Contents. Instructions for Using Online HIPAA Security Plan Generation Tool

Transcription

1 Instructions for Using Online HIPAA Security Plan Generation Tool Contents Step 1 Set Up Account... 2 Step 2 : Fill out the main section of the practice information section of the web site The next section will be to enter the individuals who are responsible for HIPAA Security at your practice The Utilities Section... 4 Section on Alarms... 4 Remote and Local Backup... 5 Network Security... 6 Step 3: Entering Practice Details... 8 Step 4 : Enter your computers... 9 Step 5 Wifi Routers and Access Points Step 6 Hardware, Software and IT Vendors Step 7 Business Associates Step 8 Employees... 16

2 Step 1 Set Up Account When you visit the login page you have two options, to log onto your existing account. To create a new account fill out the section of the page for new accounts. Your address will become your Username. Fill out the remaining fields and hit the [Start] button.

3 Step 2 : Fill out the main section of the practice information section of the web site. You will see that most of the first section is already filled out. You will need to fill out the following additional fields: Support Contact. Please provide the name of the person we will contact if we need to call you about your HIPAA Security Risk Assessment. Please include their phone number and extension. You will need to fill out the phone number for the local Police Department. It may be 911 or it may be a 10 digit number. The next section will be to enter the individuals who are responsible for HIPAA Security at your practice. Your security officer is the person who is responsible for maintaining security of your computers and network at your office. Your compliance office is the person who is responsible for ensuring that the members of your staff follow proper procedures and policies in maintaining the privacy and security of the patient information in your office.

4 Your IT director is the person who installs and maintains the physical computers and your network. Your privacy officer is your office HIPAA public relations person. When patients have questions regarding the HIPAA privacy and security policies and procedures at your office they will be directed to speak to your privacy officer. Your privacy officer needs to be identified in your Notice of Privacy Practices. For smaller practices, it is common for most practices to have a single individual fill all of the four roles. The individuals who have these roles must be trained in the HIPAA rules and regulations at a higher level than the rest of your staff. You will need to arrange for these individuals to attend TLD Systems webinars intended for the Privacy and Security officers. The Utilities Section One of the important aspects of HIPAA compliance is to have access to your critical data. This means you need to be able to turn your computers on, and sometimes connect to computers and services that are outside your office. Your utilities are an important resource. We need to collect information on the reliability of the services you utilize to access your computerized medical records. A UPS is an un- interruptible power supply, also known as a battery backup. A WAN Card is a card or device that you can utilize to access the internet using the cell phone network. Section on Alarms You need to document each physical security measures that you take to protect your data. The documentation of the alarms is part of this documentation.

5 Please fill out this section completely. Remote and Local Backup The next two sections deal with documentation of your backup procedures. Local Back is for documentation of any backup you preform using local devices such as flash drives, hard drives, local tape. Remote backup is any remote backup services that you utilize which can include services provided by your IT providers for remote backup. If you do not do any local backup click NO and skip the rest of this section.

6 If you do not use Remote Backup click no and skip this portion of the Backup Section. Backup Encryption can be accomplished by a couple of different methods. The device(s) you utilize for backup can be encrypted devices or your backup program can encrypt the backup as the backup is being made. You should check with your IT consultant and or vendor to obtain the correct answer to this question. Your Backup devices should be stored off site. This may mean taking it home with you on a daily basis. Where do you store your backup media? What type of backup media do you use? Flash Drives, removable hard drives, list all types of devices that you use. When the backups are stored offsite they should be stored in a secure location such as a fireproof safe. How often you backup is in days. So if you backup every day enter (1). If backup once a week, enter (7). Testing your backup means actually taking the backup file and restoring the file to ensure that if necessary you can utilize the backup. This should be tested on a regular basis. Never test the restore to your live system, always utilize a separate system to restore your backups. This is important because if you restore to your live system and the restore fails you have just corrupted your live system. It is important to work with your vendor or IT consultant to arrange for the testing of your backup files. How many days of backup to you retain. If you backup to one device and over write that device you are retaining 1 day of backup. You need to determine how many days of backup you retain and enter that number in this field. Backup devices wear out or may become too small. What do you do with your backup devices when you are no longer using them to backup your data? Network Security In this section you let us know if you have WiFi in your office and provide other information about your network. Your firewall is hardware or software and you may need to get this information from your IT consultant to answer this question. Your router is a device that sits between your computer network and your internet connection. You will need to get the information on that box.

7 Your IT consultant will know if your network has auditing software. You will need to get this information from your IT consultant. Your IT consultant will also know if your network is set to disable after failed login attempts. When you hit the continue button one of two things will happen, you will be brought to the next page or you will be asked to fill out missing information and then will need to hit the continue button again.

8 Step 3: Entering Practice Details Once you have completed the main section you will then need to complete details on your practice. You will be presented with the following page: On the top are in red you will see a list of the items that are missing from your Risk Analysis. You need to complete each of these items before we can produce your Security Risk Analysis and Risk Mitigation Plan. At this point you can continue or you can click the Main Menu Button and log out. Your information will be saved and you can return to this online tool at any point in time. Each time you complete a section you can hit the [continue] button and the information you entered will be saved for future sections.

