When the software of an organization you work for reaches into a computer you own, and nobody tells you.
By Omar Nabil Metwally, M.D.
Tuesday, October 27, 2026
Originally published at keisenvpa.com on October 27, 2026.
The Last Day
October 23, 2026 was my last day practicing medicine in the United States. I spent part of it at home, at my own laptop, working in the electronic health record of a Corewell Health hospital. Corewell serves Epic to physicians’ own computers through Citrix, a remote-desktop product. Earlier that day, Citrix had asked for permission to inspect the devices on my network. It asked for nothing else.
Afterward, I could no longer take screenshots of my own screen, on my own computer. No one asked for my consent. No one gave notice or sent a memo. KeisenVPA, the documentation tool I build and use, simply told me there were no screenshots. When I called and texted the hospital’s Chief of Medicine, she acknowledged that screen capture had been disabled through Citrix, “just for Epic and Microsoft Outlook.”
The first-hand account, with my own caveats, is in my earlier post: Epic Privacy Violation. And Citrix. This essay is about the pattern that afternoon belongs to.
What Happened, in Plain Words
A remote-access window is supposed to be a window: a computer elsewhere draws a picture on your screen, your keyboard drives it, and the data stays on their side. But the program that draws the window also runs on your computer, with whatever permissions it was given. That makes it a lever. A setting changed on the other side (an employer’s, a hospital’s, a client’s) can change what your own computer may do; in my case, whether it may take a picture of my own screen.
Citrix documents features of exactly this kind. Its App Protection policies include anti-screen capture, under which screenshots and recordings of a protected window come back blank, greyed out or empty, and anti-keylogging, under which, while a protected window is in focus, other software on the computer reads scrambled text instead of your keystrokes (Citrix documentation, last published October 14, 2026; Citrix blog, May 21, 2019). I do not know which setting was used on my laptop. I know what it did.
There is a real reason for such controls: patient information should not leak to screen-scraping malware, and I take that seriously. The tool that came up empty was mine, and an institution may reasonably decide it does not want its record captured on a personal computer at all. My objection, and this is opinion, is not that the control exists. It is that it was switched on, on a computer I own, without telling me, and that nothing on my computer told me either.
“If someone else can change what your computer may do, you should be the first to know, not the last.”
Naming the Pattern
I use two terms for this. They are mine, I use them deliberately, and I define them so they can be argued with.
Corporate malware: software that an employer, hospital, client or vendor places or controls on a device you own, and that acts on that device without your informed consent. The test is not intent; most of this software is written for defensible reasons. It is three conditions together: your device, their control, no informed consent. A control you were told about, understood and agreed to is not corporate malware in my sense. The same control switched on silently is. I am not calling Citrix, or any vendor’s product, malware. Nor am I accusing the hospital, or anyone, of a crime; I am saying that, as I experienced it, the three conditions were present on my laptop that day. The term is about how a control is deployed on someone else’s device and whether they were told, not about the software itself.
Hostage employees: people who must accept software controlled by the organization they work for (as employees, contractors, or physicians with hospital privileges) on a device they own in order to keep working. I use “employees” loosely; in my own story, I held privileges at the hospital. The choice they are offered is to install it or not work. Agreement given on those terms is consent of a sort; it is not much of a choice, and it is not consent to whatever the software is later switched to do. A physician who charts from home. A contractor who must enroll a personal phone to read work email. A remote worker whose laptop is the only computer in the house.
These are opinion and vocabulary, not legal claims. Compliance and legality are different words, and an institution can follow its policy to the letter and still leave the person at the keyboard uninformed. I am not alleging that anyone broke a law. I am saying the arrangement deserves a name. I am a physician, not a lawyer, and nothing here is legal advice. The matter is disputed and pending counsel.
A Trend, Not an Incident
None of this is new, and it is not confined to medicine. A few dated public sources, in order:
- June 30, 2020. As work moved home during the pandemic, the Electronic Frontier Foundation reviewed employee-monitoring products and called them “bossware.” Every product it looked at could take frequent screenshots of a worker’s device; several recorded keystrokes; many offered remote, “silent” installation on worker computers “without their knowledge”; nine of the ten companies it looked at offered “silent” or “invisible” monitoring, and it named several whose bossware is “designed to be as difficult to detect and remove as possible.” EFF cautioned that its list “may not be representative of the industry as a whole” (EFF).
