Hospital encryption?

[jtfred]

forgive me for I’m not sure if this is the right area of the forum to post this, so I was in a a general discussion with another employee from the hospital I work at in the I.T dept. I was asking them about the radios they had purchased for the ED staff to use SAMCOM FPCN30A radios that are on GMRS frequencies (not sure what frequencies security is on), into the conversation they had mentioned that they had encrypted their radios for the hospital, For clarification and knowledge purposes I am under the impression that at least GMRS frequencies are not allowed to be encrypted, and for a hospital maybe encryption is different? I’m not to sure when it comes to a hospital entity. Any information will be appreciated and thank you in advance.

 

[AK9R]

There are no special provisions in the GMRS rules for hospitals.

Under GMRS rules, the service is defined as "A mobile two-way voice communication service, with limited data applications, for facilitating activities of individual licensees and their family members, including, but not limited to, voluntary provision of assistance to the public during emergencies and natural disasters." GMRS licenses are required and those licenses are only available to individuals, not corporations, businesses, or organizations. Some non-individual persons (i.e., a partnership, corporation, association or governmental unit) that were licensed to use GMRS frequencies prior to July 31, 1987 are allowed to continue to operate under those old licenses, but there are strict limits on what they can do.

Transmitters used in GMRS must be certified by the FCC for GMRS (Part 95E). These certified transmitters can only use FM voice, though location data or brief text messages may be transmitted. I see no provisions in the GMRS rules for "encrypted" voice transmissions.

 

[DaveNF2G]

Anything other than analog FM voice and certain kinds of signaling (DTMF, etc.) violates FCC rules for GMRS.

 

[jtfred]

That’s what I was just reading on several other sites too and the fcc about encryption not being allowed on FRS, GRMRS and MURS radios.

 

[k2hz]

forgive me for I’m not sure if this is the right area of the forum to post this, so I was in a a general discussion with another employee from the hospital I work at in the I.T dept. I was asking them about the radios they had purchased for the ED staff to use SAMCOM FPCN30A radios that are on GMRS frequencies (not sure what frequencies security is on), into the conversation they had mentioned that they had encrypted their radios for the hospital, For clarification and knowledge purposes I am under the impression that at least GMRS frequencies are not allowed to be encrypted, and for a hospital maybe encryption is different? I’m not to sure when it comes to a hospital entity. Any information will be appreciated and thank you in advance.

It is a 5W radio so a license is required.
Hospital is not eligible for GMRS license and encryption prohibited on GMRS frequencies.
Use by a hospital would require frequency coordination and licensing under FCC part 90 on an authorized Business frequency.
So, operation as described is unlicensed in violation of 47 USC 301.

 

[murse_joe]

Are you sure they're on GMRS? The radio just says UHF programmable https://www.amazon.com/SAMCOM-Rechargeable-FPCN30A-Battery-Function/dp/B0969M6CR2

Maybe they just said GMRS to make explaining it easier but they're on their own UHF frequency.

 

[jtfred]

It is a 5W radio so a license is required.
Hospital is not eligible for GMRS license and encryption prohibited on GMRS frequencies.
Use by a hospital would require frequency coordination and licensing under FCC part 90 on an authorized Business frequency.
So, operation as described is unlicensed in violation of 47 USC 301.

Ahh gotcha, this honestly was what I was looking for.

Are you sure they're on GMRS? The radio just says UHF programmable https://www.amazon.com/SAMCOM-Rechargeable-FPCN30A-Battery-Function/dp/B0969M6CR2

Maybe they just said GMRS to make explaining it easier but they're on their own UHF frequency.

Yeah when I was in the emergency department and caught a glimpse of the radios I took a picture at one point to check for my own reference, they are transmitting and receiving on frequency 462.550.

 

[k2hz]

Are you sure they're on GMRS? The radio just says UHF programmable https://www.amazon.com/SAMCOM-Rechargeable-FPCN30A-Battery-Function/dp/B0969M6CR2

Maybe they just said GMRS to make explaining it easier but they're on their own UHF frequency.

