Home Internet of Things Aerospace Apparel Energy Defense Health Care Logistics Manufacturing Retail

Access This Premium Content

Options To Access This Article:

What Subscribers Are Saying

  • "Probably the best investment I've ever made."
    Steve Meizlish, President & CEO, MeizCorp Services, Inc.
  • "I have found that RFID Journal provides an objective viewpoint of RFID. It you are looking for a resource that provides insights as to the application and implications of deploying RFID, RFID Journal will meet your needs, It gives you a broad perspective of RFID, beyond the retail supply chain."
    Mike O'Shea, Director of Corporate AutoID/RFID Strategies & Technologies, Kimberly-Clark Corp.
  • "No other source provides the consistent value-added insight that Mark Robert and his staff do. In a world dominated by press release after press release, RFID Journal is developing as the one place to go to make the most sense out of the present and future of RFID in commerce."
    Bob Hurley, Project Leader for RFID, Bayer HealthCare's Consumer Care Division
  • "RFID Journal is the one go-to source for information on the latest in RFID technology."
    Bruce Keim, Director, Hewlett-Packard
  • "RFID Journal is the only source I need to keep up to the minute with the happenings in the RFID world."
    Blair Hawley, VP of Supply Chain, Remington Products Company

Access Controlled: Limiting Employee Tracking

RFID access cards can do more than let people into their workplace. If you're collecting information about your staff, here's what you—and they—need to know.
By Ann C. Logue
Feb 06, 2006—At lunchtime on July 16, 2003, a confused driver plowed his car into California's Santa Monica Farmers' Market. He stepped on the accelerator instead of the brake, killing 10 people and injuring more than 50. The market is a few blocks from RAND Corp.'s headquarters and is a popular lunch spot for RAND staffers. As employees received news of the accident, they wondered if any of their colleagues were hurt. Using data collected through RFID employee access cards, managers were able to determine who had left the building before noon but had not returned. Then, they were able to go to those people's departments and find out why they were absent.

Fortunately, no one from RAND was injured; the folks who had not returned were scheduled to be out of the office that afternoon. But there was a surprising side effect to the incident. RAND is a nonprofit research organization that has many classified and other government projects, and employees were aware that for security purposes their access cards tracked their comings and goings from the building. Each RFID access card has a unique identifier that is associated with an employee.

While RFID access cards can be used to infringe on employees' privacy, they also provide faster and easier access to facilities because employees just have to flash the card by an interrogator.
What they hadn't realized was how the time and entry/exit data their RFID access cards generated could be used. RAND had never disclosed its data usage policies to employees, and after the incident, employees found there was not a policy document to guide RFID data use.

Early in 2005, Tora Bikson, a senior behavioral scientist at RAND, coauthored a report on RFID in the workplace entitled "9 to 5: Do You Know If Your Boss Knows Where You Are?" It was inspired by the authors' curiosity about how their own employer was using information collected by RFID access cards.

Bikson's team looked at six businesses—two nonprofit organizations, two high-tech manufacturing concerns and two media-services companies—that were using RFID in employee access systems. What they found was troubling: "All but one use the personally identifiable data collected by the system to do more than open doors," according to the report.

Many businesses require employees to carry photo ID cards, often with bar codes or magnetic stripes that can be swiped to open doors. ID cards embedded with RFID tags, which have been used to control access in the workplace for more than a decade, tend to be more durable because they don't have to be swiped.

When companies install RFID systems, it's typically only afterward that someone—possibly in the human resources, security or legal department—is inspired to glean information from the data collected, says Bikson. "Records can be used in ways that personally identify individuals or in aggregate forms that limit the ability to identify individuals," according to the report. "In the former case, a typical use might be investigation of asset theft or of compliance with company timekeeping policies."

The researchers also found a lack of disclosure about data collection and use, poor or unstated data security and retention policies, and no accountability at the executive level. "Any reader who uses an RFID-based access card ought to be uneasy after seeing these results," say Bikson and her coauthors. "We are."

Employee Benefits
While RFID access cards can be used to infringe on employees' privacy, they also provide faster and easier access to facilities because employees just have to flash the card by an interrogator. And employers can use RFID access cards to increase worker safety and secure access to computer systems. Bayer AG issued RFID cards to 70,000 employees at three of its plants in Germany. The chemical company says the cards improve security and keep employees safe by limiting their access to areas with dangerous chemicals. And as RAND employees discovered, RFID access cards can help companies account for employees in the event of an accident or, say, a terrorist attack.

When the University of Colorado Hospital (UCH) moved in February 2004 to a new campus in the Denver suburb of Aurora, it issued RFID badges to all of its employees. The badges have multiple functions—parking lot access, building access and access to the computers that are connected to the clinical information system. Employees swipe their badges over a proximity card reader to enter their user name and domain (hospital or medical staff) and then use a keyboard to enter their password. After that, they can pull up their work just as they last left it from any computer in the facility by tapping their badge to a reader attached to the computer. To protect patient information, the system automatically closes a session when an employee walks away from the keyboard.

The single sign-on system uses badges from HID, proximity card readers from RF Ideas and the HealthCast medical data access platform. The only information on the card is the user's name and log-in domain. For security purposes, passwords are not stored on the badge. "It's faster. It has improved usability," says C.T. Lin, senior medical director for informatics at UCH.
To continue reading this article, please log in or choose a purchase option.

Option 1: Become a Premium Member.

One-year subscription, unlimited access to Premium Content: $189

Gain access to all of our premium content and receive 10% off RFID Reports and RFID Events!

Option 2: Purchase access to this specific article.

This article contains 2,808 words and 4 pages. Purchase Price: $19.99

Upgrade now, and you'll get immediate access to:

  • Case Studies

    Our in-dept case-study articles show you, step by step, how early adopters assessed the business case for an application, piloted it and rolled out the technology.

    Free Sample: How Cognizant Cut Costs by Deploying RFID to Track IT Assets

  • Best Practices

    The best way to avoid pitfalls is to know what best practices early adopters have already established. Our best practices have helped hundreds of companies do just that.

  • How-To Articles

    Don’t waste time trying to figure out how to RFID-enable a forklift, or deciding whether to use fixed or mobile readers. Our how-to articles provide practical advice and reliable answers to many implementation questions.

  • Features

    These informative articles focus on adoption issues, standards and other important trends in the RFID industry.

    Free Sample: Europe Is Rolling Out RFID

  • Magazine Articles

    All RFID Journal Premium Subscribers receive our bimonthly RFID Journal print magazine at no extra cost, and also have access to the complete online archive of magazine articles from past years.

Become a member today!

RFID Journal LIVE! RFID in Health Care LIVE! LatAm LIVE! Brasil LIVE! Europe RFID Connect Virtual Events RFID Journal Awards Webinars Presentations