- July 29, 2021. The Center for Democracy & Technology published Warning: Bossware May Be Hazardous to Your Health, on monitoring software’s health risks and the gaps in federal protection (CDT).
- May 7, 2022. New York began requiring private employers that monitor employees’ phone, email or internet use to give prior written notice at hiring and to post it where employees can see it (N.Y. Civil Rights Law § 52-c). Being told is treated as the floor.
- October 31, 2022. The National Labor Relations Board’s General Counsel issued memo GC 23-02 on “intrusive or abusive” electronic monitoring. It listed keyloggers and screenshot software among the ways employers watch people who work on computers, including at home, and proposed that, where such monitoring is justified by business need, employers disclose to employees the technologies they use, why, and how they use the information (NLRB).
- February 14, 2025. The NLRB’s Acting General Counsel rescinded GC 23-02, with other memos, in GC 25-05 (NLRB).
- November 24, 2025. The U.S. Government Accountability Office released a report finding that digital surveillance can both help and harm workers’ health, that heightened stress and anxiety are a concern, and that “these effects can depend on employers’ practices”; it noted that several federal agencies had rescinded or were reviewing earlier guidance in 2025 (GAO-25-107126).
Read together, in my opinion, these describe a ratchet: the tools grow more capable, the remote-access client becomes the one program everyone must install, and the protection for the person at the keyboard depends on where they live and who holds office that year. I expect the ratchet to keep turning.
The boundary already exists: since 2019, Apple has offered a separate enrollment for personally owned devices, where “the user, not the organization, owns the device,” and the organization manages only its own accounts, settings and data (Apple Platform Deployment, page updated September 17, 2026). Whether an employer uses it is the employer’s choice.
Hostage Data
In my opinion, it should be illegal for an EHR company to hold patients’ or physicians’ data hostage. For health records, federal law already goes part of the way. The 21st Century Cures Act prohibits “information blocking,” with civil penalties of up to $1 million per violation for developers of certified health IT and for health information networks and exchanges (42 U.S.C. 300jj-52). Those penalties apply to conduct since September 1, 2023 (88 FR, July 3, 2023). HHS announced a crackdown in September 2025 (HHS), but I have not found a public record of that penalty ever being imposed.
For physicians, the protection is thinner. A practice that owns its records can invoke the same information-blocking rules against its own vendor (45 CFR 171.103). HIPAA also requires the vendor’s contract to make the practice’s patient records available (45 CFR 164.504(e)). A physician as a person has, as far as I can tell, no right of his own. Michigan law makes me keep my patients’ records for seven years and keep them available to patients, but it says outright that it does not create or change ownership rights to medical records (MCL 333.16213). Inside a hospital’s system, the notes we write, the templates we build and the record of our own work belong to whoever runs the system we were given. A rule that has not produced a single public penalty I could find, and a right a physician does not have, look much the same to the person locked out.
In my own small private practice, the records are my patients’ and my practice’s, and I am the one responsible for them under HIPAA. In one week in Dallas, over the Lunar New Year of 2026, I wrote the code myself to connect to two major EHR platforms, over FHIR (the open standard) and their own APIs. Then came a short phone call with an undisclosed large EHR vendor about reading my own practice’s records through its official API. I agreed to keep what was discussed on that call confidential, and I am not suggesting that anything in it was improper. Federal certification rules require EHR developers to publish any fees for their certified APIs in plain language and to keep those fees tied to cost (45 CFR 170.404). I do not know whether those rules reach the access a small practice needs to read its own records.
In the hospital, the record ran on Epic through Citrix. In both places, the way I could actually read what I had written was the screen in front of me. A screenshot is the oldest interface there is: what I am already allowed to see, kept a moment longer. When capture was switched off, through Citrix and without notice, I had no way left to keep what I could already see. That is what “hostage” means here. The data was not taken; every way out of it ran through someone else’s permission.
