Essay

Hostage Employees and Corporate Malware

When the software of an organization you work for reaches into a computer you own, and nobody tells you

Omar Metwally
Omar Nabil Metwally, M.D.
Creator of KeisenVPA
October 27, 2026 15 min read

The Last Day

October 23, 2026 was my last day practicing medicine in the United States. I spent part of it at home, at my own laptop, working in the electronic health record of a Corewell Health hospital. Corewell serves Epic to physicians' own computers through Citrix, a remote-desktop product. Earlier that day, Citrix had asked for permission to inspect the devices on my network. It asked for nothing else.

Afterward, I could no longer take screenshots of my own screen, on my own computer. No one asked for my consent. No one gave notice or sent a memo. KeisenVPA, the documentation tool I build and use, simply told me there were no screenshots. When I called and texted the hospital's Chief of Medicine, she acknowledged that screen capture had been disabled through Citrix, "just for Epic and Microsoft Outlook."

The first-hand account, with my own caveats, is on my personal blog: Epic Privacy Violation. And Citrix. This essay is about the pattern that afternoon belongs to.

What Happened, in Plain Words

A remote-access window is supposed to be a window: a computer elsewhere draws a picture on your screen, your keyboard drives it, and the data stays on their side. But the program that draws the window also runs on your computer, with whatever permissions it was given. That makes it a lever. A setting changed on the other side (an employer's, a hospital's, a client's) can change what your own computer may do; in my case, whether it may take a picture of my own screen.

Citrix documents features of exactly this kind. Its App Protection policies include anti-screen capture, under which screenshots and recordings of a protected window come back blank, greyed out or empty, and anti-keylogging, under which, while a protected window is in focus, other software on the computer reads scrambled text instead of your keystrokes (Citrix documentation, last published October 14, 2026; Citrix blog, May 21, 2019). I do not know which setting was used on my laptop. I know what it did.

There is a real reason for such controls: patient information should not leak to screen-scraping malware, and I take that seriously. The tool that came up empty was mine, and an institution may reasonably decide it does not want its record captured on a personal computer at all. My objection, and this is opinion, is not that the control exists. It is that it was switched on, on a computer I own, without telling me, and that nothing on my computer told me either.

"If someone else can change what your computer may do, you should be the first to know, not the last."

Naming the Pattern

I use two terms for this. They are mine, I use them deliberately, and I define them so they can be argued with.

Corporate malware: software that an employer, hospital, client or vendor places or controls on a device you own, and that acts on that device without your informed consent. The test is not intent; most of this software is written for defensible reasons. It is three conditions together: your device, their control, no informed consent. A control you were told about, understood and agreed to is not corporate malware in my sense. The same control switched on silently is. I am not calling Citrix, or any vendor's product, malware. Nor am I accusing the hospital, or anyone, of a crime; I am saying that, as I experienced it, the three conditions were present on my laptop that day. The term is about how a control is deployed on someone else's device and whether they were told, not about the software itself.

Hostage employees: people who must accept software controlled by the organization they work for (as employees, contractors, or physicians with hospital privileges) on a device they own in order to keep working. I use "employees" loosely; in my own story, I held privileges at the hospital. The choice they are offered is to install it or not work. Agreement given on those terms is consent of a sort; it is not much of a choice, and it is not consent to whatever the software is later switched to do. A physician who charts from home. A contractor who must enroll a personal phone to read work email. A remote worker whose laptop is the only computer in the house.

These are opinion and vocabulary, not legal claims. Compliance and legality are different words, and an institution can follow its policy to the letter and still leave the person at the keyboard uninformed. I am not alleging that anyone broke a law. I am saying the arrangement deserves a name. I am a physician, not a lawyer, and nothing here is legal advice. The matter is disputed and pending counsel.

A Trend, Not an Incident

None of this is new, and it is not confined to medicine. A few dated public sources, in order:

Read together, in my opinion, these describe a ratchet: the tools grow more capable, the remote-access client becomes the one program everyone must install, and the protection for the person at the keyboard depends on where they live and who holds office that year. I expect the ratchet to keep turning.

The boundary already exists: since 2019, Apple has offered a separate enrollment for personally owned devices, where "the user, not the organization, owns the device," and the organization manages only its own accounts, settings and data (Apple Platform Deployment, page updated September 17, 2026). Whether an employer uses it is the employer's choice.

