SECURITY RULE POLICIES AND PROCEDURES
|
|
- Meagan Wright
- 8 years ago
- Views:
Transcription
1 County of Sacramento Health Insurance Portability and Accountability Act (HIPAA) SECURITY RULE POLICIES AND PROCEDURES Issued: February 1, 2005 Effective: April 14, 2005 Revised: January 1, 2010 HIPAA Security Officer: David Villanueva HIPAA Privacy Officer: Craig Kramer Office of Compliance 799 G Street, Suite 217 Sacramento, CA (916)
2 (This page is intentionally blank) -2-
3 Introduction Effective January 1, 2010, the County of Sacramento HIPAA Security Rule Policies and Procedures are revised in accordance with Policy 2.3.1(a) and (b). Changes in business practices of the County s HIPAA covered components as well as changes in mandated federal law required this revision. Significant changes: 1. Policy 9 Security Incident Reporting and Response: Revised to reflect changes in the incident reporting process. 2. Policy 14 Risk Analysis and Management: Clarified to reflect the requirement for notification of Office of Compliance of the planned installation, update or removal of any applications containing EPHI. 3. Workforce responsibilities for many policies are modified to reflect current business practices. 4. Workforce responsibilities for many policies are revised for increased clarity. 5. Policy 2 Policy Documentation: Procedures for revision of the Policies and Procedures were modified, and the Office of Compliance s responsibilities now reflect current business practices. 6. All modifications were reviewed for consistency with County IT Policies and IT Support procedures. 7. Definitions were added, edited, and relocated to the front of the document to better assist the reader. 8. Policy 16 Policy Documentation in the April 14, 2005 version is now Policy 2, for improved sequential organization. The HIPAA Security Rule Policies and Procedures can be accessed electronically at -3-
4 (This page is intentionally blank) -4-
5 Table of Contents Table of Contents... 5 Definitions... 6 Policy 1: Assigned Security Responsibility Policy 2: Policy Documentation Policy 3: User Access Management Policy 4: Authentication and Password Management Policy 5: Facility Access Controls Policy 6: Workstation Security Policy 7: Device and Media Controls Policy 8: Audit Controls Policy 9: Security Incident Reporting and Response Policy 10: Transmission Security Policy 11: Protection from Malicious Software Policy 12: Contingency Plan Policy 13: Business Associate Policy 14: Risk Analysis and Management Policy 15: Security Awareness and Training Policy 16: Sanctions Appendix A - HIPAA Security Rule / County Policies Crosswalk Appendix B Mapping County Policies to HIPAA Regulations Appendix C IT Change Management Policy
6 (This page is intentionally blank) -6-
7 Definitions Terms Business Associate Covered component Device Dial up Disposal Electronic Protected Health Information (EPHI) Definitions A contractor who completes a function or activity involving the use or disclosure of protected health information (PHI) or electronic protected health information (EPHI) on behalf of a HIPAA covered component. Services that Business Associate (BA) contractors provide include: claims processing or administration; data analysis, processing and/or administration; utilization review; quality assurance; billing; benefit management; document destruction; temporary administrative support; legal; actuarial; accounting; consulting; information technology (IT) support. The BA contractor does not deliver health care services to clients of the HIPAA covered component. For the purposes of this policy, each department covered by the HIPAA Security Rule is one covered component. The County s HIPAA covered components include Department of Health and Human Services, Department of Behavioral Health Services, Personnel Services Employee Benefits Office, County Counsel, Countywide Services Agency in the County Executive Office, Department of Revenue Recovery and the Office of Compliance. A device is a unit of hardware, inside or outside the case or housing for the essential computer functions (the processor, memory, and data paths). A device is capable of providing input, receiving output, or both. Dialing in to an internet service provider over a modem and phone line. The removal or destruction of electronic protected health information from electronic media. Electronic Information in electronic format such as: information system applications; internet, intranet and extranet; ; USB drives; computer screens; laptops; storage devices (magnetic tapes, floppy disks, CDs, optical devices) Protected Health Information (PHI) PHI is health information that a covered entity creates or receives that identifies an individual, and relates to: The individual s past, present, or future physical or mental health or condition; The provision of health care to the individual; or The past, present, or future payment for the provision of health care to the individual. -7-
8 Terms Encryption Facility Firewalls Hard drive IT Key pads cipher locks Local (C:) drive Malicious software or malware Media reuse Modem Network Network closets Definitions Exceptions: PHI and/or EPHI does not include the following: Education records Workman s Compensation records Health information in workforce member personnel records A method of scrambling or encoding electronic data to prevent unauthorized access. Only individuals with access to a password or key can decrypt (unscramble) and use the data. A County owned or leased building in which the workforce accesses Electronic Protected Health Information (EPHI). Special computer programs and hardware that are set up on a network to prevent an intruder from stealing or destroying data. An information storage device that contains electronic information and software programs on a computer. Information stored on the hard drive [or local (C:) drive] is not backed up on the County s network. Information Technology. Refers to the Office of Communication and Information Technology (OCIT) or the Information Technology staff in DHHS. Door locks that require a combination of numbers entered into a pad in order to unlock the door. In the context of this policy, this is the individual user s hard drive where electronic information can be stored (saved), rather than stored on the organization-wide network. The local (C:) drive should not be used to store EPHI. A type of software that includes ways of attacking data integrity, the system itself or the confidentiality of the data. Malicious software includes viruses, virus variants, worms, hoaxes, and Trojan horses. A device such as a computer hard drive that contained data (information) that is being reused to contain new data. A device that enables data to be transmitted over telephone or cable lines. It translates telephone tones to allow for the multiplexing of data (information) across the telephone network, generally in order to access the internet. A group of computers (workstations) and associated devices connected by a communications channel to share information files and other resources between multiple workforce members. Storage area of network equipment such as hubs, routers, switches, racks, cables, and sometimes has telephone equipment, at a HIPAA covered component facility. -8-
9 Terms Definitions Networked computer / workstation Payload A workstation computer that uses server resources. It is usually connected to a Local Area Network (LAN), which shares the resources of one or more large computers. Harmful code delivered by a software virus. Perimeter security Security that protects the network and its component server computers from attack or intrusion. Portable media Risk assessment Security access cards, C-Cure badges Server Server Room Devices carried or moved with ease that can contain electronic protected health information (EPHI). The most common are: laptops; CDs; USB drives (or memory sticks); and personal digital assistants (PDAs), including smartphones or BlackBerrys. A process of assessing those factors that could affect confidentiality, availability, and integrity of key information assets and systems. HIPAA covered components are responsible for ensuring the integrity, confidentiality, and availability of EPHI and equipment that contains it, while minimizing the impact of security procedures and policies upon business productivity. Cards used to gain access to a facility (also known as proximity cards or cardkeys). The credit card-sized card is held up to a reader and acts as an electronic key to unlock a door. A card s ability to unlock a door is limited by the cardholder s access clearance. A computer or device on a network that managers network resources. The room where all the server computers are housed Strong passwords A password that is difficult to guess by both humans and computer programs, effectively protecting data from unauthorized access. A strong password consists of at least six characters that are a combination of letters, numbers and symbols (@, #, $, %, etc.) if allowed. Strong passwords contain the maximum number of characters allowed. Passwords are typically case-sensitive so a strong password contains letters in both uppercase and lowercase. Strong passwords also do not contain words that can be found in a dictionary or any part of the user s own name. Transmitting Trojan or trojan horse The act of sending a message or data using an electronic medium. A trojan or trojan horse is a computer program generally designed to impact the security of a network system. The trojan is usually disguised as something else (a benign program) or masquerades as a legitimate file that the user would expect to see, or want to load, on the network system. The payload of a trojan is usually delivered as soon as it is opened with -9-