Where the Law Stands (as of October 2026)
The short answer: largely unsettled. I found no U.S. statute, regulation or court decision that deals specifically with software restricting functions such as screen capture on a computer the worker owns. I also found no court, anywhere, that has ruled on Citrix App Protection or similar controls. A few states require notice of monitoring. Consent and scope are open questions. And in 2025 the federal agencies that had flagged worker surveillance stepped back. The NLRB’s Acting General Counsel rescinded the 2022 electronic-monitoring memo (GC 25-05). The CFPB withdrew its worker-dossier circular on May 12, 2025 (CFPB). The Government Accountability Office reported that agencies had “either rescinded these prior efforts or are reassessing” them (GAO-25-107126).
What the law clearly covers. Three states require employers to give notice of electronic monitoring: New York (Civil Rights Law §52-c, since May 7, 2022), Delaware (19 Del. C. §705) and Connecticut (Conn. Gen. Stat. §31-48d, as amended by P.A. 26-73 from October 1, 2026). Connecticut’s law reaches only collection “on an employer’s premises.”
Maine goes further. Employees there may decline an employer’s request to install data-collecting apps on their personal devices for surveillance (26 MRSA §620-A(4)). The law does not say whether this covers an app installed for another purpose, such as remote access. It is enforced only through state fines of $100 to $500 per violation, provides no private right to sue, and contains no anti-retaliation clause.
HIPAA lets a hospital choose the security measures that protect patient data, endpoint controls included (45 CFR 164.306), and a hospital’s own risk analysis may lawfully lead it to block screen capture. The rule does not require screen-capture blocking or home-network inspection (164.312).
What it does not cover. In a 2014 Texas case, a federal court threw out an employee’s federal computer-crime and stored-communications claims after his former employer remotely wiped his personal iPhone. The court left his state-law claims undecided (Rajaee v. Design Tech Homes). That is one trial-court ruling, not a general rule.
Notice laws concern collecting information. As Citrix documents it, App Protection blocks capture while a protected window is visible (Citrix).
California enacted two workplace-surveillance laws on Sept. 30, 2026, both effective Jan. 1, 2027 (Governor; summary). AB 1331 bars employers from using surveillance tools to monitor workers in workplace bathrooms. AB 1883 bars AI-driven tools that read workers’ emotions or collect neural data. As reported, neither addresses software on a worker’s own device.
What is pending. The federal Stop Spying Bosses Act (S. 4831, H.R. 9402) was introduced in June 2026. It would require employers to disclose workplace surveillance and would bar collecting workers’ data while they are off duty, including at home. Both bills were referred to committee with no further action. They die if not passed before this Congress ends in January 2027.
Michigan. I found no Michigan law that requires employers to give notice of electronic monitoring. Michigan’s general eavesdropping and hidden-camera crimes require consent to record private conversations or private places (MCL 750.539c, 750.539d). They are not workplace notice laws and say nothing about blocking screen capture.
Michigan’s Internet Privacy Protection Act bars employers from demanding the passwords to workers’ personal online accounts. It also says it does not stop an employer from monitoring data on a device the employer paid for “in whole or in part,” or data “traveling through or stored on an employer’s network” (MCL 37.275). It says nothing either way about devices the employer did not pay for.
Two bills are pending. HB 4456 would let employers monitor employees’ communications only under a written policy each employee acknowledges, and only on devices the employer owns, never on the employee’s own. HB 5579 would require notice, written consent and an opt-out, would bar collecting data while employees are off duty, and would cover the vendors employers use for monitoring. Neither bill has had a committee hearing. Both die if the Legislature ends its 2025–2026 session, usually in late December, without passing them.
Most of these laws protect “employees.” Whether they reach a physician who holds hospital privileges is itself a question, although HB 5579’s definition includes independent contractors.
