The University of Illinois at Chicago Health Science Colleges
|
|
- Jeffery Hancock
- 8 years ago
- Views:
Transcription
1 POLICY NUMBER: 3 INFORMATION SYSTEMS SECURITY POLICY NAME: CONTINGENCY PLAN CONTROLS Responsible Office HSC IT Group Effective Date 10/31/2011 Responsible Official William Chamberlin Last Revision 10/31/2011 Policy Sections 3.0 Purpose Policy Delegation Policy Data Backup Plan Disaster Recovery Plan Emergency Mode Operation Plan Testing and Revision Procedure Applications and Data Criticality Analysis Policies or Procedures Required by or Referencing this Policy Forms Required by or Referencing this Policy Guidelines Required by or Referencing this Policy Standards Required by or Referencing this Policy Violations Policy Authority Responsibility for Process and Procedure Compliance Monitor Special Situations/Exceptions Contacts Revision History... 7 POLICY NUMBER: 3 Contingency Plan Policy Version 3.0 Page 1 of 7
2 3.0 Purpose The have adopted this policy to provide a framework for contingency planning within the Colleges. This Policy covers the contingency planning policy, application and data criticality, preventive measures, recovery strategy, data backup and disaster recovery planning, development and implementation of an emergency mode operation plan, and developing and testing revision procedures. This Policy is a statement of the minimum requirements, responsibilities, and accepted behaviors required to establish and maintain a secure technology environment within the Health Sciences Colleges, as well as to achieve the stated security objectives. This information security Policy emphasizes the Health Sciences Colleges commitment to strong information security; any individuals who use the information technology resources of the Health Sciences Colleges or the University resources that they depend upon are required to adhere to this Policy. The University s Combined Covered Entity 1, including the Health Sciences Colleges, is committed to securing and protecting High Risk data 2 including electronic Protected Health Information (ephi), 3 in accordance with widely accepted information systems security best practices and standards including those established by the International Organization for Standardization and the International Electrotechnical Commission (IEC); the ISO/IEC series of Information Systems Security standards; the National Institute of Standards and Technology (NIST) Information Security Standards and Guides; and the Standards for Security and Privacy of individually identifiable health information established by the Department of Health and Human Services under the Health Insurance Portability and Accountability Act of 1996 (HIPAA) subject to later modification by the Health Information Technology for Economic and Clinical Health (HITECH) Act of 2009 as part of the American Recovery and Reinvestment Act (ARRA) of , 2, 3 See Covered Entity, High Risk data, and electronic Protected Health Information (ephi) definitions in HSC Policy Definitions POLICY NUMBER: 3 Contingency Plan Policy Version 3.0 Page 2 of 7
3 3.1 Policy Delegation An individual Health Science College may delegate the duties herein to departments or other units within the individual Health Science College, or to other campus units or external vendors. If a duty is delegated, then a Service Agreement defining what is delegated, to whom it is delegated, and the duties still required of the individual Health Science College will be identified. 3.2 Policy Data Backup Plan a. The business units will establish and implement a Data Backup Plan that will detail all backups to be performed, media used for the backups, location used to store the backups, and that will allow for retrieval of copies of all data and files on systems in the event of an emergency, significant interruption, and/or disaster. b. The Data Backup Plan will require that a copy of all media used for the backups be stored in a physically secure location off-site. c. All individuals with specific responsibilities in the Data Backup Plan must be trained in those responsibilities. d. The Data Backup Plan will be documented and available to key personnel Disaster Recovery Plan a. The individual and their business units will create a Disaster Recovery Plan with procedures to recover the College s systems and data in a timely manner from an emergency, significant outage, or disaster such as fire, vandalism, terrorism, system failure, or natural disaster. b. The Disaster Recovery Plan will include procedures to restore data from backups, and the necessary steps and procedures to restore, recover, and resume Critical POLICY NUMBER: 3 Contingency Plan Policy Version 3.0 Page 3 of 7
