<p>I cannot find a defined &quot;Gold Standard&quot; within the US, but there is <a href="https://www.waterstons.com/articles/achieving-the-gold-standard-in-information-security" rel="nofollow noreferrer">ISO27001:2013</a> here in the UK and the European Union. More can be found from <a href="https://www.itgovernance.co.uk/iso27001" rel="nofollow noreferrer">this IT Governance website</a>.</p>
<p>There is also suggestion that you should also follow <a href="https://www.iso.org/standard/61498.html" rel="nofollow noreferrer">ISO27018:2014</a> if you are storing data in public cloud systems.</p>
<p>In absence of any defined &quot;Gold Standard&quot;, you can choose to follow these standards, and if you are not following the &quot;Gold Standard&quot;, you need to be able to justify your data protection procedures to any governing body who may be auditing you for compliance with their rules and regulations or when investigating any data breach.</p>
<p>Some say that <a href="https://www.theregister.co.uk/2017/04/18/protect_your_digital_enterprise_iso_27001_explainer" rel="nofollow noreferrer">just following a &quot;Gold Standard&quot; is not enough</a>.</p>
<p>The one thing you should do is regularly review your procedures to ensure you are doing everything <strong>reasonably practicable</strong> to ensure personally identifiable data is kept secure from unauthorised access. Do you have a copy of <strong>your</strong> data protection policy and procedures which <strong>you personally follow and regularly review</strong> and sign off as reviewed? If not, I would put one together and sign it off regularly at review as that would demonstrate your commitment to protecting client's personal information.</p>
<p>One major key point you need to remember with data protection is that you must protect the data from unauthorised access <strong>at all points of access</strong>.</p>
<p>The following is in response to your individual questions.</p>
<blockquote>
<p>Is it enough to put the electronic storage device (laptop, hard drive, flash drive, whatever) inside a locked room in a locked house?</p>
</blockquote>
<p>When reviewing your data protection policy and procedures, you should ask this question to yourself along with <strong>who has access to the keys to the locked room?</strong></p>
<p>If <strong>anyone</strong> not authorised to access the personal data has access to the keys then the answer in my view is that it is not enough. Otherwise, how are you going to prevent unauthorised access by others who have access to the keys to the locked room?</p>
<blockquote>
<p>Is it enough to password protect the storage device, and put it in a locked building</p>
</blockquote>
<p>With regard to locking the storage device in a building, that is covered in the previous question. <strong>Password protection can add further protection, but is it enough?</strong> This goes with your 3rd question</p>
<blockquote>
<p>Is it enough to password protect the storage device, and password protect the folder/file</p>
</blockquote>
<p>This is not straight forward to answer and will depend on many different factors.</p>
<p>If the <a href="https://www.howtogeek.com/195430/how-to-create-a-strong-password-and-remember-it" rel="nofollow noreferrer">password is strong</a>, the storage device remains in the one room, and is always locked away when unattended then passwords will provide extra protection but will it be enough protection from theives who might break in and steal the storage device?</p>
<p><a href="https://support.microsoft.com/en-gb/help/4028713/windows-10-turn-on-device-encryption" rel="nofollow noreferrer">Windows 10 provides device encryption</a>, but <strong>not Windows 10 Home</strong> it needs to be Windows 10 Pro or Enterprise. Encryption will prevent data from being read if the harddrive was removed and transferred to another computer.</p>
<p>There is 3rd party software available for device encryption and each one is different to the other on strength of encryption, security and cost.</p>
<p>If you are talking about files such as Microsoft Word documents or Excel files, you can password protect the file from being read, and in this case, Microsoft Office encrypts the file. If stored on an encrypted device, this double encrypts the file from access.</p>
<p>These are things to think about.</p>
<blockquote>
<p>And what about files in the cloud?</p>
</blockquote>
<p>In response I would ask <em>Do you <strong>really</strong> need to store the data in the cloud?</em></p>
<p>If so, then I would be <strong>very</strong> picky as to what cloud service you choose to use.</p>
<p>Ask yourself:</p>
<ol>
<li><strong>Who can access your data in the cloud?</strong></li>
<li><strong>Can the cloud service provider(s) access the data?</strong><br>I only know of one cloud service provider who has no access to your data. With them, the files are encrypted their end and if you forget your password, you have lost access to your data for good. There may be others but I don't know them if there are.</li>
<li><strong>If the cloud service provider can access your data, what is their policy with regard to Privacy and Data Protection? Is it in line with yours? - Keep an up-to-date copy with your policy and procedures</strong>.</li>
<li><strong>Is the data encrypted in the cloud?</strong></li>
<li><strong>Is the data transfer encrypted end-to-end when transferred between the cloud server and your storage device, and if so, how strong is that encryption?</strong></li>
</ol>
<p>These are just some questions you will need to find the answers to, and there may be others you feel need addressing.</p>
<p>Protection of digital data is not straight forward but if you think things through thoroughly and seek professional advice where needed you can devise a robust protection procedure which can be justified to any governing body.</p>
<h2>Links to sources provided in this answer</h2>
<ol>
<li><a href="https://www.waterstons.com/articles/achieving-the-gold-standard-in-information-security" rel="nofollow noreferrer">https://www.waterstons.com/articles/achieving-the-gold-standard-in-information-security</a></li>
<li><a href="https://www.itgovernance.co.uk/iso27001" rel="nofollow noreferrer">https://www.itgovernance.co.uk/iso27001</a></li>
<li><a href="https://www.iso.org/standard/61498.html" rel="nofollow noreferrer">https://www.iso.org/standard/61498.html</a></li>
<li><a href="https://www.theregister.co.uk/2017/04/18/protect_your_digital_enterprise_iso_27001_explainer" rel="nofollow noreferrer">https://www.theregister.co.uk/2017/04/18/protect_your_digital_enterprise_iso_27001_explainer</a></li>
<li><a href="https://www.howtogeek.com/195430/how-to-create-a-strong-password-and-remember-it" rel="nofollow noreferrer">https://www.howtogeek.com/195430/how-to-create-a-strong-password-and-remember-it</a></li>
<li><a href="https://support.microsoft.com/en-gb/help/4028713/windows-10-turn-on-device-encryption" rel="nofollow noreferrer">https://support.microsoft.com/en-gb/help/4028713/windows-10-turn-on-device-encryption</a></li>
</ol>