10 Terms USB drive, USB flash drive or memory stick User User ID or logon Virtual Private Network (VPN) Virus Workforce / workforce member Workstation Worm Definitions devastating results. Trojans often create back doors that allow access into a secure network. A hacker can then gain access to the secure network. Trojans are most often delivered as an attachment to a seemingly innocent chain . A small, portable device that plugs into a workstation computer s USB port and functions as a portable hard drive with extra storage capacity. USB devices are easy to use, small enough to be carried in a pocket, and can plug into any workstation computer with a USB drive. For the purposes of this document, the term user refers to any workforce member (permanent or temporary), contractor, consultant, vendor, volunteer, student or other person who uses, maintains, manages or is otherwise given access privileges to County IT systems. An identification code issued for access privileges which identifies the user to County IT systems. A secure, encrypted network connection between two or more devices across the public internet or other shared network. It allows workstation computers at different locations to securely communicate with each other. A computer program that copies itself into another program, sectors on a drive, or into items that support scripts. A virus may unleash a payload. Payloads can damage files, corrupt hard drives, display messages, or open other files. Typically, the payload is delivered when a certain condition occurs, such as when the date on the workstation reaches a particular day. In the HIPAA Privacy Rule, the term "workforce" is defined as "employees, volunteers, trainees, and other persons whose conduct, in the performance of work for a HIPAA covered entity, is under the direct control of such entity, whether or not they are paid by the covered entity. Workforce members include supervisors, managers and line staff. A laptop or desktop computer, or any other device that performs computer functions. A worm is a type of virus that finds vulnerable computer systems and then copies itself into those systems. The most frequent copying methods are from distribution lists, signature scripts, and shared folders on the network. A typical worm payload makes the workstation more susceptible to other malicious viruses. -10-
11 Policy 1: Assigned Security Responsibility Issue Date: February 2005 Effective Date: April 21, 2005 Revised Date: January 1, HIPAA Regulation: Assigned security responsibility 1.2 Policy Purpose: At all times the County of Sacramento shall have one individual identified and assigned to HIPAA security responsibility. 1.3 Policy Description: The HIPAA Security Officer is responsible for the oversight of Security Rule implementation by departments with HIPAA covered components. Responsibilities are: 1. To ensure that the necessary and appropriate HIPAA security policies are developed and implemented to safeguard the integrity, confidentiality, and availability of electronic protected health information (EPHI) within the HIPAA covered components. 2. To ensure that the necessary infrastructure of personnel, procedures and systems is in place through monitoring, compliance, and providing a mechanism for incident reporting and violations. 3. To act as a single point of contact for Sacramento County in all issues related to HIPAA security. 1.4 Policy Responsibilities: The above HIPAA Security Officer responsibilities are assigned to the Chief Information Security Officer for the County of Sacramento. The current County of Sacramento Information Technology Constitution identifies the Chief Information Officer as the Chief Information Security Officer (CISO). Historically, the HIPAA Security Officer has delegated assigned responsibilities of the Security Rule implementation to the Office of Compliance. The Office of Compliance shall coordinate the program level support for the HIPAA Security Rule implementation with the County s HIPAA Deputy Compliance Officers (DCOs), who are assigned by the department directors of the HIPAA covered components. -11-
12 -12-
13 Policy 2: Policy Documentation Issue Date: February 2005 Effective Date: April 21, 2005 Revised Date: January 1, HIPAA Regulation: Policies and procedures Documentation Time limit Availability Updates 2.2 Policy Purpose: The purpose of this policy is to establish the process by which County of Sacramento HIPAA Security Rule Policies and Procedures are created and maintained in accordance with federal regulations. 2.3 Policy Description: The County of Sacramento is required to have policies and procedures for compliance with the HIPAA Security Rule Policies and Procedures 1. As assigned by the HIPAA Security Officer, the Office of Compliance shall draft new or revised HIPAA Security Rule Policies and Procedures as required due to: a. Changes in business practices or the Information Technology (IT) environment of the HIPAA covered components b. Mandated federal law enacted by Congress c. Risk analysis determines new or increased vulnerability to security threat 2. The HIPAA Deputy Compliance Officers and existing IT governance bodies shall participate in the revision process. 3. The County Compliance Officer, who is assigned responsibilities of the HIPAA Privacy Officer, shall direct the Office of Compliance in the revision process, and provide review for compliance standards. Legal review of the policies and procedures will be made by the Office of County Counsel. Approval of the HIPAA Security Rule Policies and Procedures will be made by the County s Chief Information Security Officer who is assigned the responsibilities of the HIPAA Security Officer. 4. All policies and procedures implemented to comply with the HIPAA Security Rule shall be made available to the HIPAA covered component workforce. 5. All actions, activities, or assessments required by the County s HIPAA Security Policies and Procedures shall be documented. The documentation shall provide sufficient detail to communicate the implemented security measures and to -13-
14 facilitate periodic evaluations by the HIPAA covered components or as requested by the County s HIPAA Security Officer. 6. In accordance with 45 CFR , documentation shall be retained for a minimum of 6 years from the time of its creation or the date it was last in effect, whichever is later. 7. Security procedures developed by the HIPAA covered components shall be consistent with the County HIPAA Security Rule Policies and Procedures. 2.4 Policy Responsibilities: Office of Compliance Responsibilities 1. Draft new or updated HIPAA Security Rule Policies and Procedures as indicated in Section Communicate the approved new or revised policy to the workforce of the HIPAA covered components, and update training and related materials as needed. 3. Maintain and make available to the workforce the HIPAA Security Rule policies and procedures in electronic form on the County s intranet County Compliance Officer and HIPAA Privacy Officer Responsibilities Direct the Office of Compliance in the revision of the County s HIPAA Security Policies and Procedures and provide review for compliance with mandated standards Office of the County Counsel Responsibilities Provide legal review of the County s HIPAA Security Policies and Procedures for compliance with mandated standards Chief Information Security Officer/HIPAA Security Officer Responsibilities Provide final approval of the County s HIPAA Security Policies and Procedures. -14-
15 Policy 3: User Access Management Issue Date: February 2005 Effective Date: April 21, 2005 Revised Date: January 1, HIPAA Regulation: Workforce security Authorization and/or supervision Workforce clearance procedure Termination procedures Information access management Access authorization Access establishment and modification Access control Integrity Emergency access procedure 3.2 Policy Purpose: The purpose of this policy is to establish rules for authorizing access to the computing network, applications, workstations, and to areas where electronic protected health information (EPHI) is accessible. The HIPAA covered components shall ensure that only workforce members who require access to EPHI for work related activities shall be granted access and when work activities no longer require access, authorization shall be terminated. In Section of the HIPAA Privacy Rule, the "workforce" is defined as "employees, volunteers, trainees, and other persons whose conduct, in the performance of work for a covered entity, is under the direct control of such entity, whether or not they are paid by the covered entity. 3.3 Policy Description: Management and Access Control Only the workforce member s manager or an appropriate designee can authorize access to the County s EPHI information systems. Access to the information system or application may be revoked or suspended, consistent with County policies and practice, if there is evidence that an individual is misusing information or resources. Any individual whose access is revoked or suspended may be subject to disciplinary action or other appropriate corrective measures. -15-
16 3.3.2 Minimum Necessary Access Each HIPAA covered component shall ensure that only workforce members who require access to Electronic Protected Health Information (EPHI) are granted access. Each manager or supervisor is responsible for ensuring that the access to EPHI granted to the workforce member is the minimum necessary access required for each work role and responsibilities. If the workforce member no longer requires access, it is the responsibility of the manager or appropriate designee to complete the necessary process to terminate access Granting Access to EPHI Screen Workforce Members Prior to Access The manager or designee shall ensure that information access is granted only after first verifying that the access of a workforce member to EPHI is appropriate Sign Security Acknowledgement Prior to being issued a User ID or logon account to access any EPHI, each workforce member shall sign the County of Sacramento s Acknowledgement of Information Security Responsibility before access is granted to the network or any application that contains EPHI, and thereafter shall comply with all County of Sacramento security policies and procedures Security Awareness Prior to Getting Access Before access is granted to any of the various systems or applications that contain EPHI, the manager or appropriate designee shall ensure that workforce members are trained to a minimum standard including: 1. Proper uses and disclosures of the EPHI stored in the systems or application 2. How to properly log on and log off the systems or application 3. Protocols for correcting user errors 4. Instructions on contacting a designated person or help desk when EPHI may have been altered or destroyed in error 5. Reporting a potential or actual security breach Management Approval Each HIPAA covered component shall implement the following policies and procedures: 1. User IDs or logon accounts can only be assigned with management approval or by an appropriate designee. 2. Managers or their designees are responsible for requesting the appropriate level of access for staff to perform their job function. 3. All requests regarding user IDs or computer system access for workforce members are to be communicated to the appropriate system administrator. All requests shall be made in writing (which may be in an electronic format). -16-