Hostage Data

In my opinion, it should be illegal for an EHR company to hold patients' or physicians' data hostage. For health records, federal law already goes part of the way. The 21st Century Cures Act prohibits "information blocking," with civil penalties of up to $1 million per violation for developers of certified health IT and for health information networks and exchanges (42 U.S.C. 300jj-52). Those penalties apply to conduct since September 1, 2023 (88 FR, July 3, 2023). HHS announced a crackdown in September 2025 (HHS), but I have not found a public record of that penalty ever being imposed.

For physicians, the protection is thinner. A practice that owns its records can invoke the same information-blocking rules against its own vendor (45 CFR 171.103). HIPAA also requires the vendor's contract to make the practice's patient records available (45 CFR 164.504(e)). A physician as a person has, as far as I can tell, no right of his own. Michigan law makes me keep my patients' records for seven years and keep them available to patients, but it says outright that it does not create or change ownership rights to medical records (MCL 333.16213). Inside a hospital's system, the notes we write, the templates we build and the record of our own work belong to whoever runs the system we were given. A rule that has not produced a single public penalty I could find, and a right a physician does not have, look much the same to the person locked out.

In my own small private practice, the records are my patients' and my practice's, and I am the one responsible for them under HIPAA. In one week in Dallas, over the Lunar New Year of 2026, I wrote the code myself to connect to two major EHR platforms, over FHIR (the open standard) and their own APIs. Then came a short phone call with an undisclosed large EHR vendor about reading my own practice's records through its official API. I agreed to keep what was discussed on that call confidential, and I am not suggesting that anything in it was improper. Federal certification rules require EHR developers to publish any fees for their certified APIs in plain language and to keep those fees tied to cost (45 CFR 170.404). I do not know whether those rules reach the access a small practice needs to read its own records.

In the hospital, the record ran on Epic through Citrix. In both places, the way I could actually read what I had written was the screen in front of me. A screenshot is the oldest interface there is: what I am already allowed to see, kept a moment longer. When capture was switched off, through Citrix and without notice, I had no way left to keep what I could already see. That is what "hostage" means here. The data was not taken; every way out of it ran through someone else's permission.

Where the Law Stands (as of October 2026)

The short answer: largely unsettled. I found no U.S. statute, regulation or court decision that deals specifically with software restricting functions such as screen capture on a computer the worker owns. I also found no court, anywhere, that has ruled on Citrix App Protection or similar controls. A few states require notice of monitoring. Consent and scope are open questions. And in 2025 the federal agencies that had flagged worker surveillance stepped back. The NLRB's Acting General Counsel rescinded the 2022 electronic-monitoring memo (GC 25-05). The CFPB withdrew its worker-dossier circular on May 12, 2025 (CFPB). The Government Accountability Office reported that agencies had "either rescinded these prior efforts or are reassessing" them (GAO-25-107126).

What the law clearly covers. Three states require employers to give notice of electronic monitoring: New York (Civil Rights Law §52-c, since May 7, 2022), Delaware (19 Del. C. §705) and Connecticut (Conn. Gen. Stat. §31-48d, as amended by P.A. 26-73 from October 1, 2026). Connecticut's law reaches only collection "on an employer's premises."

Maine goes further. Employees there may decline an employer's request to install data-collecting apps on their personal devices for surveillance (26 MRSA §620-A(4)). The law does not say whether this covers an app installed for another purpose, such as remote access. It is enforced only through state fines of $100 to $500 per violation, provides no private right to sue, and contains no anti-retaliation clause.

HIPAA lets a hospital choose the security measures that protect patient data, endpoint controls included (45 CFR 164.306), and a hospital's own risk analysis may lawfully lead it to block screen capture. The rule does not require screen-capture blocking or home-network inspection (164.312).

What it does not cover. In a 2014 Texas case, a federal court threw out an employee's federal computer-crime and stored-communications claims after his former employer remotely wiped his personal iPhone. The court left his state-law claims undecided (Rajaee v. Design Tech Homes). That is one trial-court ruling, not a general rule.

Notice laws concern collecting information. As Citrix documents it, App Protection blocks capture while a protected window is visible (Citrix).

California enacted two workplace-surveillance laws on Sept. 30, 2026, both effective Jan. 1, 2027 (Governor; summary). AB 1331 bars employers from using surveillance tools to monitor workers in workplace bathrooms. AB 1883 bars AI-driven tools that read workers' emotions or collect neural data. As reported, neither addresses software on a worker's own device.