9 Step 4 : Enter your computers Identifier this is what you may call the computer for example Jills Workstation. It does not need to be a technical name, it is utilized to help you identify the computer for future management of the computer Make This is the Brand of the computer. This may be a brand name or it may be custom build. Model this is the model of your computer. Service Tag / Serial Number If you computer has one, please enter that information. Operating System, please select the appropriate operating system from the drop down list Number of Hard Drives There are a series of steps you can take to get this information from each of your computers.

10 o Step 1 Click on the Start Button

11 Select Control Panel In the control Panel select Device Manager Select Disk Drives

12 You will see how many drives are in your computer. In the example above there is one disk drive in the computer, The Toshiba MK3261GSYN. In this case you will enter 1 for hard drives. The next question is are the drives encrypted. This relates to whether or not they actual drive is fully encrypted. If the drive is not encrypted but one of more of your programs encrypts the data, the answer to this question is no. You may need to check with your IT consultant to answer this question. Location This will be where the computer is physically located for example back office, server room, or front desk. Antivirus this is the antivirus software that is running on the computer. You will then check the appropriate box to indicate if the computer is attached to a UPS device. Remember a UPS Device is an Un interruptible Power Supply or a Battery Backup. Since laptops have built in batteries, you should check this to be yes for all laptops. If this is a laptop please list the person responsible for the device. If the device has auditing software, note that in this section. You may need to check with your IT consultant to answer this question. Once you have answered all questions you can select to enter the next computer or more on to the next section.

13 Step 5 Wifi Routers and Access Points If you do not have any Wifi Routers or Access Points in your office you will not need to fill out this section. The Manufacturer and Model can be obtained directly from each device. As far as MAC Restriction and Security Settings you can log onto each device and get that information. If you do not know how to do this check with your IT Consultant.

14 Step 6 Hardware, Software and IT Vendors Here you list each of the vendors that you utilize for your technical infrastructure. Who you purchase computers from, who you purchase software from, and who assists you in installing, maintaining and installing your systems. When we have all of the information on a vendor available we give you a tool to populate this entire screen so the first step is to look at the drop down menus and see if we have all of the data for your vendor. Select that vendor and click the save button. If your vendor is not already a preset you will need to fill out all of the information for that vendor. Start with the name of the vendor and your contact person for the vendor, their phone number and their address. If the vendor is NOT a software vendor then you are done with this section. If they are a software vendor then you will need to fill out all of the information on this screen. You will need to contact your vendor to get the answers to each of the questions.

15 Step 7 Business Associates A business associate is any individual or organization that you share patient information with. Examples of business associates include but are not limited to Billing services Transcription Services DME providers Software Support Services that get to see your data Backup Service Providers Medical Providers who are involved in the care of a patient are NOT considered business associates. A good rule of thumb to follow is: If the person or organization has access to patient information and they bill you for their services they are a business associate. If they bill the patient for their services then they are a provider and a they are not a business associate. You are required to have a Business Associate Agreement with each of your business associates. This portion helps you to track each of your Business Associates and the presence or absence of a Business Associate Agreement. Here you enter the company Name, the services they provide whether or not you have a Business Associate Agreement in place and the date of the agreement.

16 Step 8 Employees You need to log each and every employee. This section is utilized to arrange for training for each of your employees. You will need to provide the individual addresses for each employee. You will need to put in the name and job title of each employee as well as their individual address. If you have completed a background check on the employee enter that date. If the employee has completed HIPAA training enter that date. Should the employee complete HIPAA training or you do a background check you can log back into the system and update the profile for that employee.

17 Step 9 Copiers and Printers Your copies, printers and fax machines are potential data stores of patient information. Some of these machines may contain hard drives that contain copies of every document that was printed or sent. In order to safeguard this data you need to carefully track each of the devices in your office that processes patient information. To achieve this we log each device in your practice. This may require a bit of leg work on your part you will need to get the Make and Model of each of your devices, and contact the manufacturer and ask if the device has any hard drives. You will then need to determine if the drive is encrypted. Log these items as well as the device identifier and the location for each device.

18 Step 10 Devices that contain E- PHI If you checked Yes to storing data on local devices you will be required to list each device that contains data in this section. Those devices can include Flash Drives Removable Hard Drives Tape Backup devices Any other device that is physically inside your computer You will need to name each device. This can be as simple as Flash Drive for Monday. You should then place some sort of label on the device so that you can track the device. Some devices have serial numbers, some do not. If the device does not have a serial number enter None or N/A. If the device itself is encrypted click yes. If the software that creates your backups encrypts the file as it is written you can also click yes for encrypted. These backup devices should not be stored in your office, and we recommend that you take them home with you each night and store the devices in a fireproof safe. List where each device is stored. When you retire / destroy the backup device log the method of destruction and the date of destruction of the backup device.

19 When you have finished entering all of your computers, employees, printers and backup devices you are ready to send the manual for review. Click the Place Order link at the bottom of the page and the manual will then be reviewed and you will be contacted to clarify any issues. Should you have questions at any time you can or call (631)