17 4. System administrators are required to process only those requests that have been authorized by managers or their appropriate designees. 5. A written or electronic record of the authorized request is to be retained by the system administrator for the period of time the approved user has access, plus a minimum of 1 year Granting Access in an Emergency Management has the authority to grant emergency access for workforce members who have not completed the normal HIPAA access requirements if: 1. Management declares an emergency or is responding to a natural disaster that makes client information security secondary to personnel safety. 2. Management determines that granting immediate access is in the best interest of the client. 3. If emergency access is granted, the manager shall review the impact of emergency access and document the event within 24 hours of it being granted. 4. After the emergency event is over, the user access shall be removed or the workforce member shall complete the normal requirements for being granted access Termination or Suspension of Access Department managers or their designated representatives are responsible for terminating a workforce member s access to EPHI in these circumstances: 1. If management has evidence or reason to believe the individual is using information systems or resources in a manner inconsistent with HIPAA Security Rule policies. 2. If the workforce member or management has reason to believe the user s password has been compromised. 3. If the workforce member resigns, is terminated, suspended, retires, or is away on unapproved leave. 4. If the workforce member s work role changes and system access is no longer justified. If the workforce member is on leave of absence and the user s system access will not be required for more than three weeks, management shall suspend the user s account until the workforce member returns from their leave of absence Modifications to Access If a workforce member transfers to another program or changes their work role within the same program in a County s HIPAA covered component: 1. The workforce member s new manager or supervisor is responsible for evaluating the member s current access and for requesting new access to EPHI commensurate with the workforce member s new work role and responsibilities. If a workforce member transfers to another program or department outside of the County s current HIPAA covered components: 1. The workforce member s access to EPHI within his or her current unit shall be terminated as of the date of transfer. -17-
18 2. The workforce member s new manager or supervisor is responsible for requesting access to EPHI commensurate with the workforce member s new work role and responsibilities Ongoing Compliance for Access In order to ensure that workforce members only have access to EPHI when it is required for their job function, the following actions shall be implemented by all HIPAA covered components: 1. Every new user ID or logon account that has not been used after 30 consecutive calendar days since creation shall be investigated to determine if the workforce member still requires access to the EPHI. 2. At least every six months, Information Technology (IT) teams are required to send managers or appropriate designees: a. a list of all workforce members for all applications b. a list of workforce members and their access rights for all shared folders that contain EPHI c. a list of all workforce members approved for access to Virtual Private Network (VPN) 3. The managers or their designees shall then notify their IT support of any workforce members who no longer require access. 3.4 Policy Responsibilities: Manager and Supervisor Responsibilities 1. Ensure that the access to EPHI granted to each of their workforce member is the minimum necessary access required for each such workforce member s work role and responsibilities. 2. Request termination of access if the workforce member no longer requires access. 3. Work with Personnel Services to establish a process to immediately contact IT and Facilities Management if a workforce member is being released from probation, suspended, or terminated with cause. 4. Validate new User IDs or logon accounts that are not used within 30 days of creation and provide IT with that information. 5. Review semi-annual user and folder access reports and the VPN access reports prepared by IT support and verify to determine if the workforce members still require access to the EPHI. 6. Ensure members of the workforce have signed the IT security agreement and are properly trained before approving access to EPHI. 7. Follow the appropriate security procedures when granting emergency access with support from IT where required IT Support Responsibilities 1. Immediately, upon written notification from a manager or supervisor remove or modify a workforce member s access to EPHI. -18-
19 2. Provide management with a report that identifies new User IDs or logon accounts not used within 30 days of creation. 3. Provide management with a semi-annual report documenting workers with access to EPHI, and requesting verification that access is still required to fulfill the worker s job functions. 4. When required, support management with the appropriate security procedures for granting emergency access Workforce Member Responsibilities Each user of a system or application that contains EPHI shall: 1. Read and sign the Sacramento County Acknowledgment of Information Security Responsibility and the Sacramento County HIPAA Privacy and Security Policies & Procedures Acknowledgement.. 2. Follow all County Information Security policies and requirements. 3. Complete HIPAA Privacy and Security training. 4. Immediately report all security incidents to their supervisor. -19-
20 -20-
21 Policy 4: Authentication and Password Management Issue Date: February 2005 Effective Date: April 21, 2005 Revised Date: January 1, HIPAA Regulation: Mechanism to authenticate electronic protected health information Person or entity authentication Password management Unique user identification 4.2 Policy Purpose: The purpose of this policy is to ensure that County HIPAA covered component workforce members select and secure strong passwords to authenticate their access to information systems containing EPHI. 4.3 Policy Description: Information systems used to access electronic protected health information (EPHI) shall uniquely identify and authenticate workforce members Authentication Standards The password file on the authenticating server shall be adequately protected and not stored in plaintext (unencrypted). Network and application systems shall be configured to enforce at a minimum: 1. Automatic password expiration at User ID creation and password reset 2. Automatic password expiration every six months 3. A minimum password length of 6 characters 4. A minimum of five previous passwords that cannot be reused with a User ID User ID and Password Management All workforce members are assigned a unique User ID to access the County network and are responsible for creating and maintaining the confidentiality of the password associated with their unique User ID. Supervisors and managers are required to ensure that the workforce under their supervision understands the user responsibilities for securely managing confidential passwords. Upon receipt of a User ID, the workforce member assigned the User ID is required to change the password provided by the administrator to a password that only he or she knows. Strong passwords shall be created in order to secure access to EPHI. Workforce members who suspect that their password has become known by another person shall change their password immediately. Workforce members shall not share with or reveal their password to anyone, including their supervisor, manager or IT support staff. -21-
22 All privileged system-level passwords (e.g., root, enable, application administration accounts, etc.) shall be changed, at a minimum, each fiscal quarter. All passwords are to be treated as sensitive, confidential Sacramento County information. If the workforce member s manager or supervisor requires emergency access to a worker s or individual network drive, refer to Section Granting Access in an Emergency Strong Password Guidelines Select strong passwords that have the following characteristics: 1. The password contains at least 6 characters. 2. The password contains both upper and lower case characters. 3. The password contains at least one number or special character, such #, $, %, and &. 4. The password is not so hard to remember that you have to write it down, and is difficult for others to guess. 5. Avoid using dictionary words. 4.4 Policy Responsibilities: Manager and Supervisor Responsibilities 1. Supervisors and managers shall reinforce secure password use by workforce members. 2. If access to another workforce member s account is required, managers/supervisors shall follow the emergency access procedures in Section Granting Access in an Emergency IT Support Responsibilities 1. System administrators shall verify the identity and the authority of the workforce member or an authorized requester, such as the member s manager or supervisor, before providing the password for a new User ID. 2. System administrators shall verify the identity and the authority of the workforce member requesting a password reset. 3. System administrators shall verify the identity and the authority of an authorized requester, such as the member s manager or supervisor, to request a password reset for another workforce member Workforce Member Responsibilities 1. Workforce members shall create and securely manage strong passwords for access to systems containing EPHI. 2. Workforce members shall follow the password protection requirements to protect the confidentiality of their passwords to ensure security of EPHI: Passwords shall not be shared with or revealed to anyone, including their supervisor, manager or IT support staff Passwords shall never be revealed on questionnaires or security forms Passwords shall be memorized, not written down -22-