4 Levels 4 1, 2, and 3 processes, functions, and technology infrastructure components of the College. c. The Disaster Recovery Plan will include a set of procedures, plans, and details to be used for all identified contingencies, including emergency-mode operations planning. The recovery site, recovery responsibilities, and service levels, along with Recovery Point Objectives and Recovery Time Objectives, will be identified. d. All individuals with specific responsibilities in the Disaster Recovery Plan must be trained in those responsibilities. e. The Disaster Recovery Plan will be documented and available to key personnel. A complete copy of the current Disaster Recovery Plan, or copy of the portion pertinent to personnel performing recovery efforts, will be retained off-site in a reliably retrievable form by the relevant personnel as identified in the Plan Emergency Mode Operation Plan a. Each business unit will establish procedures to enable continuation of business processes in Critical Levels 5 1, 2, and 3 to ensure protection of the security of ephi while operating in an Emergency Mode. b. Additionally, a business unit may establish a Emergency Operation Plan to address matters beside ephi such as continuing critical business operations requiring secure access to the more generic data class, High Risk Data. c. All individuals with specific responsibilities in the Emergency Mode Operation Plan must be trained in those responsibilities. d. The Emergency Mode Operation Plan will be documented and available to key personnel. 4 See Critical Level definition in HSC Policy Definitions 5 See Critical Level definition in HSC Policy Definitions POLICY NUMBER: 3 Contingency Plan Policy Version 3.0 Page 4 of 7
5 3.2.4 Testing and Revision Procedure The Health Science College and the business units will establish a process to test the Data Backup Plan, Disaster Recovery Plan, and Emergency Mode Operations Plan. Testing should occur after all individuals with specific responsibilities have been trained in their respective roles and duties Applications and Data Criticality Analysis The individual and their business units will assess the relative criticality of their specific applications and data in support of other Contingency Plan components. 3.3 Policies or Procedures Required by or Referencing this Policy This: References: HSC Policy 4.2.4, Develop Data Backup and Storage Procedures Forms Required by or Referencing this Policy None 3.5 Guidelines Required by or Referencing this Policy None 3.6 Standards Required by or Referencing this Policy None 3.7 Violations Any individual found to have violated this policy may be subject to disciplinary action, up to and including termination of employment, regardless of tenure status. 3.8 Policy Authority Information Technology Group POLICY NUMBER: 3 Contingency Plan Policy Version 3.0 Page 5 of 7
6 3.9 Responsibility for Process and Procedure The Individual Health Science College Information Security Officer 3.10 Compliance Monitor The Individual Health Science College Information Security Officer 3.11 Special Situations/Exceptions Any exceptions to this policy must be approved by the College Information Security Officer or delegate Contacts Subject Contact Phone Applied Health Sciences Mike Kirda Dr. Annette Valenta Dentistry Jay Dean Medicine Andre Pavkovic Interpretation of Policy Nursing Ursula Brozek Bala Ramaraju Pharmacy Philip J. Reiter Public Health Faith Davis Dr. Sylvia Furner La Don Reed POLICY NUMBER: 3 Contingency Plan Policy Version 3.0 Page 6 of 7
7 3.13 Revision History 12/10/2007 Initial draft composed by College of Medicine: Ian Huggins, Robert McAuley, Andre Pavkovic 3/25/2009 Reviewed and Approved by HSC IT Group College of Medicine: Robert McAuley, Andre Pavkovic, Ian Huggins. College of Applied Health Sciences: Mike Kirda, Dr. Annette Valenta. College of Dentistry: Jay Dean. College of Nursing: Bala Ramaraju. College of Pharmacy: Philip Reiter. School of Public Health: La Don Reed (with input by Academic Computing and Communications Center and University of Illinois Medical Center) 3/03/2010 Updated 1.12 Contacts, completed first annual review of HSC Policies 7/07/ /2010 through 6/2011 HSC IT Group Review of Policies - Edited by Judith Grobe Sachs; Group s following consensus revisions summarized by Ian Huggins 7/21/2011 Updated language by Mike Kirda, Judith Grobe Sachs, and Doug McCarthy 8/19/2011 Updated language, added numbering and automatic table of contents, added cross-references by Doug McCarthy. 10/31/2011 HSC IT Group approval of 10/2010 through 8/2011 Policy revisions, this completes the second annual review of the Policies. POLICY NUMBER: 3 Contingency Plan Policy Version 3.0 Page 7 of 7
The University of Illinois at Chicago Health Science Colleges
POLICY NUMBER: 6 INFORMATION SYSTEMS SECURITY POLICY NAME: INFORMATION ACCESS MANAGEMENT SECURITY Responsible Office HSC IT Group Effective Date 10/31/2011 Responsible Official William Chamberlin Last
More informationThe University of Illinois at Chicago Health Science Colleges
