Mobile and Desktop Device Encryption FAQs

Laptop and Desktop Encryption makes the hard drive of your laptop unreadable without proper authentication.

When you encrypt your laptop or desktop's hard drive, the entire contents of your computer becomes unreadable to anyone who lacks the proper credentials to log on to your system.

New federal and state data protection laws mandate that all portable devices that access or allow access to Protected Health Information (PHI) or Personal Identifiable Information (PII) be encrypted. It is essential that Mass General Brigham safeguard its privileged information against this kind of loss.

Mass General Brigham’s policies mandate that all laptops, that access the Mass General Brigham network and internet-based resources or store Mass General Brigham Confidential Data, be encrypted.

No - Tablets, Smartphones and Netbooks* must be encrypted. Also, it is recommended to encrypt desktops.

• Mac computers used for business purposes must be enrolled in PEAS. See PEAS FAQs for details.
• Apple iPhone and certain Android phones must enroll in the Mobile Management system AKA Ivanti Go. See https://rc.partners.org/search?keys=mobileiron for full details.

If laptops, Tablets, Smartphones and Netbooks* access Mass General Brigham resources or store Mass General Brigham Confidential Data, they must be encrypted. Examples of access to resources include:

• Mass General Brigham VPN
• Email via Outlook Web Access
• Patient Gateway
• Access to LMR Over the Internet (LOTI)
• GoToMyPC
• Workspace apps like Epic and UKG Dimensions
• Any other Mass General Brigham applications or internet-based resources.

Users may not connect unencrypted devices to the Mass General Brigham network except for the following purposes:

• Accessing Peoplesoft to view an individual’s personal information
• Accessing HealthStream for training purposes
• Using My Profile for the individuals’ own password self-service needs

Yes, Mass General Brigham’s policies require all laptops that connect to Mass General Brigham resources to have their entire hard drives encrypted with approved encryption software.

All employees, contractors, or vendors who have laptops, which connect to Mass General Brigham resources regardless of the data maintained on the device, must have hard drive encryption installed.

If you use your personal laptop to store Mass General Brigham Confidential Data or to access Mass General Brigham resources, you must encrypt it.

At this time, Mass General Brigham does not require you to encrypt your non-laptop home computer if it is used to access Mass General Brigham resources.

Mass General Brigham clinical workstation builds are presently exempt from the laptop encryption requirement.

An Mass General Brigham clinical workstation is a desktop or laptop located in clinical areas of the hospitals. They are highly restrictive builds that run a subset of approved applications.

These workstations are used by multiple individuals and have fast log on and log off procedures.

Mass General Brigham laptop: Yes, multiple users accounts can share an encrypted device. Example: If two colleagues share a Mass General Brigham laptop, each user must have their own McAfee encryption and Mass General Brigham accounts. Please call your IS Service Desk for assistance with configuring the device for multiple users.

Personal laptop: No, you may not share a personal laptop with non-employees if the device has been encrypted and is used to connect to Mass General Brigham resources. Sharing your encryption password with anyone is prohibited by law. Example: You have a personal laptop that you use to check email with Outlook Web Access. This laptop must be encrypted and cannot be shared with non-employees.

Encryption is supported on the following operating systems.

*Chromebooks do not support Mass General Brigham encryption standards. 

Mass General Brigham does not currently offer encryption software for Linux laptops. Employees with Linux (or derivatives) laptops should secure their devices with the encryption product of their choice.

For managed Mass General Brigham Computers running Windows, we are using built-in Bitlocker.

For non-standard Windows Computers, including personal laptops we are using McAfee Endpoint Encryption*. People may choose to activate Personal Bitlocker on Windows Professional systems.

For MacOS Computers, we are using built-in FileVault 2.

Bitlocker, McAfee Endpoint Encryption®, and FileVault 2 are the only supported encryption programs.

• 256-bit key strength;
• Use of the Advanced Encryption Standard (AES) or other FIPS 140-2 validated algorithm;
• Full disk encryption for all files (the entire disk must be a private partition); and
• Support for strong password enforcement

Full disk encryption means that the entire content of the hard drive is encrypted. This includes the operating system itself, program files, swap space, and temporary files.