Note that it is advertised as "Adult Walkie Talkie". I don't know about the specifics of this radio but most come pre-programmed for GMRS and/or the "Color Dot" frequencies. Users ignore the need for licensing in GMRS, if eligible, or licensing and probably reprogramming for Part 90 frequency use.

 

[KC3ECJ]

I worked at a place where they had some of these Samcoms.

The front ends on them didn't seem too good.

I was using a DMR radio that was some off brand name that Motorola used.

We were using Tier II DMR.

The Samcoms would pick up interference from the Motorolas.

 

[k2hz]

I worked at a place where they had some of these Samcoms.

The front ends on them didn't seem too good.

I was using a DMR radio that was some off brand name that Motorola used.

We were using Tier II DMR.

The Samcoms would pick up interference from the Motorolas.

Typical Cheap Chinese Radio. Advertising says "FCC certificated SAMCOM walkie talkie for adults" and nothing about license requirements. So, like most CCRs, most users just buy it and use the preprogrammed frequencies.

 

[K6GBW]

Seriously? A hospital is using these? Most hospitals these days use an internal phone system that runs on the WiFi. Discussing anything to do with patients needs to be encrypted or they risk HIPAA violations. If they are actually doing this..especially on GMRS they are stupid.

 

[MTS2000des]

You'd be surprised. Mickey Mouse administrators are all about saving bucks. They'll call Bearcom and get a quote for 5 figures for some MotoTRBO radios with proper licensing and all, and they'll just go to Chinazon and buy those "adult walkie talkies" for a few hundred bucks and get attboy/attagirls from their admin/finance folks. Happens every day.

 

[K6GBW]

No, I wouldn't. I spent thirty years as a cop at UCLA. I know some of the dumb stuff admins can do!

 

[jtfred]

Seriously? A hospital is using these? Most hospitals these days use an internal phone system that runs on the WiFi. Discussing anything to do with patients needs to be encrypted or they risk HIPAA violations. If they are actually doing this..especially on GMRS they are stupid.

Yeah we have an internal phone system on WiFi here at the hospital which nurses doctors and ward clerks/ technicians are supposed to be using but in honest typical fashion our I.T director from 3 years ago wanted to “save” money (haha) and ordered these for the emergency room, I have a police scanner that I use and pick up their frequency regularly on Gmrs, sadly things do get said on the frequency that violates HIPPA, been trying to go on the best way to report it to the FCC or maybe another agency that would be appropriate to handle this.

 

[kf8yk]

...been trying to go on the best way to report it to the FCC or maybe another agency that would be appropriate to handle this.

You might want to reach out to whoever handles JCAHO compliance or patient safety at your hospital. Two way radios in a health care environment can be a concern for both privacy/HIPAA as well as patient safety from interference to electronic medical systems.

Another approach would be your legal department. With the potential for stiff FCC fines, HIPAA violations & the general aversion of risk most hospital lawyers have they might put an end to this.

Does your facility have a policy? Here's an example: https://www.uab.edu/medicine/obgyn/images/Residency/Cell_Phone_Policies.pdf

 

[SuperFlyEDSguy]

You might want to reach out to whoever handles JCAHO compliance or patient safety at your hospital. Two way radios in a health care environment can be a concern for both privacy/HIPAA as well as patient safety from interference to electronic medical systems.

Another approach would be your legal department. With the potential for stiff FCC fines, HIPAA violations & the general aversion of risk most hospital lawyers have they might put an end to this.

Does your facility have a policy? Here's an example: https://www.uab.edu/medicine/obgyn/images/Residency/Cell_Phone_Policies.pdf

Maybe OP should even do so anonymously because the potential backlash is sadly very real.

 

[SuperFlyEDSguy]

Ahh gotcha, this honestly was what I was looking for.

Yeah when I was in the emergency department and caught a glimpse of the radios I took a picture at one point to check for my own reference, they are transmitting and receiving on frequency 462.550.