POLICY NUMBER: 2 INFORMATION SYSTEMS SECURITY POLICY NAME: AUDIT CONTROL Responsible Office HSC IT Group Effective Date 10/31/2011 Responsible Official William Chamberlin Last Revision 10/31/2011 Policy
More informationThe University of Illinois at Chicago. Health Science Colleges
POLICY NUMBER: 9 INFORMATION SYSTEMS SECURITY POLICY NAME: SECURITY INCIDENT RESPONSE AND REPORTING Responsible Office HSC IT Group Effective Date 10/31/2011 Responsible Official William Chamberlin Last
More informationThe University of Illinois at Chicago. Health Science Colleges
POLICY NUMBER: 12 INFORMATION SYSTEMS SECURITY POLICY NAME: SECURITY AWARENESS AND TRAINING Responsible Office HSC IT Group Effective Date 10/31/2011 Responsible Official William Chamberlin Last Revision
More informationMaintenance Connection Disaster Recovery Plan
Maintenance Connection Disaster Recovery Plan Last Revised: January 2014 Maintenance Connection, Inc. 1477 Drew Ave. Suite 103 Davis, CA 95695 8885673434 1 Introduction Maintenance Connection s Disaster
More informationUniversity of Illinois at Chicago Health Sciences Colleges Information Technology Group Security Policies Summary
University of Illinois at Chicago Health Sciences Colleges Information Technology Group Security Policies Summary This Summary was prepared March 2009 by Ian Huggins prior to HSC adoption of the most recent
More informationHIPAA Security. 2 Security Standards: Administrative Safeguards. Security Topics
HIPAA Security SERIES Security Topics 1. Security 101 for Covered Entities 5. 2. Security Standards - Organizational, Security Policies Standards & Procedures, - Administrative and Documentation Safeguards
More informationHIPAA Compliance Guide
HIPAA Compliance Guide Important Terms Covered Entities (CAs) The HIPAA Privacy Rule refers to three specific groups as covered entities, including health plans, healthcare clearinghouses, and health care
More informationHealth Insurance Portability and Accountability Act (HIPAA) and Health Information Technology for Economic and Clinical Health Act (HITECH)
Health Insurance Portability and Accountability Act (HIPAA) and Health Information Technology for Economic and Clinical Health Act (HITECH) Table of Contents Introduction... 1 1. Administrative Safeguards...
More informationVirginia Commonwealth University School of Medicine Information Security Standard
Virginia Commonwealth University School of Medicine Information Security Standard Title: Scope: Business Continuity Management Standard for IT Systems This standard is applicable to all VCU School of Medicine
More informationDatto Compliance 101 1
Datto Compliance 101 1 Overview Overview This document provides a general overview of the Health Insurance Portability and Accounting Act (HIPAA) compliance requirements for Managed Service Providers (MSPs)
More informationHIPAA Compliance Guide
HIPAA Compliance Guide Important Terms Covered Entities (CAs) The HIPAA Privacy Rule refers to three specific groups as covered entities, including health plans, healthcare clearinghouses, and health care
More informationThis is the third and final presentation on HIPAA Security Administrative Safeguards. This presentation focuses on the last 2 standards under the
This is the third and final presentation on HIPAA Security Administrative Safeguards. This presentation focuses on the last 2 standards under the HIPAA Security rule: Contingency planning and evaluation.
More informationHIPAA COMPLIANCE AND DATA PROTECTION. sales@eaglenetworks.it +39 030 201.08.25 Page 1
HIPAA COMPLIANCE AND DATA PROTECTION sales@eaglenetworks.it +39 030 201.08.25 Page 1 CONTENTS Introduction..... 3 The HIPAA Security Rule... 4 The HIPAA Omnibus Rule... 6 HIPAA Compliance and EagleHeaps
More informationHow To Write A Health Care Security Rule For A University
INTRODUCTION HIPAA Security Rule Safeguards Recommended Standards Developed by: USF HIPAA Security Team May 12, 2005 The Health Insurance Portability and Accountability Act (HIPAA) Security Rule, as a
More informationWHITE PAPER. HIPAA-Compliant Data Backup and Disaster Recovery
WHITE PAPER HIPAA-Compliant Data Backup and Disaster Recovery DOCUMENT INFORMATION HIPAA-Compliant Data Backup and Disaster Recovery PRINTED March 2011 COPYRIGHT Copyright 2011 VaultLogix, LLC. All Rights
More informationPlan Development Getting from Principles to Paper
Plan Development Getting from Principles to Paper March 22, 2015 Table of Contents / Agenda Goals of the workshop Overview of relevant standards Industry standards Government regulations Company standards
More informationHIPAA BUSINESS ASSOCIATE AGREEMENT
HIPAA BUSINESS ASSOCIATE AGREEMENT This Business Associate Agreement ( BAA ) is effective ( Effective Date ) by and between ( Covered Entity ) and Egnyte, Inc. ( Egnyte or Business Associate ). RECITALS
More informationHeather L. Hughes, J.D. HIPAA Privacy Officer U.S. Legal Support, Inc. hhughes@uslegalsupport.com www.uslegalsupport.com
