Article

Protecting privacy: A job for HR kiosks

Believe it or not, many companies put privacy low on the list of requirements for HR kiosk solutions. Most people like their privacy, so this issue should be well considered before planning a deployment.

November 1, 2004

Do you like your privacy? Most people do, especially when it comes to personal information. While you may choose to share certain things with your coworkers, chances are you don't reveal your medical history, your Social Security number, or your unlisted telephone number. How would you feel if your coworkers inadvertently read such personal information about you simply by using your employer's human resources (HR) kiosk? You'd be angry, and rightfully so.

Describing this scenario to your clients planning HR kiosk deployments will certainly bring the issue of privacy to their attention. Believe it or not, many companies put privacy low on the list of requirements for their solution, according to James Kruper, president of KioWare, a kiosk software development company. He said most of his company's clients are very concerned about privacy. "However, I am surprised that there are still some who claim that it is the employee's responsibility to ensure their privacy." 

In some companies, for example, employees are expected to immediately log off after using the kiosk. Failure to do so exposes the employee's information to the next user. "In this scenario, the most positive outcome will be less and less use of the kiosks as employees inadvertently expose their confidential data," explains Kruper. "The worst is a lawsuit against the company." Kruper acknowledged that it is also uncomfortable for the person accidentally coming across someone else's personal information.

New regulations often make privacy a legal issue, as in the healthcare market. "With the new HIPAA (Health Insurance Portability and Accountability Act of 1996) requirements, our clients are very concerned about their employees' privacy,"

When privacy is well-considered, HR kiosks are valuable to employers and employees alike.

said Ed Crowley, vice president of sales and business development for 5Point, a complete kiosk solution provider.

The growing HR self-service market Addressing HR kiosk privacy is vital if you want to grab a piece of a growing market. A recent Forrester Research report predicts that 80 percent of employers will adopt some type of HR self-service technology by 2008. Self-service applications will include personal data management, benefits enrollment and time reporting. The Forrester report noted that companies reach out electronically to their employees to strengthen relationships and streamline operations. Routine tasks such as benefit enrollment can be easily handled using a kiosk.

Privacy: Protection and perception Heidi E. Duthoy, marketing analyst for KioWare, authored a white paper for the company discussing HR kiosk applications. Duthoy stressed the confidential nature of HR information and pointed out that it is important that "the kiosk's physical design and placement, as well as programmatic function, protect that information."  

Vision barriers and monitors with reduced fields of view limit unauthorized third-party viewing. Kiosk placement is an important privacy consideration as well. Kiosks placed in alcoves offer privacy, and also appear more secure to potential users. The perception of security can impact kiosk usage. "It is only when the user perceives it (privacy) to be high that they will be comfortable using the kiosk," Kruper explained.

Crowley lists several additional integrated peripheral options that protect privacy. These include privacy wings, privacy filters, Web cameras, biometric devices and ring-down terminals.

Switches and mats Peter Nelson, president of Larco Manufacturing, acknowledges that privacy issues abound as kiosk and ATM usage becomes commonplace. He points to instances where users unexpectedly leave a kiosk unattended, to care for a fussy or wandering child, for example. Users can also be in a hurry, or simply forgetful, and walk away from the kiosk.

Nelson's company manufactures mats and presence sensors that, used in conjunction with kiosk software, provide additional security. The flat, rubber mats are conspicuous, and come in a variety of colors. They resemble a boot tray used for wet footwear. For aesthetic reasons, the mats can be used inconspicuously underneath floor carpet or vinyl tile. In either case, the mats are activated by the weight of the kiosk users. When a user walks off the mat, the software reverts to a logon screen and deletes session variables. 

Presence sensors are built into nearby walls or directly into kiosk enclosures. According to Nelson, ultrasonic sensors are the most reliable and preferred type, although infrared sensors are also available. The presence sensor is activated when someone comes within a certain distance of the kiosk, allowing the kiosk screen to flash or change.

While mats and presence sensors may seem simplistic, Nelson cautions that they are actually quite complex. "They are smart devices that communicate through the USB port," said Nelson. Unlike a light switch, these devices do not simply switch off and on. Instead, they communicate keystrokes to the PC to sign out users.

Incorporating mats and presence sensors is best done prior to kiosk deployment, by integrating the devices into the kiosk software. "The key is to address security early in the process," adds Nelson.

Software safeguards "It is critical that when a user session is over, that all traces of that user's data disappear from the kiosk immediately," said Kruper. An inactivity timer simply waits until the application hasn't been used for a defined period of time and logs off the user. There are drawbacks to this method, however, according to Kruper. "This is less than ideal because if it (the timer) is set too long, then a new user can step up to the kiosk before it resets." Setting the timer for too short of a time period logs off users who simply paused and took too long retrieving something from a wallet or purse. 

Kruper pointed out that paper retraction, while often overlooked, is an important security measure integrated into the software. "Most printers will retract after a time," Kruper explained. "But to be truly secure, when you walk away, the paper is immediately sucked back into the printer." Otherwise, printed personal information is left at the kiosk for the next user to view or even take.

Application resetting is another important security feature incorporated into kiosk software. It is important that the application resets from whatever page the last user was on to a logon page or attract screen. A new user could be confused when presented with a page that is 10 levels down into the HR application, without knowing how to return to the logon page. More importantly, a new user would know what page the previous user viewed, such as the company's drug addiction treatment information page.

Locking up a kiosk solution With the variety of hardware and software safety measures available, protecting privacy should be easy. Crowley cites an example of a customer that incorporated a number of features in one kiosk. The kiosk includes privacy wings, an LCD privacy filter, and a security mat that allows users to access the application portal only when they are standing on the mat. As an added level of security, the printer is configured to automatically retract the paper and hold it in the secure lower enclosure until retrieved by authorized personnel. The kiosk is also equipped with a ring-down terminal that allows users to dial the help desk if they need assistance.

"The wonderful thing about providing complete self-service solutions for the human resources market is the requirements for these self-service kiosks actually cross all traditional vertical market boundaries," stated Crowley. "The need to reduce the cost associated with employee benefits and the requirement to provide these services in a convenient 24/7 accessible environment for all employees extends to all traditional markets. These important requirements have positioned the self-service industry and specifically the self-service human resources market as one of the truly hot kiosk markets for today and tomorrow."