CC BY-SA 4.0
2019-01-02T23:29:20.193Z
Thank you, Chris, that was a beautifully well thought out and researched answer, and I really appreciate it.
Dragon
CC BY-SA 4.0
2018-11-30T15:19:13.737Z
2018-11-30T15:19:13.737Z
2020-06-17T09:55:31.633Z
Chris Rogers
<p>I am asking this question in the context of a U.S. (Massachusetts) psychologist performing IPA studies. The interviews will be conducted through Zoom mostly. The recorded interviews will be stored the only way they can be, which is digitally. Has anyone found a specific resource describing how psychologists have dealt with the confidentiality concerns of digital information storage? It used to be that the gold standard for double-locked storage of therapeutic records was to put them in a locked file cabinet or locked room in a locked building. Now that we have electronic records, what are people doing about that? Is it enough to:</p>

<ol>
<li>Put the electronic storage device (laptop, hard drive, flash drive, whatever) inside a locked room in a locked house?</li>
<li>Password protect the storage device, and put it in a locked building</li>
<li>Password protect the storage device, and password protect the folder/file</li>
<li>Something else?</li>
</ol>

<p>And what about files in the cloud? Is that a no-no, or is the password protection there sufficient for one of the locks?</p>

<therapy>
What is the current gold standard in double locked storage of therapeutic records?
Dragon
# What is the current gold standard in double locked storage of therapeutic records?

(Asked by: username_0 on 2018-11-21)

I am asking this question in the context of a U.S. (Massachusetts) psychologist performing IPA studies. The interviews will be conducted through Zoom mostly. The recorded interviews will be stored the only way they can be, which is digitally. Has anyone found a specific resource describing how psychologists have dealt with the confidentiality concerns of digital information storage? It used to be that the gold standard for double-locked storage of therapeutic records was to put them in a locked file cabinet or locked room in a locked building. Now that we have electronic records, what are people doing about that? Is it enough to:

1. Put the electronic storage device (laptop, hard drive, flash drive, whatever) inside a locked room in a locked house?
2. Password protect the storage device, and put it in a locked building
3. Password protect the storage device, and password protect the folder/file
4. Something else?

And what about files in the cloud? Is that a no-no, or is the password protection there sufficient for one of the locks?

**Tags:** therapy


---

## 1 answers

### Answer by username_1 on 2018-11-30. Score: 1 | Accepted answer

I cannot find a defined "Gold Standard" within the US, but there is [ISO27001:2013](https://www.waterstons.com/articles/achieving-the-gold-standard-in-information-security) here in the UK and the European Union. More can be found from [this IT Governance website](https://www.itgovernance.co.uk/iso27001).