Heather L. Hughes, J.D. HIPAA Privacy Officer U.S. Legal Support, Inc. hhughes@uslegalsupport.com www.uslegalsupport.com HIPAA Privacy Rule Sets standards for confidentiality and privacy of individually
More informationWHITE PAPER. HIPPA Compliance and Secure Online Data Backup and Disaster Recovery
WHITE PAPER HIPPA Compliance and Secure Online Data Backup and Disaster Recovery January 2006 HIPAA Compliance and the IT Portfolio Online Backup Service Introduction October 2004 In 1996, Congress passed
More informationEnsuring HIPAA Compliance with eztechdirect Online Backup and Archiving Services
Ensuring HIPAA Compliance with eztechdirect Online Backup and Archiving Services Introduction Patient privacy continues to be a chief topic of concern as technology continues to evolve. Now that the majority
More informationCERT Resilience Management Model (CERT -RMM) V1.1: NIST Special Publication 800-66 Crosswalk
CERT Resilience Management Model (CERT -RMM) V1.1: NIST Special Publication 800-66 Crosswalk Lisa R. Young, Software Engineering Institute Ma-Nyahn Kromah, SunGard Availability Services October 2013 TECHNICAL
More informationDisaster Recovery and Business Continuity Plan
Disaster Recovery and Business Continuity Plan Table of Contents 1. Introduction... 3 2. Objectives... 3 3. Risks... 3 4. Steps of Disaster Recovery Plan formulation... 3 5. Audit Procedure.... 5 Appendix
More informationSCOPE; ENFORCEMENT; AUTHORITY; EXCEPTIONS
Title: DRAFT USG Continuity of Operation Plan Policy Policy Number: 2009-Julian Date Topical Security Area: Document Type: Standard Pages: Words: Lines: 5 1,387 182 Issue Date: May-09 Effective Date: Immediately
More informationHIPAA Security. 2 Security Standards: Administrative Safeguards. Security. Topics
HIPAA Security SERIES Security Topics 1. Security 101 for Covered Entities 5. 2. Security Standards - Organizational, Security Policies Standards & Proc - A edures, dministrativ and e Documentation Safeguards
More informationHIPAA COMPLIANCE AND
INTRONIS CLOUD BACKUP & RECOVERY HIPAA COMPLIANCE AND DATA PROTECTION CONTENTS Introduction 3 The HIPAA Security Rule 4 The HIPAA Omnibus Rule 6 HIPAA Compliance and Intronis Cloud Backup and Recovery
More informationInformation Security Program
Stephen F. Austin State University Information Security Program Revised: September 2014 2014 Table of Contents Overview... 1 Introduction... 1 Purpose... 1 Authority... 2 Scope... 2 Information Security
More informationVMware vcloud Air HIPAA Matrix
goes to great lengths to ensure the security and availability of vcloud Air services. In this effort VMware has completed an independent third party examination of vcloud Air against applicable regulatory
More information1. Secure 128-Bit SSL Communication 2. Backups Are Securely Encrypted 3. We Don t Keep Your Encryption Key VERY IMPORTANT:
HOW IT WORKS 1. Secure 128-Bit SSL Communication All communications between Offsite Backup Server and your computer are transported in a 128-bit SSL (Secure Socket Layer) channel. Although all your backup
More informationHealthcare Compliance Solutions
Privacy Compliance Healthcare Compliance Solutions Trust and privacy are essential for building meaningful human relationships. Let Protected Trust be your Safe Harbor The U.S. Department of Health and
More informationSUBJECT: SECURITY OF ELECTRONIC MEDICAL RECORDS COMPLIANCE WITH THE HEALTH INSURANCE PORTABILITY AND ACCOUNTABILITY ACT OF 1996 (HIPAA)
UNIVERSITY OF PITTSBURGH POLICY SUBJECT: SECURITY OF ELECTRONIC MEDICAL RECORDS COMPLIANCE WITH THE HEALTH INSURANCE PORTABILITY AND ACCOUNTABILITY ACT OF 1996 (HIPAA) DATE: March 18, 2005 I. SCOPE This
More informationHIPAA Security Alert
Shipman & Goodwin LLP HIPAA Security Alert July 2008 EXECUTIVE GUIDANCE HIPAA SECURITY COMPLIANCE How would your organization s senior management respond to CMS or OIG inquiries about health information
More informationCHIS, Inc. Privacy General Guidelines
CHIS, Inc. and HIPAA CHIS, Inc. provides services to healthcare facilities and uses certain protected health information (PHI) in connection with performing these services. Therefore, CHIS, Inc. is classified
More informationHIPAA Audit Processes HIPAA Audit Processes. Erik Hafkey Rainer Waedlich
HIPAA Audit Processes Erik Hafkey Rainer Waedlich 1 Policies for all HIPAA relevant Requirements and Regulations Checklist for an internal Audit Process Documentation of the compliance as Preparation for
More informationFINRMFS9 Facilitate Business Continuity Planning and disaster recovery for a financial services organisation
Facilitate Business Continuity Planning and disaster recovery for a Overview This unit is suitable for those working in risk management roles who have responsibility for facilitating business continuity
More informationHIPAA Security Checklist
