I Bolted a Hard Drive to a Desk That Moves Up and Down

The mover reached for the laptop bag, and I heard myself say no.

Not dramatically. He was three feet from the door with his arms already full, and the bag was the last obvious thing left in an empty room, and I said thanks, that one rides with me. He shrugged and went back for a lamp. The whole thing took four seconds.

But I stood there afterward and thought: that was a HIPAA decision. It happened in a doorway, with a guy named Dave, and it was over before I finished having it.

Where I Have Been

That was moving day, and it is most of the reason you have not heard from me in a month.

The honest version: we moved, and there is a baby coming this fall. One of those has a deadline that negotiates and one does not. Between them the practice had to be taken apart and rebuilt in a different room, and I decided in June that going quiet for a few weeks was better than sending you four issues written at eleven at night by someone who was not paying attention.

I did not spend the month away from this work, though. I spent it doing the part of this work that does not photograph well, and somewhere on the floor of an empty office it occurred to me that I have written fifteen issues about the half of this that has a login screen.

The Bag That Rides With You

So the laptop and the backup drive rode in my passenger seat with the belt across them, which I recognize is a look. It was the right call anyway. The moving company is not my business associate. They have signed nothing and they are not going to, and if that bag had gone in the truck then the chain of custody for every backup I own would have been a vehicle I could not see inside of, on a route I was not driving, handled by three people I met that morning. For four hours I could not have told you where it was. Not approximately. At all.

There is a rule about this, and it reads like paperwork. Device and media controls. Where things go, who has them, whether you can account for them afterward. In a doorway it reads like Dave reaching for your bag.

The Empty Room

Four hours later the house had that empty echo in every room, and the office was a rectangle with a window and nothing in it. The desk was still in its box, which is its own genre of experience: hex key taped inside the lid, eleven numbered bags of hardware whose numbers correspond to nothing in the instructions, and styrofoam that sheds little white beads which then follow you around the house for a week.

I got it standing. Put the laptop on it. And then I got down on my back on the floor, because the drive was not going to mount itself.

If you have never assembled something from underneath, the position is this. Shoulders flat on hardwood, one arm straight up pressing a bracket to the underside of the desk and holding it there by feel because your head is at the wrong angle to see anything, the other hand running a screwdriver at a wrist angle your wrist has opinions about. Styrofoam in your hair. Every screw catches for two turns and then binds. I got it mounted, threaded a cable lock through the drive, wrapped the other end around the desk leg, cinched it down, and lay there a moment admiring the work.

The desk is a standing desk.

I had bolted my backups to a piece of furniture whose entire job is to go up and down.

Two Different Jobs

I stayed on the floor a while, and that is where the useful thought showed up. I had spent months on the digital side of this practice. Encryption, password manager, access logs, MFA on anything with a login field, the whole vocabulary that compliance conversations live inside. And the actual work, the thing that had me flat on my back with dust in my eye, was making sure a physical object full of patient information could not be picked up and carried out of a room whose door I had propped open all morning for three men I did not know.

Which is true, and which I had been treating as an argument for the bolt. It is not. It is an argument for both, because they are not two attempts at the same job. The bolt decides how hard the thing is to take. The encryption decides what it is worth once somebody has it. One of those I had spent months on. The other I had never once checked.

Because the cable lock is mostly theater. It buys inconvenience and maybe ninety seconds of a determined person's time. The thing that would actually save me if that drive left the house is whether the data on it is encrypted at rest. Which is a setting. Which is decided months before the drive goes anywhere, by someone who is not thinking about drives at all. So I got up, still holding the screwdriver, and went and checked. It was not encrypted. Most drives you buy off a shelf are not, out of the box. That took ten minutes to fix and I have thought about it more than the mount ever since.

What Can Be Seen

After that the room started handing me the rest of it, and it came in an order I have since decided is the right order for anyone setting up a space where clinical work happens. What can be seen. What can be heard. What can be reached.