What is pending. The federal Stop Spying Bosses Act (S. 4831, H.R. 9402) was introduced in June 2026. It would require employers to disclose workplace surveillance and would bar collecting workers' data while they are off duty, including at home. Both bills were referred to committee with no further action. They die if not passed before this Congress ends in January 2027.

Michigan. I found no Michigan law that requires employers to give notice of electronic monitoring. Michigan's general eavesdropping and hidden-camera crimes require consent to record private conversations or private places (MCL 750.539c, 750.539d). They are not workplace notice laws and say nothing about blocking screen capture.

Michigan's Internet Privacy Protection Act bars employers from demanding the passwords to workers' personal online accounts. It also says it does not stop an employer from monitoring data on a device the employer paid for "in whole or in part," or data "traveling through or stored on an employer's network" (MCL 37.275). It says nothing either way about devices the employer did not pay for.

Two bills are pending. HB 4456 would let employers monitor employees' communications only under a written policy each employee acknowledges, and only on devices the employer owns, never on the employee's own. HB 5579 would require notice, written consent and an opt-out, would bar collecting data while employees are off duty, and would cover the vendors employers use for monitoring. Neither bill has had a committee hearing. Both die if the Legislature ends its 2025–2026 session, usually in late December, without passing them.

Most of these laws protect "employees." Whether they reach a physician who holds hospital privileges is itself a question, although HB 5579's definition includes independent contractors.

Outside the U.S. Spain bars employers from requiring software on devices that regular remote workers own (Ley 10/2021, art. 17(2)). The European Court of Human Rights lists advance notice first among six factors for judging workplace monitoring. It found a violation where the national courts never asked whether the employee had been told in advance (Bărbulescu v. Romania, Grand Chamber, 2017). In a 2017 opinion, Europe's data-protection authorities said that installing software cannot count as an employee's consent, and that consent at work is rarely valid at all (WP249). Ontario requires employers with 25 or more employees to have a written electronic-monitoring policy that covers personal computers used for work, but it creates no right not to be monitored (Ontario).

The open question. On my own laptop, in my own house, screenshots stopped working. The hospital's Chief of Medicine acknowledged that capture had been disabled via Citrix "just for Epic and Microsoft Outlook." As I wrote on my personal blog, "Nobody asked. Nobody notified." I am not accusing anyone of breaking the law. The question belongs to courts and legislators. How far may an organization's control reach into a device it does not own? And does installing an app count as consent to whatever it is later configured to do, without notice?

I am a physician, not a lawyer. This is research, not legal advice.

What You Can Do Today

What We Are Building: Keisen Schutzhund

Schutzhund is German for "protection dog." Keisen Schutzhund is in development; it is not available yet. One of its planned features is meant to answer one question: who else has control of this computer?

It is designed to look for:

For each finding it will say, in plain words, what that item can do: a capability, not an accusation. It will mark what is new since the last time you checked. It will show the standard operating-system command behind every finding, so you can check it yourself instead of trusting us. And it will help you remove or contain what you find, by revoking a permission, removing a profile or moving software into a separate account, if you choose to.

What it will not do: it will not bypass, disable or defeat a control that is running. If your employer's software blocks screen capture inside its window, Schutzhund will tell you that the software can do that, and since when. It will not switch it off. That is a feature, not a limitation. A tool that defeats controls puts its user at odds with the agreements they signed, and in healthcare with their duty to patients' privacy. What was missing on October 23 was not a way around the control. It was knowing.

Schutzhund is designed to run on your computer and report to you. It will show what it found and how it looked; it will not certify a computer as clean.

Request Access

Keisen Schutzhund is in development and not available yet. Like KeisenVPA, its status is “request access”: tell us what computer you use and what worries you, and it will shape what we build first.

Request Access About Keisen Schutzhund →

Seeing Comes First

October 23 was my last day practicing medicine in the United States. The screenshot was not the heaviest reason; it was the last one. And the only reason I noticed is that I had built something that depended on it. Most people in that position will simply notice, one day, that something no longer works, and not know why.

The remedy starts with being able to see: who else has a hand on this computer, what that hand can do, and what changed since yesterday. After that, the decision is yours, as it should have been all along.

← Back to all posts