HIPAA Security Checklist The following checklist summarizes HIPAA Security Rule requirements that should be implemented by covered entities and business associates. The citations are to 45 CFR 164.300
More informationITS HIPAA Security Compliance Recommendations
ITS HIPAA Security Compliance Recommendations October 24, 2005 Updated May 31, 2010 http://its.uncg.edu/hipaa/security/ Table of Contents Introduction...1 Purpose of this Document...1 Important Terms...1
More informationHIPAA SECURITY RISK ASSESSMENT SMALL PHYSICIAN PRACTICE
HIPAA SECURITY RISK ASSESSMENT SMALL PHYSICIAN PRACTICE How to Use this Assessment The following risk assessment provides you with a series of questions to help you prioritize the development and implementation
More informationHIPAA Security Series
7 Security Standards: Implementation for the Small Provider What is the Security Series? The security series of papers provides guidance from the Centers for Medicare & Medicaid Services (CMS) on the rule
More informationEnsuring HIPAA Compliance with Computer BYTES Online Backup and Archiving Services
Ensuring HIPAA Compliance with Computer BYTES Online Backup and Archiving Services Page 2 of 8 Introduction Patient privacy has become a major topic of concern over the past several years. With the majority
More informationEnsuring HIPAA Compliance with Pros 4 Technology Online Backup and Archiving Services
Ensuring HIPAA Compliance with Pros 4 Technology Online Backup and Archiving Services Introduction Patient privacy has become a major topic of concern over the past several years. With the majority of
More informationBACKUP AND CONTIGENCY PLANS (DISASTER RECOVERY)
BACKUP AND CONTIGENCY PLANS (DISASTER RECOVERY) PURPOSE The purpose of this policy is to describe the backup and contingency plans, including disaster recovery planning, that will be implemented to ensure
More informationHIPAA Privacy & Security White Paper
HIPAA Privacy & Security White Paper Sabrina Patel, JD +1.718.683.6577 sabrina@captureproof.com Compliance TABLE OF CONTENTS Overview 2 Security Frameworks & Standards 3 Key Security & Privacy Elements
More informationHIPAA Security Matrix
HIPAA Matrix Hardware : 164.308(a)(1) Management Process =Required, =Addressable Risk Analysis The Covered Entity (CE) can store its Risk Analysis document encrypted and offsite using EVault managed software
More informationInformation Privacy and Security Program Title:
Page: 1 of 11 I. PURPOSE: The purpose of this standard is to protect the safety of our workforce members and mitigate potential risk(s) that could materially affect the ability of the facility to remain
More informationThe second section of the HIPAA Security Rule is related to physical safeguards. Physical safeguards are physical measures, policies and procedures
The second section of the HIPAA Security Rule is related to physical safeguards. Physical safeguards are physical measures, policies and procedures to protect and secure a covered entity s electronic information
More informationUNIVERSITY OF CALIFORNIA, SANTA CRUZ 2015 HIPAA Security Rule Compliance Workbook
Introduction Per UCSC's HIPAA Security Rule Compliance Policy 1, all UCSC entities subject to the HIPAA Security Rule ( HIPAA entities ) must implement the UCSC Practices for HIPAA Security Rule Compliance
More informationDRAFT BUSINESS ASSOCIATES AGREEMENT
DRAFT BUSINESS ASSOCIATES AGREEMENT THIS AGREEMENT is made this day of, 20, by and among, a Corporation organized under the laws of the State of (hereinafter known as "Covered Entity") and organized under
More informationTechnology Recovery Plan Instructions
State of California California Information Security Office Technology Recovery Plan Instructions SIMM 5325-A (Formerly SIMM 65A) September 2013 REVISION HISTORY REVISION DATE OF RELEASE OWNER SUMMARY OF
More informationPolicy Title: HIPAA Security Awareness and Training
Policy Title: HIPAA Security Awareness and Training Number: TD-QMP-7011 Subject: HIPAA Security Awareness and Training Primary Department: TennDent/Quality Monitoring/Improvement Effective Date of Policy:
More informationJoe Dylewski President, ATMP Solutions
Joe Dylewski President, ATMP Solutions Joe Dylewski President, ATMP Solutions Assistant Professor, Madonna University 20 Years, Technology and Application Implementation Experience Served as Michigan Healthcare
More informationDOCUMENT NUMBER: IT-0514
SUBJECT: Disaster Recovery Plan EFFECTIVE DATE: 04/15/05 PAGE 1 OF 6 OFFICE OF MIS: DATE: SECRETARY OF DHHR: DATE: 1.0 PURPOSE The purpose of this policy is to specify requirements and responsibilities
More informationThe HIPAA Audit Program
The HIPAA Audit Program Anna C. Watterson Davis Wright Tremaine LLP The U.S. Department of Health and Human Services (HHS) was given authority, and a mandate, to conduct periodic audits of HIPAA 1 compliance
More informationOur Colorado region is offering a FREE Disaster Recovery Review promotional through June 30, 2009!