23 The password used to access the County network shall not be used anywhere else The password shall be changed immediately if the workforce member suspects it has become known by another person -23-
24 -24-
25 Policy 5: Facility Access Controls Issue Date: February 2005 Effective Date: April 21, 2005 Revised Date: January 1, HIPAA Regulation: Facility security plan Facility access controls Access control and validation procedures Maintenance records Contingency operations 5.2 Policy Purpose: The purpose of this policy is to establish protocols for securing facilities that contain electronic protected health information (EPHI). 5.3 Policy Description: The County of Sacramento shall reasonably safeguard electronic protected health information (EPHI) from any intentional or unintentional use or disclosure. The County shall protect its facilities where EPHI can be accessed Facility Security Plan The County shall safeguard the facilities of its HIPAA covered components and the equipment therein from unauthorized physical access, tampering, and theft. The Office of Compliance in coordination with the Deputy Compliance Officers shall periodically audit HIPAA covered component facilities to ensure EPHI safeguards are continuously being maintained. When designing a new building and remodeling existing sites, facility managers and/or designees shall work with the Office of Compliance to ensure the facility plan components below are compliant with federal HIPAA regulations. The following shall be implemented for all sites that access EPHI: 1. Visitor Access Control: In facilities in which EPHI is available, all visitors shall be escorted and monitored. Each facility shall implement procedures that govern visitor access controls. These procedures may vary depending on the facility structure, the type of visitors, and where the EPHI is accessible. 2. Security Access Cardkeys: Some facilities have security access cardkeys (also known as proximity cards a credit card-size card held up to a reader that acts as an electronic key to unlock a door). These facilities shall include a card management system and a monitoring system to ensure the appropriate use of the security access cardkeys. When administering security access cardkeys each HIPAA covered component shall have the following: a. A standard card format -25-
26 b. Defined clearances based on programmatic need, special mandated security requirements and workforce member security c. Documentation for the authorization of approved clearances d. A back-up procedure in case of system failure e. A system for disabling cards when workforce members leave County employment, take an extended leave of absence, discontinue volunteer service, or report their card as lost or stolen f. System audits on a semi-annual basis to ensure all workforce members who currently have access continue to require access to the facility g. A process to investigate security access cardkeys inactive for 90 days or more to determine if the access cardkey shall be disabled h. A tracking mechanism to identify all workforce members with security card access in each facility 3. Keypads/Cipher Locks: Facilities shall change the codes on keypads/cipher locks at least every six months in order to ensure the security of staff, property, and the confidentiality of client information. In addition, the facility shall have: a. Clearances based on programmatic need, special mandated security requirements and workforce member security, and b. A mechanism to track which workforce members are provided access. 4. Metal/Hard Keys: Facilities that use metal/hard keys shall change affected or appropriate key locks when keys are lost or a workforce member leaves without returning the key. In addition, the facility shall have: a. Clearances based on programmatic need, special mandated security requirements and workforce member security; and b. A mechanism to track which workforce members are provided access. 5. Network Closet(s): Every network closet shall be locked, whenever the closet is unoccupied or not in use, or shall be enclosed in a locked equipment cage. HIPAA covered components shall maintain a log of who has accessed the network closets and periodically change the locking mechanism to these closets. 6. Server Room(s): Every server room shall be locked whenever the room is unoccupied or not in use, or shall be enclosed in a locked equipment cage. HIPAA covered components shall document who has access to each server room and periodically change the locking mechanism to server rooms. 7. Alarm Systems: All buildings that contain EPHI shall have some form of alarm system that is activated during non business hours. Alarm system codes may only be provided to workforce members who require this information in order to leave and enter a building. 8. Doors: All non-public exterior doors (such as employee only doors) and doors leading to areas with EPHI shall remain locked at all times. It is each workforce member s responsibility to make sure the door that is being entered or exited is completely shut before leaving the door. If a door s closing or locking mechanism -26-
27 is not working, it is every worker s responsibility to notify the facility manager or designee for that facility Contingency Operations Emergency Access to Facilities Each facility shall have emergency access procedures in place that allow facility access for appropriate workforce members to access EPHI as well as support restoration of lost EPHI. This includes a primary contact person and back-up person when facility access is necessary after business hours by persons who do not currently have access to the facility outside of regular business hours Maintenance Records Repairs or modifications to the physical building for each facility where EPHI can be accessed shall be logged and tracked. The log shall include at a minimum events that are related to security (for example, repairs or modifications of hardware, walls, doors, and locks). 5.4 Policy Responsibilities: Supervisor and Manager Responsibilities 1. Take appropriate corrective action if any workforce member knowingly violates the facility security plan and its procedures. 2. Authorize clearances that are appropriate to the duties of each workforce member. 3. Notify the Facility Manager or designee within one business day when a user no longer requires access to the facility. 4. Verify that each workforce member surrenders her/his card or key upon leaving employment. 5. Work with the Facility Manager to ensure a log is kept of all access into network closets Workforce Member Responsibilities 1. Display their access/security card or employee badge to demonstrate their authorization to access restricted areas. 2. Do not allow other persons to enter the facility by tailgating (entering the facility by walking behind an authorized person through a door without using a valid cardkey in the reader). 3. Do not share access cardkeys, hard keys, alarm codes or keypad codes to enter the facility or areas where there is EPHI. 4. Immediately report lost or stolen cardkeys, metal keys or keypad-cipher lock combinations. 5. Surrender access cardkeys and/or hard key(s) upon leaving employment. -27-
28 5.4.3 Facility Manager Responsibilities 1. Request and track maintenance repairs. 2. Establish and maintain a mechanism for accessing the facility in an emergency. 3. Track who has access to the facility. 4. Change metal locks when a key is lost or unaccounted for. 5. Change combination keypads/cipher locks every three months. 6. Disable the unique user alarm code when a workforce member is no longer authorized for facility access. 7. Disable access cardkeys not used for 90 days or more. 8. Complete access cardkey audits every 6 months to verify user access Office of Compliance and HIPAA Deputy Compliance Officer Responsibilities 1. Work with the Facility Managers of the HIPAA covered components to ensure facilities comply with the HIPAA Security Rule for access controls. 2. Conduct periodic audits of HIPAA covered components to ensure their facilities are secure and the requirements of this policy are enforced. -28-
29 Policy 6: Workstation Security Issue Date: February 2005 Effective Date: April 21, 2005 Revised Date: January 1, HIPAA Regulation: Access control and validation Workstation use Workstation security Automatic log off 6.2 Policy Purpose: The purpose of this policy is to establish rules for securing workstations that access electronic protected health information (EPHI). Since EPHI can be portable, this policy requires workforce members of HIPAA covered components to protect EPHI at County worksites and all other locations. 6.3 Policy Description: The County of Sacramento shall implement safeguards to prevent unauthorized access to EHPI through workstations, and to protect EPHI from any intentional or unintentional use or disclosure Workstation Security Controls All workstations used by workforce members of HIPAA covered components to access EPHI shall be set to automatically lock the computer when it is left unattended, requiring the user to enter a password to unlock the workstation. The standard setting for the computer to lock after a period of inactivity is not to exceed 15 minutes, with a recommended inactivity timeout of 5 minutes. Workforce members shall manually lock their workstation computer using the Ctrl-Alt- Delete-Enter keys when the computer is left unattended for any period of time. Workforce members shall ensure that observable confidential information is adequately shielded from unauthorized disclosure and access on computer screens. At each site, every effort shall be made to ensure that confidential information on computer screens is not visible to unauthorized persons. Workforce members who work in other County facilities that are not HIPAA covered components shall be aware of their surroundings to ensure no one can incidentally view EPHI and that no EPHI is left unattended. Workforce members who work from home or other non-office sites shall follow the above workstation security controls to safeguard EPHI access or viewing by any unauthorized individual. Workforce members shall protect printed versions of EPHI that have been transmitted via fax or multi-use machines by promptly removing documents from shared devices. -29-
