Currently, there are no HIPAA compliant remote solutions, but this is not because they aren't very secure. It is because the audits change and setting up standards would be difficult. The 3rd party web solutions are very secure but generally less so than RDP and VPN. This is simply by virtue of the 3rd party in the middle. Also, LMI could never market a HIPAA compliant service without charging as, by definition, that would make the user a business. It is a licensing violation to use LMI free version for a business. If you are using RDP with 2008 and above, you can use the TS Gateway, now known as the RDS Gateway, which will give you the most speed and the most security. With the gateway you are using port 443.
The RDP encryption with or without a RDS gateway is the same. But the RDS Gateway does authorization before you access the server, uses a certificate so there can be no site spoofing, and uses 443 which is not really more secure than 3389, in itself, but hackers don't know what protocol to use, which they do with 3389.
This brings us to RDP with port forwarding directly to the router and client. Without using a RDS Gateway, you must open port 3389. Port 3389 is evil, and hackers will sit there all day trying to access your network via it. They know it is there, and they know it is open. If your check your security messages on the server you may see hundreds or thousands of hacker attempts, and the only thing between you and them is a username and password, meaning your password must be strong. Closing 3389 will possibly reveal a zero the next day. If you do need to use RDP in that fashion, then I would recommend changing the port number.
Both VPN's and RDP have good encryption. I have never heard of an IPSec VPN or RDP session being hacked, though it is likely possible. I read last year that of thousands of hacks last year not one was via a encrypted connection. A good VPN can be controlled by a pre-built secured client and a certificate, such that if you don't have the certificate, you cannot connect. In that sense they may offer a little more protection.
VPN's though have one major security flaw, a wide open tunnel allowing all traffic between an unmanaged client and the corporate network. Viruses can traverse, and data can be stolen.
VPN's are much slower if actually accessing data rather than using RDP.
VPN's add overhead so using RDP over a VPN does not perform quite as well as straight RDP.
Still RDP with TSGateway can come down to a guessing game of user name and password. This is why secure passwords and account lockout policies are so important.
This is cool:
If you want security, any accounting firm or one handling critical information will use a two factor authentication process. Secure ID is the best known, but they were hacked 2 years ago :-) I would recommend Scorpion Software's solution. They have a solution specific to SBS and is quite affordable
http://www.scorpionsoft.com/docs/authanvil/rwwguard2011/ (link is for SBS 2011, though they have options for 2003 and 2008).
Another issue with LMI is it is far easier for a user to set it up making your network vulnerable if they have local admin rights. When you set up RDP one tends to go to each PC and decide who can access which computer. I have heard that more employees than you think use LMI to clock out on website clock out managers. You can check by looking at the login logs on LMI and compare it.
Forgot to talk about RWW or RWA. This is an extremely secure remote connection and probably just a bit more secure than RDP.
All in all, RDP is probably your best bet, more secure than VPN and much faster depending on what you are doing. As a caveat, this is just factual, and I am not trying to put down my friends who use LMI or GTMPC. It is a very good program, and I use it as well on home home computer. It can be a good backup plan as well. But, you have to decide between licensed and non-licensed.
One thing people should try is the paid version to see if they get better speed. I have heard of that also.
Thanks to Rob Will for some contribution to the above.