Disaster Recovery Review FREE Promotional Offer Our Colorado region is offering a FREE Disaster Recovery Review promotional through June 30, 2009! This review is designed to help the small business better
More informationHIPAA Security Compliance Reviews
HIPAA Security Compliance Reviews Elizabeth S. Holland, MPA Office of E-Health Standards and Services Centers for Medicare & Medicaid Services U.S. Department of Health and Human Services 1 2 What is HIPAA?
More informationHIPAA/HITECH PRIVACY & SECURITY CHECKLIST SELF ASSESSMENT INSTRUCTIONS
HIPAA/HITECH PRIVACY & SECURITY CHECKLIST SELF ASSESSMENT INSTRUCTIONS Thank you for taking the time to fill out the privacy & security checklist. Once completed, this checklist will help us get a better
More informationFACT SHEET: Ransomware and HIPAA
FACT SHEET: Ransomware and HIPAA A recent U.S. Government interagency report indicates that, on average, there have been 4,000 daily ransomware attacks since early 2016 (a 300% increase over the 1,000
More informationHealthcare Compliance Solutions
Healthcare Compliance Solutions Let Protected Trust be your Safe Harbor In the Health Information Technology for Economic and Clinical Health Act of 2009 (HITECH), the U.S. Department of Health and Human
More informationBusiness Unit CONTINGENCY PLAN
Contingency Plan Template Business Unit CONTINGENCY PLAN Version 1.0 (Date submitted) Submitted By: Business Unit Date Version 1.0 Page 1 1 Plan Review and Updates... 3 2 Introduction... 3 2.1 Purpose...
More informationBusiness Continuity Information Gathering Template
Business Continuity Information Gathering Template August 2009 Introduction Our organization has begun an intensive effort to document Business Continuity Plans for all departments and s. The Department
More informationUniversity of Massachusetts Medical School's Data Center Relocation For the period July 1, 2008 through August 31, 2010
` Official Audit Report Issued September 30, 2011 University of Massachusetts Medical School's Data Center Relocation For the period July 1, 2008 through August 31, 2010 State House Room 230 Boston, MA
More informationHIPAA Compliance and the Protection of Patient Health Information
HIPAA Compliance and the Protection of Patient Health Information WHITE PAPER By Swift Systems Inc. April 2015 Swift Systems Inc. 7340 Executive Way, Ste M Frederick MD 21704 1 Contents HIPAA Compliance
More informationDisaster Recovery Planning for Health care Providers
E-Guide Disaster Recovery Planning for Health care Providers For hospitals, timely access to patient data is critical for maintaining normal operations during a natural or man-made disaster. This Eguide
More informationInformation Protection Framework: Data Security Compliance and Today s Healthcare Industry
Information Protection Framework: Data Security Compliance and Today s Healthcare Industry Executive Summary Today s Healthcare industry is facing complex privacy and data security requirements. The movement
More informationITSM Tools Operation Continuity Plan Example
ITSM Tools Operation Continuity Plan Example 1 Table of Contents 2 Introduction... 2 3 Invocation... 2 4 Scope... 2 5 Data Dependencies and Considerations... 3 6 Security and Access Considerations... 3
More informationBusiness Continuity Planning for Schools, Departments & Support Units
Business Continuity Planning for Schools, Departments & Support Units 1 What is Business Continuity Planning? Examples Planning for an adverse, major or catastrophic event that would cause a disruption
More informationHIPAA: In Plain English
HIPAA: In Plain English Material derived from a presentation by Kris K. Hughes, Esq. Posted with permission from the author. The Health Insurance Portability and Accountability Act of 1996 (HIPAA), Pub.