30 Whenever possible, confidential documents are to be placed in locked cabinets or drawers when left unattended. 6.4 Policy Responsibilities: Supervisor and Manager Responsibilities 1. Control workforce member access to EPHI as per Security Policy 3: User Access Management. 2. Take appropriate corrective action if any workforce member knowingly violates the security of workstation use. 3. Ensure that the automatic lock is functioning on all workstations. 4. Ensure that all workforce members are locking their workstations when they are left unattended. 5. Ensure that all confidential information is not viewable by unauthorized persons at workstations in offices under their management Workforce Member Responsibilities 1. Lock their computer when it is left unattended for any period of time. 2. Do not change or disable the automatic inactivity lock on their workstation. 3. Ensure that all confidential information in their workstation is not viewable or accessible by unauthorized persons. 4. When working from home, non-hipaa covered County facilities, or other nonoffice work sites, protect EPHI from unauthorized access or viewing IT Support Responsibilities 1. When installing new workstations, set the computer to automatically lock after the recommended period of inactivity, which is not to exceed 15 minutes. -30-
31 Policy 7: Device and Media Controls Issue Date: February 2005 Effective Date: April 21, 2005 Revised Date: January 1, HIPAA Regulation: Device and media controls Disposal Media reuse Accountability Data backup and storage 7.2 Policy Purpose: The purpose of this policy is to ensure that EPHI stored or transported on storage devices and removable media is appropriately controlled and managed. 7.3 Policy Description: Device and Media Protection Each HIPAA covered component shall protect all the hardware and electronic media that contain EPHI. This includes, but is not limited to, workstation computers, laptops, personal digital assistants (PDAs) such as BlackBerrys and smartphones, USB drives, backup tapes, and CDs. Each HIPAA covered component is responsible to develop procedures that govern the receipt and removal of hardware and electronic media that contain EPHI outside of the secured physical perimeter of a County facility, and the movement of these items within the facility. Procedures shall include maintaining a custody record of hardware and electronic media Portable Media Security EPHI that is placed on portable electronic media shall be encrypted so that access to the EPHI can only be attained by authorized individuals with knowledge of the decryption code. Workforce members shall limit the quantity of EPHI on portable electronic media to the minimum necessary for the performance of their duties. All workforce members shall receive permission from their supervisor before transporting EPHI outside of the secured physical perimeter of a County facility. Approvals shall include the time period for authorization, which shall be a maximum of one year. Workforce members shall not leave portable media that contains EPHI visible in their vehicles or in any other unsecured location. If portable media is lost, workforce members are responsible to immediately notify their supervisor. -31-
32 7.3.3 Electronic Media Disposal Before electronic media that contains EPHI can be disposed, the following actions shall be taken on devices used by the workforce: 1. Hard drives shall be either wiped clean by IT or destroyed to prevent recognition or reconstruction of the information. The hard drive shall be tested to ensure the information cannot be retrieved. 2. PDAs shall have all stored EPHI erased or shall be physically destroyed. 3. Storage media, such as backup tapes, USB flash drives and CDs, shall be physically destroyed (broken into pieces) before disposing of the item Electronic Media Reuse All EPHI shall be removed from hard drives when the equipment is transferred to a worker who does not require access to the EPHI. Hard drives shall be wiped clean by IT before transfer. All other media shall have all the EPHI removed (the mechanism may vary depending on the media type) and tested to ensure the EPHI cannot be retrieved. If the media is not technology capable of being cleaned, the media shall be overwritten or destroyed Device Maintenance and Repair When the technology is capable, all EPHI shall be removed from the device s memory or hard drive before the device is accessed for maintenance or sent out for repair. Devices include computer servers, copiers, printers and other devices capable of storing electronic data Device and Media Acquisition The County shall include security requirements and/or security specifications in information system acquisition contracts based on an assessment of risk (applications, servers, copiers, etc.). 7.4 Policy Responsibilities: Manager and Supervisor Responsibilities 1. Ensure that only workforce members whose duties require the need to transport EPHI outside of the secured physical perimeter of a County facility are granted permission to do so. 2. Enforce procedures to govern the receipt and removal of hardware and electronic media that contain EPHI outside of the secured physical perimeter of a County facility, and the movement of these items within the facility IT Support Responsibilities 1. Ensure all hard drives are wiped clean of EPHI before disposal, reuse or sent out for repair. 2. Maintain an inventory and a record of movements of hardware and electronic media such as workstation computers, servers, or backup tapes. -32-
33 7.4.3 Workforce Member Responsibilities 1. Follow the procedures that govern the receipt and removal of hardware and electronic media that contain EPHI. 2. Limit the quantity of EPHI on portable electronic media to the minimum necessary to perform their duties. 3. Secure EPHI on portable electronic media through encryption. 4. Remove and destroy all EPHI from portable electronic media when it is no longer needed to perform their duties. 5. Do not leave or store portable media that contains EPHI in their vehicles or in any other unsecured location. -33-
34 -34-
35 Policy 8: Audit Controls Issue Date: February 2005 Effective Date: April 21, 2005 Revised Date: January 1, HIPAA Regulation: Log-in monitoring Information system activity review Audit controls 8.2 Policy Purpose: The purpose of this policy is to establish the standard of authority to conduct security monitoring and enforce audit controls on computing resources used by HIPAA covered components. 8.3 Policy Description: The County has the requirement to monitor system access and activity of all HIPAA covered component workforce members Log-in Monitoring To ensure that access to servers, workstations, and other computer systems containing electronic protected health information (EPHI) is appropriately secured, the following log-in monitoring measures shall be implemented: 1. A mechanism to record all failed log-in attempts on network systems containing EPHI when the technology is capable. 2. To the extent that technology allows, a means to disable any User ID that has more than four consecutive failed log-in attempts within a 30 minute period. 3. A review of log-in activity reports and logs when required to identify any patterns of suspicious activity, such as continuous failed log-in attempts Information System Activity Review Information system activity reviews and audits may be conducted to: 1. Ensure integrity, confidentiality, and availability of information and resources. 2. Investigate possible security incidents to ensure compliance with County of Sacramento Information Technology (IT) and security policies. 3. Monitor user or system activity as required. 4. Verify that software patching is maintained at the appropriate security level. 5. Verify virus protection is current Information System Audit Controls To ensure that activity for all computer systems accessing EPHI is appropriately monitored and reviewed, these requirements shall be met: -35-
ISLAND COUNTY SECURITY POLICIES & PROCEDURES
Health Insurance Portability and Accountability Act (HIPAA) ISLAND COUNTY SECURITY POLICIES & PROCEDURES Island County HIPAA Security Rule Page 1 Table of Contents Table of Contents... 2 Authority... 3
SUBJECT: SECURITY OF ELECTRONIC MEDICAL RECORDS COMPLIANCE WITH THE HEALTH INSURANCE PORTABILITY AND ACCOUNTABILITY ACT OF 1996 (HIPAA)
UNIVERSITY OF PITTSBURGH POLICY SUBJECT: SECURITY OF ELECTRONIC MEDICAL RECORDS COMPLIANCE WITH THE HEALTH INSURANCE PORTABILITY AND ACCOUNTABILITY ACT OF 1996 (HIPAA) DATE: March 18, 2005 I. SCOPE This
HIPAA Security Alert
Shipman & Goodwin LLP HIPAA Security Alert July 2008 EXECUTIVE GUIDANCE HIPAA SECURITY COMPLIANCE How would your organization s senior management respond to CMS or OIG inquiries about health information
HIPAA Information Security Overview
HIPAA Information Security Overview Security Overview HIPAA Security Regulations establish safeguards for protected health information (PHI) in electronic format. The security rules apply to PHI that is
How To Write A Health Care Security Rule For A University
INTRODUCTION HIPAA Security Rule Safeguards Recommended Standards Developed by: USF HIPAA Security Team May 12, 2005 The Health Insurance Portability and Accountability Act (HIPAA) Security Rule, as a
HIPAA Security. assistance with implementation of the. security standards. This series aims to
HIPAA Security SERIES Security Topics 1. Security 101 for Covered Entities 2. Security Standards - Administrative Safeguards 3. Security Standards - Physical Safeguards 4. Security Standards - Technical
Health Insurance Portability and Accountability Act (HIPAA) and Health Information Technology for Economic and Clinical Health Act (HITECH)
Health Insurance Portability and Accountability Act (HIPAA) and Health Information Technology for Economic and Clinical Health Act (HITECH) Table of Contents Introduction... 1 1. Administrative Safeguards...
HIPAA Security. 2 Security Standards: Administrative Safeguards. Security Topics
HIPAA Security SERIES Security Topics 1. Security 101 for Covered Entities 5. 2. Security Standards - Organizational, Security Policies Standards & Procedures, - Administrative and Documentation Safeguards
State HIPAA Security Policy State of Connecticut
Health Insurance Portability and Accountability Act State HIPAA Security Policy State of Connecticut Release 2.0 November 30 th, 2004 Table of Contents Executive Summary... 1 Policy Definitions... 3 1.