Outside the U.S. Spain bars employers from requiring software on devices that regular remote workers own (Ley 10/2021, art. 17(2)). The European Court of Human Rights lists advance notice first among six factors for judging workplace monitoring. It found a violation where the national courts never asked whether the employee had been told in advance (Bărbulescu v. Romania, Grand Chamber, 2017). In a 2017 opinion, Europe’s data-protection authorities said that installing software cannot count as an employee’s consent, and that consent at work is rarely valid at all (WP249). Ontario requires employers with 25 or more employees to have a written electronic-monitoring policy that covers personal computers used for work, but it creates no right not to be monitored (Ontario).
The open question. On my own laptop, in my own house, screenshots stopped working. The hospital’s Chief of Medicine acknowledged that capture had been disabled via Citrix “just for Epic and Microsoft Outlook.” As I wrote in my earlier post, “Nobody asked. Nobody notified.” I am not accusing anyone of breaking the law. The question belongs to courts and legislators. How far may an organization’s control reach into a device it does not own? And does installing an app count as consent to whatever it is later configured to do, without notice?
I am a physician, not a lawyer. This is research, not legal advice.
What You Can Do Today
- Ask what is installed and why. Before you install a remote-access client, a device-management profile or a “device health” agent on a computer you own, ask in writing: what does it do on my computer, what can it change, who can change its settings, and will I be told when they do?
- Read the permissions it holds. On a Mac, System Settings → Privacy & Security lists which apps hold Screen & System Audio Recording (Screen Recording on older versions), Accessibility, Full Disk Access and Local Network access; the Profiles or Device Management pane (its place depends on the macOS version) lists installed profiles, and
profiles status -type enrollmentin Terminal says whether the Mac is enrolled in device management. Windows and Linux have their own equivalents. - Keep employer software in its own space. A separate user account keeps its permissions and its background items away from your own. A separate device is better still, and it is reasonable to ask your employer to provide one.
- Remove it after a session. Quit the client when you finish. If you only need it now and then, uninstall it, and remove any profile you no longer need. A profile that will not let you remove it is itself worth knowing about. If your work requires the profile or client, check your employer’s policy first: removing it can end your access and may breach terms you agreed to. Ask in writing instead.
What We Are Building: Keisen Schutzhund
Schutzhund is German for “protection dog.” Keisen Schutzhund is in development; it is not available yet. One of its planned features is meant to answer one question: who else has control of this computer?
It is designed to look for:
- device-management enrollment and configuration profiles;
- system extensions, which run alongside the operating system and can watch processes and files, and network extensions, which can see or filter network traffic;
- trusted certificates someone added, which can let a proxy holding the matching key read encrypted web traffic from this computer;
- managed browser policies;
- background agents and login items that start without you;
- which apps hold Screen Recording, Accessibility and Full Disk Access.
For each finding it will say, in plain words, what that item can do: a capability, not an accusation. It will mark what is new since the last time you checked. It will show the standard operating-system command behind every finding, so you can check it yourself instead of trusting us. And it will help you remove or contain what you find, by revoking a permission, removing a profile or moving software into a separate account, if you choose to.
What it will not do: it will not bypass, disable or defeat a control that is running. If your employer’s software blocks screen capture inside its window, Schutzhund will tell you that the software can do that, and since when. It will not switch it off. That is a feature, not a limitation. A tool that defeats controls puts its user at odds with the agreements they signed, and in healthcare with their duty to patients’ privacy. What was missing on October 23 was not a way around the control. It was knowing.
Schutzhund is designed to run on your computer and report to you. It will show what it found and how it looked; it will not certify a computer as clean.
Request Access
Keisen Schutzhund is in development and not available yet. Like KeisenVPA, its status is “request access”: tell us what computer you use and what worries you, and it will shape what we build first.
Request access to Keisen Schutzhund · About Keisen Schutzhund →
Seeing Comes First
October 23 was my last day practicing medicine in the United States. The screenshot was not the heaviest reason; it was the last one. And the only reason I noticed is that I had built something that depended on it. Most people in that position will simply notice, one day, that something no longer works, and not know why.
The remedy starts with being able to see: who else has a hand on this computer, what that hand can do, and what changed since yesterday. After that, the decision is yours, as it should have been all along.