There is also suggestion that you should also follow [ISO27018:2014](https://www.iso.org/standard/61498.html) if you are storing data in public cloud systems.

In absence of any defined "Gold Standard", you can choose to follow these standards, and if you are not following the "Gold Standard", you need to be able to justify your data protection procedures to any governing body who may be auditing you for compliance with their rules and regulations or when investigating any data breach.

Some say that [just following a "Gold Standard" is not enough](https://www.theregister.co.uk/2017/04/18/protect_your_digital_enterprise_iso_27001_explainer).

The one thing you should do is regularly review your procedures to ensure you are doing everything **reasonably practicable** to ensure personally identifiable data is kept secure from unauthorised access. Do you have a copy of **your** data protection policy and procedures which **you personally follow and regularly review** and sign off as reviewed? If not, I would put one together and sign it off regularly at review as that would demonstrate your commitment to protecting client's personal information.

One major key point you need to remember with data protection is that you must protect the data from unauthorised access **at all points of access**.

The following is in response to your individual questions.

> Is it enough to put the electronic storage device (laptop, hard drive, flash drive, whatever) inside a locked room in a locked house?

When reviewing your data protection policy and procedures, you should ask this question to yourself along with **who has access to the keys to the locked room?**

If **anyone** not authorised to access the personal data has access to the keys then the answer in my view is that it is not enough. Otherwise, how are you going to prevent unauthorised access by others who have access to the keys to the locked room?

> Is it enough to password protect the storage device, and put it in a locked building

With regard to locking the storage device in a building, that is covered in the previous question. **Password protection can add further protection, but is it enough?** This goes with your 3rd question

> Is it enough to password protect the storage device, and password protect the folder/file

This is not straight forward to answer and will depend on many different factors.

If the [password is strong](https://www.howtogeek.com/195430/how-to-create-a-strong-password-and-remember-it), the storage device remains in the one room, and is always locked away when unattended then passwords will provide extra protection but will it be enough protection from theives who might break in and steal the storage device?

[Windows 10 provides device encryption](https://support.microsoft.com/en-gb/help/4028713/windows-10-turn-on-device-encryption), but **not Windows 10 Home** it needs to be Windows 10 Pro or Enterprise. Encryption will prevent data from being read if the harddrive was removed and transferred to another computer.

There is 3rd party software available for device encryption and each one is different to the other on strength of encryption, security and cost.

If you are talking about files such as Microsoft Word documents or Excel files, you can password protect the file from being read, and in this case, Microsoft Office encrypts the file. If stored on an encrypted device, this double encrypts the file from access.

These are things to think about.

> And what about files in the cloud?

In response I would ask *Do you **really** need to store the data in the cloud?*

If so, then I would be **very** picky as to what cloud service you choose to use.

Ask yourself:

1. **Who can access your data in the cloud?**
2. **Can the cloud service provider(s) access the data?**  
   I only know of one cloud service provider who has no access to your data. With them, the files are encrypted their end and if you forget your password, you have lost access to your data for good. There may be others but I don't know them if there are.
3. **If the cloud service provider can access your data, what is their policy with regard to Privacy and Data Protection? Is it in line with yours? - Keep an up-to-date copy with your policy and procedures**.
4. **Is the data encrypted in the cloud?**
5. **Is the data transfer encrypted end-to-end when transferred between the cloud server and your storage device, and if so, how strong is that encryption?**

These are just some questions you will need to find the answers to, and there may be others you feel need addressing.

Protection of digital data is not straight forward but if you think things through thoroughly and seek professional advice where needed you can devise a robust protection procedure which can be justified to any governing body.

## Links to sources provided in this answer

1. <https://www.waterstons.com/articles/achieving-the-gold-standard-in-information-security>
2. <https://www.itgovernance.co.uk/iso27001>
3. <https://www.iso.org/standard/61498.html>
4. <https://www.theregister.co.uk/2017/04/18/protect_your_digital_enterprise_iso_27001_explainer>
5. <https://www.howtogeek.com/195430/how-to-create-a-strong-password-and-remember-it>
6. <https://support.microsoft.com/en-gb/help/4028713/windows-10-turn-on-device-encryption>

> **Comments:**
> **username_0**: Thank you, Chris, that was a beautifully well thought out and researched answer, and I really appreciate it.  

---