HIPAA Security COMPLIANCE Checklist For Employers
Compliance HIPAA Security COMPLIANCE Checklist For Employers All of the following steps must be completed by April 20, 2006 (April 14, 2005 for Large Health Plans) Broadly speaking, there are three major
UNIVERSITY OF CALIFORNIA, SANTA CRUZ 2015 HIPAA Security Rule Compliance Workbook
Introduction Per UCSC's HIPAA Security Rule Compliance Policy 1, all UCSC entities subject to the HIPAA Security Rule ( HIPAA entities ) must implement the UCSC Practices for HIPAA Security Rule Compliance
Procedure Title: TennDent HIPAA Security Awareness and Training
Procedure Title: TennDent HIPAA Security Awareness and Training Number: TD-QMP-P-7011 Subject: Security Awareness and Training Primary Department: TennDent Effective Date of Procedure: 9/23/2011 Secondary
Policies and Procedures Audit Checklist for HIPAA Privacy, Security, and Breach Notification
Policies and Procedures Audit Checklist for HIPAA Privacy, Security, and Breach Notification Type of Policy and Procedure Comments Completed Privacy Policy to Maintain and Update Notice of Privacy Practices
DHHS Information Technology (IT) Access Control Standard
DHHS Information Technology (IT) Access Control Standard Issue Date: October 1, 2013 Effective Date: October 1,2013 Revised Date: Number: DHHS-2013-001-B 1.0 Purpose and Objectives With the diversity of
Montclair State University. HIPAA Security Policy
Montclair State University HIPAA Security Policy Effective: June 25, 2015 HIPAA Security Policy and Procedures Montclair State University is a hybrid entity and has designated Healthcare Components that
VMware vcloud Air HIPAA Matrix
goes to great lengths to ensure the security and availability of vcloud Air services. In this effort VMware has completed an independent third party examination of vcloud Air against applicable regulatory
Appendix 4-2: Sample HIPAA Security Risk Assessment For a Small Physician Practice
Appendix 4-2: Administrative, Physical, and Technical Safeguards Breach Notification Rule How Use this Assessment The following sample risk assessment provides you with a series of sample questions help
Policies and Compliance Guide
Brooklyn Community Services Policies and Compliance Guide relating to the HIPAA Security Rule June 2013 Table of Contents INTRODUCTION... 3 GUIDE TO BCS COMPLIANCE WITH THE HIPAA SECURITY REGULATION...
LAMAR STATE COLLEGE - ORANGE INFORMATION RESOURCES SECURITY MANUAL. for INFORMATION RESOURCES
LAMAR STATE COLLEGE - ORANGE INFORMATION RESOURCES SECURITY MANUAL for INFORMATION RESOURCES Updated: June 2007 Information Resources Security Manual 1. Purpose of Security Manual 2. Audience 3. Acceptable
INITIAL APPROVAL DATE INITIAL EFFECTIVE DATE
TITLE AND INFORMATION TECHNOLOGY RESOURCES DOCUMENT # 1107 APPROVAL LEVEL Alberta Health Services Executive Committee SPONSOR Legal & Privacy / Information Technology CATEGORY Information and Technology
HIPAA SECURITY RISK ASSESSMENT SMALL PHYSICIAN PRACTICE
HIPAA SECURITY RISK ASSESSMENT SMALL PHYSICIAN PRACTICE How to Use this Assessment The following risk assessment provides you with a series of questions to help you prioritize the development and implementation
NC DPH: Computer Security Basic Awareness Training
NC DPH: Computer Security Basic Awareness Training Introduction and Training Objective Our roles in the Division of Public Health (DPH) require us to utilize our computer resources in a manner that protects
MONTSERRAT COLLEGE OF ART WRITTEN INFORMATION SECURITY POLICY (WISP)
MONTSERRAT COLLEGE OF ART WRITTEN INFORMATION SECURITY POLICY (WISP) 201 CMR 17.00 Standards for the Protection of Personal Information Of Residents of the Commonwealth of Massachusetts Revised April 28,
Supplier Information Security Addendum for GE Restricted Data
Supplier Information Security Addendum for GE Restricted Data This Supplier Information Security Addendum lists the security controls that GE Suppliers are required to adopt when accessing, processing,
HIPAA Security Series
7 Security Standards: Implementation for the Small Provider What is the Security Series? The security series of papers provides guidance from the Centers for Medicare & Medicaid Services (CMS) on the rule
SECURITY RISK ASSESSMENT SUMMARY
Providers Business Name: Providers Business Address: City, State, Zip Acronyms NIST FIPS PHI EPHI BA CE EHR HHS IS National Institute of Standards and Technology Federal Information Process Standards Protected
Physical Protection Policy Sample (Required Written Policy)
Physical Protection Policy Sample (Required Written Policy) 1.0 Purpose: The purpose of this policy is to provide guidance for agency personnel, support personnel, and private contractors/vendors for the
SAMPLE HIPAA/HITECH POLICIES AND PROCEDURES MANUAL FOR THE SECURITY OF ELECTRONIC PROTECTED HEALTH INFORMATION
SAMPLE HIPAA/HITECH POLICIES AND PROCEDURES MANUAL FOR THE SECURITY OF ELECTRONIC PROTECTED HEALTH INFORMATION Please Note: 1. THIS IS NOT A ONE-SIZE-FITS-ALL OR A FILL-IN-THE BLANK COMPLIANCE PROGRAM.
Rotherham CCG Network Security Policy V2.0
Title: Rotherham CCG Network Security Policy V2.0 Reference No: Owner: Author: Andrew Clayton - Head of IT Robin Carlisle Deputy - Chief Officer D Stowe ICT Security Manager First Issued On: 17 th October
HIPAA/HITECH PRIVACY & SECURITY CHECKLIST SELF ASSESSMENT INSTRUCTIONS
HIPAA/HITECH PRIVACY & SECURITY CHECKLIST SELF ASSESSMENT INSTRUCTIONS Thank you for taking the time to fill out the privacy & security checklist. Once completed, this checklist will help us get a better
HIPAA Audit Processes HIPAA Audit Processes. Erik Hafkey Rainer Waedlich
HIPAA Audit Processes Erik Hafkey Rainer Waedlich 1 Policies for all HIPAA relevant Requirements and Regulations Checklist for an internal Audit Process Documentation of the compliance as Preparation for
HIPAA Compliance (DSHS and HCA) Preamble: This section of the Contract is the Business Associate Agreement as
HIPAA Compliance (DSHS and HCA) Preamble: This section of the Contract is the Business Associate Agreement as required by HIPAA. 1. Definitions. a. Business Associate, as used in this Contract, means the
BEFORE THE BOARD OF COUNTY COMMISSIONERS FOR MULTNOMAH COUNTY, OREGON RESOLUTION NO. 05-050
BEFORE THE BOARD OF COUNTY COMMISSIONERS FOR MULTNOMAH COUNTY, OREGON RESOLUTION NO. 05-050 Adopting Multnomah County HIPAA Security Policies and Directing the Appointment of Information System Security
Estate Agents Authority
INFORMATION SECURITY AND PRIVACY PROTECTION POLICY AND GUIDELINES FOR ESTATE AGENTS Estate Agents Authority The contents of this document remain the property of, and may not be reproduced in whole or in
Security Manual for Protected Health Information
Security Manual for Protected Health Information Revised September 2011 Contents PREFACE... 4 TTUHSC Operating Policy Regarding Privacy and Security... 5 1. DEFINITIONS:... 6 2. ADMINISTRATIVE SAFEGUARDS
CREATIVE SOLUTIONS IN HEALTHCARE, INC. Privacy Policy
CREATIVE SOLUTIONS IN HEALTHCARE, INC. Privacy Policy Amended as of February 12, 2010 on the authority of the HIPAA Privacy Officer for Creative Solutions in Healthcare, Inc. TABLE OF CONTENTS ARTICLE
Effective Date: Subject Matter Experts / Approval(s): TAC: LASO: C/ISO: Front Desk: Technology Support Lead: Agency Head:
Policy Title: Effective Date: Revision Date: Subject Matter Experts / Approval(s): TAC: LASO: C/ISO: Front Desk: Technology Support Lead: Agency Head: Every 2 years or as needed Purpose: The purpose of
Data Management Policies. Sage ERP Online
Sage ERP Online Sage ERP Online Table of Contents 1.0 Server Backup and Restore Policy... 3 1.1 Objectives... 3 1.2 Scope... 3 1.3 Responsibilities... 3 1.4 Policy... 4 1.5 Policy Violation... 5 1.6 Communication...