More informationVolume UC DAVIS HEALTH SYSTEM. HIPAA Security Compliance Workbook. Multi User Guide
Volume 1 UC DAVIS HEALTH SYSTEM HIPAA Security Compliance Workbook Multi User Guide UC DAVIS HEALTH SYSTEM HIPAA Security Compliance Workbook Guide Table of Contents Introduction General Instructions SECTION
More informationData Center Assistance Group, Inc. DCAG Contact: Tom Bronack Phone: (718) 591-5553 Email: bronackt@dcag.com Fax: (718) 380-7322
Business Continuity and Disaster Recovery Job Descriptions Table of Contents Business Continuity Services Organization Chart... 2 Director Business Continuity Services Group... 3 Manager of Business Recovery
More informationUniversity of Cincinnati Limited HIPAA Glossary
University of Cincinnati Limited HIPAA Glossary ephi System A system that creates accesses, transmits or receives: 1) primary source ephi, 2) ephi critical for treatment, payment or health care operations
More informationHIPAA BUSINESS ASSOCIATE ADDENDUM (Privacy & Security) I. Definitions
HIPAA BUSINESS ASSOCIATE ADDENDUM (Privacy & Security) I. Definitions A. Business Associate. Business Associate shall have the meaning given to such term under the Privacy and Security Rules, including,
More informationSecurity Is Everyone s Concern:
Security Is Everyone s Concern: What a Practice Needs to Know About ephi Security Mert Gambito Hawaii HIE Compliance and Privacy Officer July 26, 2014 E Komo Mai! This session s presenter is Mert Gambito
More informationHIPAA Security Rule Compliance
HIPAA Security Rule Compliance Caryn Reiker MAXIS360 HIPAA Security Rule Compliance what is it and why you should be concerned about it Table of Contents About HIPAA... 2 Who Must Comply... 2 The HIPAA
More informationHIPAA and Mental Health Privacy:
HIPAA and Mental Health Privacy: What Social Workers Need to Know Presenter: Sherri Morgan, JD, MSW Associate Counsel, NASW Legal Defense Fund and Office of Ethics & Professional Review 2010 National Association
More informationSECTION 15 INFORMATION TECHNOLOGY
SECTION 15 INFORMATION TECHNOLOGY 15.1 Purpose 15.2 Authorization 15.3 Internal Controls 15.4 Computer Resources 15.5 Network/Systems Access 15.6 Disaster Recovery Plan (DRP) 15.1 PURPOSE The Navajo County
More informationInformation Security Policy and Handbook Overview. ITSS Information Security June 2015
Information Security Policy and Handbook Overview ITSS Information Security June 2015 Information Security Policy Control Hierarchy System and Campus Information Security Policies UNT System Information
More informationHIPAA Compliance Audits: Your Newest Risk: Are You Prepared?
HIPAA Compliance Audits: Your Newest Risk: Are You Prepared? Presented by: Melissa (Lisa) Thompson, JD, MPH and Elizabeth Lamkin, MHA Slide 1 Speakers Melissa (Lisa) Thompson, JD, MPH Partner Adelman,
More informationUnderstanding Health Insurance Portability Accountability Act AND HITECH. HIPAA s Privacy Rule
Understanding Health Insurance Portability Accountability Act AND HITECH HIPAA s Privacy Rule 1 What Is HIPAA s Privacy Rule The privacy rule is a component of the Health Insurance Portability and Accountability
More informationSecurity Manual for Protected Health Information
Security Manual for Protected Health Information Revised September 2011 Contents PREFACE... 4 TTUHSC Operating Policy Regarding Privacy and Security... 5 1. DEFINITIONS:... 6 2. ADMINISTRATIVE SAFEGUARDS
More informationPRIVACY POLICIES AND FORMS FOR BUSINESS ASSOCIATES
PRIVACY POLICIES AND FORMS FOR BUSINESS ASSOCIATES TABLE OF CONTENTS A. Overview of HIPAA Compliance Program B. General Policies 1. Glossary of Defined Terms Used in HIPAA Policies and Procedures 2. Privacy
More informationHIPAA Security COMPLIANCE Checklist For Employers
Compliance HIPAA Security COMPLIANCE Checklist For Employers All of the following steps must be completed by April 20, 2006 (April 14, 2005 for Large Health Plans) Broadly speaking, there are three major
More informationDisaster Recovery Plan Overview for Customers. Sage ERP Online
Disaster Recovery Plan Overview for Customers Sage ERP Online Table of Contents 1.0 Executive Summary... 3 1.1 The Plan... 3 1.2 Determining Factors... 4 2.0 Disaster Recovery Strategy... 5 2.1 Summary
More informationMy Docs Online HIPAA Compliance
My Docs Online HIPAA Compliance Updated 10/02/2013 Using My Docs Online in a HIPAA compliant fashion depends on following proper usage guidelines, which can vary based on a particular use, but have several
More informationHIPAA/HITECH: A Guide for IT Service Providers
HIPAA/HITECH: A Guide for IT Service Providers Much like Arthur Dent in the opening scene of The Hitchhiker s Guide to the Galaxy (HHGTTG), you re experiencing the impact of new legislation that s infringing