Full disk encryption is considerably more secure than file encryption solutions since it ensures that all data is encrypted, not just the files you remember to encrypt.

Yes. Mass General Brigham's vendors and contractors that access protected health information (PHI) and/or personal identifiable information (PII) on portable devices are required to use encryption.

Going forward, Mass General Brigham and entity Business Associate Agreements have been updated to reflect this requirement.

Yes. You can set up your own user name and password for Macintosh, Personal Windows Professional using BitLocker, and Linux encrypted laptops. You are not required to use your Mass General Brigham user name and password.

McAfee Endpoint encryption however uses your current and active Mass General Brigham User ID.

MGB managed devices will prompt you for necessary information when you log in using your MGB credentials.

You must contact the IS Service Desk to be added to a personal or lab device's McAfee Endpoint Encryption or  enrolled in PEAS and FileVault.

No. Laptop encryption software is provided for free to Mass General Brigham employees°.

All Mass General Brigham Standard Desktop and Laptop Windows 10 computers use the built-in encryption called Bitlocker.

° Users with personal or non-standard devices requiring a Windows Professional upgrade will not be compensated by MGB

Back to top

Your system must have 30MB of free disk space. McAfee is supported on the following operating systems:

• Microsoft Windows 10

Please refer to our list of know incompatible laptops: https://rc.partners.org/kb/article/2877

To have a laptop encrypted please see HOWTO: Request Installation of Encryption Software 

Right click on the McAfee icon in your toolbar and select "show status." You should see C:\Full in green on the right of the window. This means that your hard drive is completely encrypted.

• Passwords for laptop encryption must be 8 characters in length and contain at least one letter and one number.
• The system will remember previously used passwords and prevent them from being used again.
• You will be required to change your password every 180 days. You will receive a reminder 7 days in advance.
• After entering an incorrect password 3 times, you will be locked out for 5 minutes.
• After 10 incorrect attempts at entering a password, you will have to call the IS Service Desk to regain access to your laptop.

You can use your Mass General Brigham logon for your McAfee account, but note that your Mass General Brigham logon will not be in sync with your McAfee account.

If you update your password for your Mass General Brigham logon, your McAfee password will not be affected.

On the log in screen select Options/Recovery/ user recovery/ question and answer recovery.
You will be required to answer the security questions that you originally set up when you first logged in to McAfee Endpoint Encryption®

Otherwise, contact the MGB IS Service Desk if you forget your password.

8. What happens if I don't log in to my laptop at least once a year?

Laptops must synchronize with the server once every year. Your laptop needs to be connected to the internet to synchronize with the server.

When a laptop goes more than a year without synchronizing with the server, it will lock down. You will need to call the MGB IS Service Desk to restore access.

9. I am no longer using my computer to access Mass General Brigham resources. How do I uninstall encryption?

Call the MGB IS Service Desk to have Encryption removed from your device.

Back to top

MacOS 12 or greater. NOTE: Mac devices used for business purposes must have macOS 12 or later installed to comply with Mass General Brigham policies.

You must enroll in PEAS which will automatically enable encryption.

Macintosh Computers running OS X 11 or greater can use the Time Machine utility included with their Operating System.

A 500GB drive can take upwards of 6 hours to encrypt. However, you may continue to use your laptop normally while it encrypts.

You will be able to use your Mac normally as it is being encrypted. 

Here are instructions on how to verify your hard drive is encrypted.

Call the IS Service Desk to have PEAS, Filevault, or PGP Whole Disk Encryption removed from your device.

Back to top

New federal and state data protection laws mandate that all portable devices that access or allow access to Protected Health Information (PHI) or Personal Identifiable Information (PII) be encrypted. It is essential that Mass General Brigham safeguard its privileged information against this kind of loss.

Mass General Brigham's policies mandate that all mobile devices that access the Mass General Brigham network and internet-based resources or stores Mass General Brigham Confidential Data be encrypted.

Please review the Portable Device Security Policy