HIPAA Security and HITECH Compliance Checklist
HIPAA Security and HITECH Compliance Checklist A Compliance Self-Assessment Tool HIPAA SECURITY AND HITECH CHECKLIST The Health Insurance Portability and Accountability Act of 1996 (HIPAA) requires physicians
HIPAA Security Checklist
HIPAA Security Checklist The following checklist summarizes HIPAA Security Rule requirements that should be implemented by covered entities and business associates. The citations are to 45 CFR 164.300
U.S. Department of the Interior's Federal Information Systems Security Awareness Online Course
U.S. Department of the Interior's Federal Information Systems Security Awareness Online Course Rules of Behavior Before you print your certificate of completion, please read the following Rules of Behavior
HIPAA Compliance Guide
HIPAA Compliance Guide Important Terms Covered Entities (CAs) The HIPAA Privacy Rule refers to three specific groups as covered entities, including health plans, healthcare clearinghouses, and health care
HIPAA Security. 4 Security Standards: Technical Safeguards. Security Topics
HIPAA Security S E R I E S Security Topics 1. Security 101 for Covered Entities 2. Security Standards - Administrative Safeguards 3. Security Standards - Physical Safeguards 4. Security Standards - Technical
BERKELEY COLLEGE DATA SECURITY POLICY
BERKELEY COLLEGE DATA SECURITY POLICY BERKELEY COLLEGE DATA SECURITY POLICY TABLE OF CONTENTS Chapter Title Page 1 Introduction 1 2 Definitions 2 3 General Roles and Responsibilities 4 4 Sensitive Data
Heather L. Hughes, J.D. HIPAA Privacy Officer U.S. Legal Support, Inc. hhughes@uslegalsupport.com www.uslegalsupport.com
Heather L. Hughes, J.D. HIPAA Privacy Officer U.S. Legal Support, Inc. hhughes@uslegalsupport.com www.uslegalsupport.com HIPAA Privacy Rule Sets standards for confidentiality and privacy of individually
MIT s Information Security Program for Protecting Personal Information Requiring Notification. (Revision date: 2/26/10)
MIT s Information Security Program for Protecting Personal Information Requiring Notification (Revision date: 2/26/10) Table of Contents 1. Program Summary... 3 2. Definitions... 4 2.1 Identity Theft...
Unified Security Anywhere HIPAA COMPLIANCE ACHIEVING HIPAA COMPLIANCE WITH MASERGY PROFESSIONAL SERVICES
Unified Security Anywhere HIPAA COMPLIANCE ACHIEVING HIPAA COMPLIANCE WITH MASERGY PROFESSIONAL SERVICES HIPAA COMPLIANCE Achieving HIPAA Compliance with Security Professional Services The Health Insurance
Welcome to part 2 of the HIPAA Security Administrative Safeguards presentation. This presentation covers information access management, security
Welcome to part 2 of the HIPAA Security Administrative Safeguards presentation. This presentation covers information access management, security awareness training, and security incident procedures. The
Information Technology Security Policies
Information Technology Security Policies Randolph College 2500 Rivermont Ave. Lynchburg, VA 24503 434-947- 8700 Revised 01/10 Page 1 Introduction Computer information systems and networks are an integral
Chronic Disease Management
RESOURCE AND PATIENT MANAGEMENT SYSTEM Chronic Disease Management (BCDM) Version 1.0 Office of Information Technology (OIT) Division of Information Resource Management Albuquerque, New Mexico Table of
Healthcare Compliance Solutions
Healthcare Compliance Solutions Let Protected Trust be your Safe Harbor In the Health Information Technology for Economic and Clinical Health Act of 2009 (HITECH), the U.S. Department of Health and Human
How To Protect Research Data From Being Compromised
University of Northern Colorado Data Security Policy for Research Projects Contents 1.0 Overview... 1 2.0 Purpose... 1 3.0 Scope... 1 4.0 Definitions, Roles, and Requirements... 1 5.0 Sources of Data...
Cyber Self Assessment
Cyber Self Assessment According to Protecting Personal Information A Guide for Business 1 a sound data security plan is built on five key principles: 1. Take stock. Know what personal information you have
2. From a control perspective, the PRIMARY objective of classifying information assets is to:
MIS5206 Week 13 Your Name Date 1. When conducting a penetration test of an organization's internal network, which of the following approaches would BEST enable the conductor of the test to remain undetected
HIPAA Security Training Manual
HIPAA Security Training Manual The final HIPAA Security Rule for Montrose Memorial Hospital went into effect in February 2005. The Security Rule includes 3 categories of compliance; Administrative Safeguards,
8.03 Health Insurance Portability and Accountability Act (HIPAA)
Human Resource/Miscellaneous Page 1 of 5 8.03 Health Insurance Portability and Accountability Act (HIPAA) Policy: It is the policy of Licking/Knox Goodwill Industries, Inc., to maintain the privacy of
HIPAA 101: Privacy and Security Basics
HIPAA 101: Privacy and Security Basics Purpose This document provides important information about Kaiser Permanente policies and state and federal laws for protecting the privacy and security of individually
HIPAA ephi Security Guidance for Researchers
What is ephi? ephi stands for Electronic Protected Health Information (PHI). It is any PHI that is stored, accessed, transmitted or received electronically. 1 PHI under HIPAA means any information that
The second section of the HIPAA Security Rule is related to physical safeguards. Physical safeguards are physical measures, policies and procedures
The second section of the HIPAA Security Rule is related to physical safeguards. Physical safeguards are physical measures, policies and procedures to protect and secure a covered entity s electronic information
Version: Modified By: Date: Approved By: Date: 1.0 Michael Hawkins October 29, 2013 Dan Bowden November 2013
Version: Modified By: Date: Approved By: Date: 1.0 Michael Hawkins October 29, 2013 Dan Bowden November 2013 Rule 4-004L Payment Card Industry (PCI) Physical Security (proposed) 01.1 Purpose The purpose
Data Security Incident Response Plan. [Insert Organization Name]
Data Security Incident Response Plan Dated: [Month] & [Year] [Insert Organization Name] 1 Introduction Purpose This data security incident response plan provides the framework to respond to a security
Virginia Commonwealth University School of Medicine Information Security Standard
Virginia Commonwealth University School of Medicine Information Security Standard Title: Scope: Data Handling and Storage Standard This standard is applicable to all VCU School of Medicine personnel. Approval
IT Best Practices Audit TCS offers a wide range of IT Best Practices Audit content covering 15 subjects and over 2200 topics, including:
IT Best Practices Audit TCS offers a wide range of IT Best Practices Audit content covering 15 subjects and over 2200 topics, including: 1. IT Cost Containment 84 topics 2. Cloud Computing Readiness 225
University of Cincinnati HIPAA Administrative, Physical and Technical Safeguards
HIPAA Administrative, Physical and Technical Safeguards Your information security role in protecting HIPAA information Effective Date: 7/1/2014 Prior Effective Date: 10/1/2013 HIPAA Administrative, Physical
Healthcare Compliance Solutions
Privacy Compliance Healthcare Compliance Solutions Trust and privacy are essential for building meaningful human relationships. Let Protected Trust be your Safe Harbor The U.S. Department of Health and
INFORMATION TECHNOLOGY SECURITY POLICY COUNTY OF IMPERIAL
INFORMATION TECHNOLOGY SECURITY POLICY COUNTY OF IMPERIAL 1 INTRODUCTION The County of Imperial Information & Technical Services (ITS) Security Policy is the foundation of the County's electronic information
Information Technology Cyber Security Policy
Information Technology Cyber Security Policy (Insert Name of Organization) SAMPLE TEMPLATE Organizations are encouraged to develop their own policy and procedures from the information enclosed. Please
Network Security for End Users in Health Care
Network Security for End Users in Health Care Virginia Health Information Technology Regional Extension Center is funded by grant #90RC0022/01 from the Office of the National Coordinator for Health Information
Guide to INFORMATION SECURITY FOR THE HEALTH CARE SECTOR