More informationBuilding and Maintaining a Business Continuity Program
Building and Maintaining a Business Continuity Program Successful strategies for financial institutions for effective preparation and recovery Table of Contents Introduction...3 This white paper was written
More informationA to Z Information Services stands out from the competition with CA Recovery Management solutions
Customer success story October 2013 A to Z Information Services stands out from the competition with CA Recovery Management solutions Client Profile Industry: IT Company: A to Z Information Services Employees:
More informationClinic Business Continuity Plan Guidelines
Clinic Business Continuity Plan Guidelines Emergency notification contacts: Primary Role Name Address Home phone Mobile/Cell phone Business Continuity Plan Coordinator QSP Business Continuity Plan Coordinator
More informationOffice of Inspector General
DEPARTMENT OF HOMELAND SECURITY Office of Inspector General Security Weaknesses Increase Risks to Critical United States Secret Service Database (Redacted) Notice: The Department of Homeland Security,
More informationHIPAA RISK ASSESSMENT
HIPAA RISK ASSESSMENT PRACTICE INFORMATION (FILL OUT ONE OF THESE FORMS FOR EACH LOCATION) Practice Name: Address: City, State, Zip: Phone: E-mail: We anticipate that your Meaningful Use training and implementation
More informationSecurity Architecture. Title Disaster Planning Procedures for Information Technology
Category Applicability Title Disaster Planning Procedures for Information Technology All Public Entities (See the Applicability section below.) Standard - A degree or level of requirement that all jurisdictions
More informationHIPAA Security. 1 Security 101 for Covered Entities. Security Topics
HIPAA SERIES Topics 1. 101 for Covered Entities 2. Standards - Administrative Safeguards 3. Standards - Physical Safeguards 4. Standards - Technical Safeguards 5. Standards - Organizational, Policies &
More informationDocumentation. Disclaimer
HOME UTORprotect DOCUMENTATION AMS/ROSI SERVICES CONTACT Documentation Disaster Recovery Planning Disaster Recovery Planning Disclaimer The following project outline is provided solely as a guide. It is
More informationVolume UC DAVIS HEALTH SYSTEM. HIPAA Security Compliance Workbook. Single - User Guide
Volume 1 UC DAVIS HEALTH SYSTEM HIPAA Security Compliance Workbook Single - User Guide UC DAVIS HEALTH SYSTEM HIPAA Security Compliance Workbook Guide 1 Table of Contents Introduction General Instructions
More informationHIPAA Security. 5 Security Standards: Organizational, Policies. Security Topics. and Procedures and Documentation Requirements
HIPAA Security S E R I E S Security Topics 1. Security 101 for Covered Entities 2. Security Standards - Administrative Safeguards 3. Security Standards - Physical Safeguards 4. Security Standards - Technical
More informationThe Basics of HIPAA Privacy and Security and HITECH
The Basics of HIPAA Privacy and Security and HITECH Protecting Patient Privacy Disclaimer The content of this webinar is to introduce the principles associated with HIPAA and HITECH regulations and is
More informationWhite Paper THE HIPAA FINAL OMNIBUS RULE: NEW CHANGES IMPACTING BUSINESS ASSOCIATES
White Paper THE HIPAA FINAL OMNIBUS RULE: NEW CHANGES IMPACTING BUSINESS ASSOCIATES CONTENTS Introduction 3 Brief Overview of HIPPA Final Omnibus Rule 3 Changes to the Definition of Business Associate
More informationMontclair State University. HIPAA Security Policy
Montclair State University HIPAA Security Policy Effective: June 25, 2015 HIPAA Security Policy and Procedures Montclair State University is a hybrid entity and has designated Healthcare Components that
More informationEnsuring HIPAA Compliance with AcclaimVault Online Backup and Archiving Services
Ensuring HIPAA Compliance with AcclaimVault Online Backup and Archiving Services 1 Contents 3 Introduction 5 The HIPAA Security Rule 7 HIPAA Compliance & AcclaimVault Backup 8 AcclaimVault Security and
More informationAppendix 4-2: Sample HIPAA Security Risk Assessment For a Small Physician Practice
Appendix 4-2: Administrative, Physical, and Technical Safeguards Breach Notification Rule How Use this Assessment The following sample risk assessment provides you with a series of sample questions help
More informationINTERNAL AUDIT 2008/09 INFORMATION TECHNOLOGY (BUSINESS CONTINUITY)
2008/09 SUMMARY Location Subject Business Sponsor Staff engaged Coleg Gwent Information Technology (Business Continuity) Lynda Roberts Sue Harris Head of Internal Audit Gaynor Rains Manager David Bratt
More information