Seen came first, because I got it wrong immediately. I had put the window behind me, obviously. Good light over the shoulder, view when you lean back, nothing but wall in front of your face. I opened the laptop and looked up in time to watch a woman walk a dog past the house at roughly screen height, eight feet away, with a completely unobstructed view of everything I had open.

So the desk faces the window now. I look outside, and so does the back of the screen. Anyone glancing in gets my face and an aluminum lid, and the woman with the dog gets nothing, which is what she was getting anyway, but now on purpose. If your room does not allow the turn, a privacy filter costs less than dinner and kills the angle from the side, which is the same fix as the one for working anywhere that is not your house.

And while I was in the settings anyway I dropped the screen lock from the fifteen minutes it shipped with to two. That week I was getting up constantly to sign for something or find a box, and the most common exposure in a home office is not a burglar. It is you leaving the room with a chart open.

What Can Be Heard

Heard came second, and it surfaced in the first session I took in there.

White noise in the hallway does real work in a house where other people live and the interior doors are more suggestion than barrier. But the same machine that makes me unintelligible on the far side of that door also makes my patient harder to hear, and I caught myself leaning toward the screen and asking someone to repeat themselves twice. Which is a clinical problem now, not just an acoustic one. A privacy measure that degrades the session is not a privacy measure you will keep.

I have been shopping for speakers, and I know already that speakers are the wrong answer, because the thing that actually solves it is headphones. They take my patient's voice out of the room entirely and let me turn the hallway noise down to something I can think through. I have resisted this for reasons that do not survive being written down.

What Can Be Reached

Reached came third, and it is the one I have not finished.

Sitting in that same session I glanced at the wifi menu and saw the whole household in a list. The television, the doorbell, a set of speakers, something called BRAD-OFFICE that I set up in twenty minutes and meant to come back to. That work network is still not fully separated from the rest of the house. It is partway. It is on the list, the list is real, and it is not done.

I am telling you that on purpose, because I would bet money that the number of practitioners who have genuinely segmented a home office is a good deal smaller than the number who would raise a hand for it in a room. What I have learned in the meantime is that most people attempt it backward. They try to harden the work network and give up somewhere in the router settings. The easier version is to invert it: leave the work machine where it is and move the television and the doorbell and every other cheerful little appliance onto the guest network instead. Same separation, a tenth of the effort, doable from your phone in an evening.

I have a deadline on it now, which is that the number of connected objects in this house is about to go up and not down.

A Pile of Small Defaults

None of this was one big failure. It is a pile of small defaults that nobody was in the room to decide.

The desk went where the desk went. The shredder is whichever one was on sale, and if it makes ribbons instead of confetti then a patient person with a flat surface and an evening can undo your entire afternoon. The drive sits wherever it was last set down. The door either locks or it does not, you already know which, and you have never once thought about it mid-session.

Every one of those was decided by nobody. That is the actual finding from my month off. The digital side of a practice gets decided on purpose, because it comes with prompts and setup wizards and a vocabulary. The physical side gets decided by where the movers set the box down.

And on the other side of that screen is a person telling you something they have not told anyone. They did not ask about your network. They assumed. That assumption is the actual product, and every one of these unglamorous little decisions is quietly protecting it or quietly not.

The Vault's internal binder has the written version, and two of its forms map onto the afternoon I just described. The Clean Desk and Clear Screen Policy is about what a room gives away when you walk out of it. The Employee Workstation and "Shadow IT" Policy is about the machine and everything you quietly attached to it, and despite the name it governs a one-person office just as well. There is a third I did not expect to need this month, the 24-Hour "Lost/Stolen Device" Incident Response Plan, which is the document you want already written on the day you need it.

None of them will get under the desk with you. But they put the decisions on paper with a date on them, which on an ordinary Tuesday is philosophical and in an investigation is the entire conversation.

Anyway. The drive is bolted down, the desk still goes up and down, and nobody is walking off with the thing.