That’s GMRS-15 and there’s no way to make it HIPAA compliant as it needs to broadcast without encryption to also be FCC compliant. I’ve met far too many people that think CTCSS and DCS are bona fide methods of encryption, yet all they do is mute the non-tagged traffic coming into your radio. They would absolutely still transmit “in the clear” for anyone to listen in on. Now, those radios do have a “SCR” feature that appears to be a legitimate form of encryption, however they would need to legally use UHF channels to do so. They may possibly be able to use the SCR feature with MURS, but I would have to check to be certain, however GMRS is certainly not designed for encrypted communication. I personally wouldn’t even have simple security or bouncers at a nightclub on such a system as anyone could easily listen in, so certainly not a hospital by any stretch of the imagination! You should ensure the privacy officer or similar knows, however I would strongly suggest doing it anonymously to ensure that there would be no potential retaliation. Good call on your end!

 

[wtp]

the manual says 406.1 to 470

 

[mmckenna]

Before using the HIPAA argument, you should have whoever handles the HIPAA compliance to clarify about patient information over the radio and the need for encryption.

HIPAA does not require encryption when first responders are handling emergency patient care over the radio.
That may be different inside the walls of the hospital, but the compliance officer could confirm that. Be careful using a hobby radio forum as the basis for your argument.


Businesses -can- use GMRS if they are properly licensed. If they had a valid GMRS license before the rules changed back in the late 90's, then they would still be legal. Would be surprised if they had a valid license, but I do know of more than a few businesses that -do- have valid GMRS licenses and can absolutely, legally, use GMRS for their business. Those radios, however, are not legal for use on GMRS, even without the encryption.



Using GMRS for this application is a poor choice, legal issues aside. Obvious someone went on Amazon, searched "Walkie Talkie" and hit "buy it now" on the first thing that looked cool and was cheap. Not the first or last time that'll happen.

Yeah we have an internal phone system on WiFi here at the hospital which nurses doctors and ward clerks/ technicians are supposed to be using but in honest typical fashion our I.T director from 3 years ago wanted to “save” money (haha) and ordered these for the emergency room,

There are some very good WiFi push to talk radios that will do exactly what they need, would be HIPAA compliant, and would utilize the existing infrastructure you already have.

I have a police scanner that I use and pick up their frequency regularly on Gmrs, sadly things do get said on the frequency that violates HIPPA, been trying to go on the best way to report it to the FCC or maybe another agency that would be appropriate to handle this.

FCC probably isn't going to give you the response you desire. They aren't going to show up at the hospital and hand them a fine. Best you'd get would be a call from the local FCC office asking a few questions and reminding them of the rules. If you kept complaining, they may eventually get a bit more serious. But the process is usually a verbal warning, a written warning, a few more warnings, lots of time, eventually a Notice of Apparent Liability. The NAL could be handled by a good attorney from the hospital claiming ignorance and then fixing the issue.

In other words, that's not going to get you far. At least not quickly.

Your best option is to use what you have. If you are in IT, then talk to your managers and let them know what you found. Explain the HIPAA concerns and show them that you can listen on your scanner.
Explain the FCC Part 95 rules about encryption not being permitted.
Explain that the FCC requires a valid GMRS license to use those frequencies and that the hospital will not qualify for that license if they do not already have one.
Explain that the radios purchased do not have proper FCC Type Approval for use on those frequencies.

Be prepared to back all that up with sections of the FCC Part 95 rules.

Then offer them a few solutions:

WLAN | Network | Products | Icom America.

Icom,America,Land Mobile,Marine,Aviation,Amateur,Network,Systems

www.icomamerica.com

Or any of the similar products out there on the market, including some cheaper Chinese products.

And then be ready to let this all go. Amazon/YouTube has led thousands of random people to assume they are now two way radio experts. This happens all over the country every day. The GMRS frequencies are full of this sort of stuff. It's good that you want to fix this, but it sounds like the deck is kind of stacked against you. Don't risk making those above you unhappy.

 

[n3obl]

And more than likely whats gonna happen is your job becomes on the line.

I have a local er that uses analog radios in their er with a low power repeater on site. The signal does not travel far from property. Here stuff like whats coming in via EMS from med control dispatchers, housekeeping need room xx cleaned, need someone to take 15 to xray etc. Dont think i ever heard a name mentioned which is usually required for a hipaa violation.