchronized, or uploaded to “cloud” services.
During your travels, medical information needs to be readily available in case of emergency. That may mean electronic copies on your mobile device and perhaps team leaders’ as a backup. Electronic devices holding copies of records should have a basic passcode or locking screen enabled. However, electronic devices can break or run out of power, so it is appropriate to carry paper forms as well. Paper forms, while more durable than electronics, are still subject to water damage, so they should be stored in a waterproof container. To keep each participant's data private, store paper copies in individual tamper-evident envelopes to provide some privacy protection without adding a lot of weight.
Once you've returned from your expedition, destroy medical information that you no longer need. Unless you have an ongoing relationship with your participants, that likely includes their pre-participation forms.
If you've kept paper copies, returning the forms to their owners is simple. If you have electronic copies, delete them from the computer you used to scan documents, your email inbox and server, and the electronic device(s) holding copies on the trips. Be aware that deleting a file doesn't actually remove the contents from the device memory or hard drive - it just tells the computer that it can store new information in that spot as needed. Even doing a factory wipe of many devices will not physically erase the electronic information from memory. For this reason, never let go of computers, USB drives, memory cards, or mobile devices without first performing a “low level” data overwrite. Often, it is simpler to physically destroy the device.
While there are many more things that can be done, this article reviews basic data protection. If you act on these few tips, you can reduce the risk that your team's personal data will be either disclosed inappropriately or inaccessible in case of medical need.