Guide to INFORMATION SECURITY FOR THE HEALTH CARE SECTOR Information and Resources for Small Medical Offices Introduction The Personal Health Information Protection Act, 2004 (PHIPA) is Ontario s health-specific
Other terms are defined in the Providence Privacy and Security Glossary
Subject: Device and Media Controls Department: Enterprise Security Executive Sponsor: EVP/COO Approved by: Rod Hochman, MD - President/CEO Policy Number: New Date: Revised 10/11/2013 Reviewed Policy Owner:
Security Framework Information Security Management System
NJ Department of Human Services Security Framework - Information Security Management System Building Technology Solutions that Support the Care, Protection and Empowerment of our Clients JAMES M. DAVY
Newcastle University Information Security Procedures Version 3
Newcastle University Information Security Procedures Version 3 A Information Security Procedures 2 B Business Continuity 3 C Compliance 4 D Outsourcing and Third Party Access 5 E Personnel 6 F Operations
How To Protect Decd Information From Harm
Policy ICT Security Please note this policy is mandatory and staff are required to adhere to the content Summary DECD is committed to ensuring its information is appropriately managed according to the
Ohio Supercomputer Center
Ohio Supercomputer Center Portable Security Computing No: Effective: OSC-09 05/27/09 Issued By: Kevin Wohlever Director of Supercomputer Operations Published By: Ohio Supercomputer Center Original Publication
ASCINSURE SPECIALTY RISK PRIVACY/SECURITY PLAN July 15, 2010
ASCINSURE SPECIALTY RISK PRIVACY/SECURITY PLAN July 15, 2010 OBJECTIVE This Security Plan (the Plan ) is intended to create effective administrative, technical and physical safeguards for the protection
Network and Workstation Acceptable Use Policy
CONTENT: Introduction Purpose Policy / Procedure References INTRODUCTION Information Technology services including, staff, workstations, peripherals and network infrastructures are an integral part of
Responsible Access and Use of Information Technology Resources and Services Policy
Responsible Access and Use of Information Technology Resources and Services Policy Functional Area: Information Technology Services (IT Services) Applies To: All users and service providers of Armstrong
HIPAA: Bigger and More Annoying
HIPAA: Bigger and More Annoying Instructor: Laney Kay, JD Contact information: 4640 Hunting Hound Lane Marietta, GA 30062 (770) 312-6257 (770) 998-9204 (fax) laney@laneykay.com www.laneykay.com OFFICIAL
Nationwide Review of CMS s HIPAA Oversight. Brian C. Johnson, CPA, CISA. Wednesday, January 19, 2011
Nationwide Review of CMS s HIPAA Oversight Brian C. Johnson, CPA, CISA Wednesday, January 19, 2011 1 WHAT I DO Manage Region IV IT Audit and Advance Audit Technique Staff (AATS) IT Audit consists of 8
FINAL May 2005. Guideline on Security Systems for Safeguarding Customer Information
FINAL May 2005 Guideline on Security Systems for Safeguarding Customer Information Table of Contents 1 Introduction 1 1.1 Purpose of Guideline 1 2 Definitions 2 3 Internal Controls and Procedures 2 3.1
This policy applies to all DRC employees, contractors, volunteers, interns and other agents of the state.
STATE OF OHIO SUBJECT: PAGE 1 OF 9 DRC Sensitive Data Security Requirements NUMBER: 05-OIT-23 DEPARTMENT OF REHABILITATION AND CORRECTION RULE/CODE REFERENCE: RELATED ACA STANDARDS: SUPERSEDES: 05-OIT-23
The Practice of Internal Controls. Cornell Municipal Clerks School July 16, 2014
The Practice of Internal Controls Cornell Municipal Clerks School July 16, 2014 Page 1 July 18, 2014 Cash Receipts (Collection procedures) Centralize cash collections within a department or for the local
Network Protection and Information Security Policy
Network Protection and Information Security Policy Purpose... 1 Scope... 1 Policy... 1 Responsibilities... 1 System Access Control... 2 System Privileges... 4 Establishment Of Access Paths... 6 Computer
An Oracle White Paper December 2010. Leveraging Oracle Enterprise Single Sign-On Suite Plus to Achieve HIPAA Compliance
An Oracle White Paper December 2010 Leveraging Oracle Enterprise Single Sign-On Suite Plus to Achieve HIPAA Compliance Executive Overview... 1 Health Information Portability and Accountability Act Security
HIPAA Compliance Review Analysis and Summary of Results
HIPAA Compliance Review Analysis and Summary of Results Centers for Medicare & Medicaid Services (CMS) Office of E-Health Standards and Services (OESS) Reviews 2008 Table of Contents Introduction 1 Risk
Supplier IT Security Guide
Revision Date: 28 November 2012 TABLE OF CONTENT 1. INTRODUCTION... 3 2. PURPOSE... 3 3. GENERAL ACCESS REQUIREMENTS... 3 4. SECURITY RULES FOR SUPPLIER WORKPLACES AT AN INFINEON LOCATION... 3 5. DATA
C.T. Hellmuth & Associates, Inc.
Technical Monograph C.T. Hellmuth & Associates, Inc. Technical Monographs usually are limited to only one subject which is treated in considerably more depth than is possible in our Executive Newsletter.
Why Lawyers? Why Now?
TODAY S PRESENTERS Why Lawyers? Why Now? New HIPAA regulations go into effect September 23, 2013 Expands HIPAA safeguarding and breach liabilities for business associates (BAs) Lawyer is considered a business
Written Information Security Plan (WISP) for. HR Knowledge, Inc. This document has been approved for general distribution.
Written Information Security Plan (WISP) for HR Knowledge, Inc. This document has been approved for general distribution. Last modified January 01, 2014 Written Information Security Policy (WISP) for HR
Information Technology Branch Access Control Technical Standard
Information Technology Branch Access Control Technical Standard Information Management, Administrative Directive A1461 Cyber Security Technical Standard # 5 November 20, 2014 Approved: Date: November 20,
micros MICROS Systems, Inc. Enterprise Information Security Policy (MEIP) August, 2013 Revision 8.0 MICROS Systems, Inc. Version 8.
micros MICROS Systems, Inc. Enterprise Information Security Policy (MEIP) Revision 8.0 August, 2013 1 Table of Contents Overview /Standards: I. Information Security Policy/Standards Preface...5 I.1 Purpose....5
How To Protect The Time System From Being Hacked
WISCONSIN TIME SYSTEM Training Materials TIME SYSTEM SECURITY AWARENESS HANDOUT Revised 11/21/13 2014 Security Awareness Handout All System Security The TIME/NCIC Systems are criminal justice computer
ICT NETWORK AND INFRASTRUCTURE FILE SERVER POLICY
ICT NETWORK AND INFRASTRUCTURE FILE SERVER POLICY Version 1.0 Ratified By Date Ratified Author(s) Responsible Committee / Officers Issue Date Review Date Intended Audience Impact Assessed CCG Committee
the American Recovery and Reinvestment Act of 2009
Policy Title: Policy Number: HIPAA Information 9.1.10 Security Category: Effective Date: Policy Owner: Information 10/01/2013 Sr. VP Academic Affairs Technology Prior Effective Date: & Provost N/A Sr.
Datto Compliance 101 1
Datto Compliance 101 1 Overview Overview This document provides a general overview of the Health Insurance Portability and Accounting Act (HIPAA) compliance requirements for Managed Service Providers (MSPs)
M E M O R A N D U M. Revised Information Technology Security Procedures INFORMATION TECHNOLOGY SECURITY PROCEDURES. I. General
M E M O R A N D U M To: From: IT Steering Committee Brian Cohen Date: March 26, 2009 Subject: Revised Information Technology Security Procedures The following is a revised version of the Information Technology
The County of San Bernardino Department of Behavioral Health. Facility Physical Security and Access Control Pr
Facility Physical Security and Access Control Pr Effective Approved 07/01/10 12/06/10 Purpose To provide (DBH) staff with a protocol to follow to ensure protected health information (PHI) and personally
Controls for the Credit Card Environment Edit Date: May 17, 2007
Controls for the Credit Card Environment Edit Date: May 17, 2007 Status: Approved in concept by Executive Staff 5/15/07 This document contains policies, standards, and procedures for securing all credit
HIPAA Privacy and Security Risk Assessment and Action Planning
HIPAA Privacy and Security Risk Assessment and Action Planning Practice Name: Participants: Date: MU Stage: EHR Vendor: Access Control Unique ID and PW for Users (TVS016) Role Based Access (TVS023) Account