HIPAA Compliance Evaluation Report

Transcription

1 Jun29,2016 HIPAA Compliance Evaluation Report Custom HIPAA Risk Evaluation provided for: OF Date of Report 10/13/2014 Findings Each section of the pie chart represents the HIPAA compliance risk determinations based upon the answers you provided. Green represents those areas that are low risk. You've gotten a lot of compliance activities done for these areas, and may need just a few more things to do for full compliance. For most areas you may have reached compliance and now need to start working on maintaining compliance in those areas on an ongoing basis. You would probably not get non-compliance findings on a report from a regulator or auditor for these areas, if you have documentation to support your answers. Yellow represents those areas that are medium risk. You may have several compliance requirements yet to complete to get into compliance. Once you are there, you then need to establish a plan to maintain compliance on an ongoing basis. You would probably get some warnings and/or findings on a report from a regulator or auditor for these areas. If you have documentation to support your compliance efforts, that would help you to avoid findings and get the less severe warnings. Red represents those areas that are high risk. You have not done compliance activities in these areas, may have just started, or may have not done anything for more than one or two years for compliance. You have many activities to do to reach compliance, and then you need to be diligent in establishing a plan to maintain compliance on an ongoing basis. You would probably get many findings on a report from a regulator or auditor for these areas. If you do not have documentation to support your compliance efforts, that would also result in findings on their report. Please refer to the recommendations below for some simple steps to take to mitigate the identified risks, and to avoid the associated possible non-compliance penalties that could occur after a compliance audit, or during an investigation if you ever have a breach. Recommendations Our HIPAA Risk Level Evaluator is not a complete risk assessment but is a great tool designed to give the user a good idea where they stand with overall compliance. Use the tool to assess which areas need work and use the

2 recommendations as a guide. If you need a more complete risk assessment, please contact us and we'll recommend a good solution. If you need a system to manage compliance click here. Question 1: To which of the following items of PHI do you have access? Please check all that apply? Your Risk: Low Question 2: Please list any previously unmentioned PHI to which you have access (separate by commas) lk If there are additional PHI items provided that were not in the previous list, it is common for these information items to not have appropriate security and privacy controls applied. Ensure appropriate controls are in place for the additional PHI items. In addition to the actions to mitigate the Low, Medium and High risks. Question 3: Select One of the following which best describes your company's access to your client's protected health information (PHI) Question 4: Name the formally designated person or position that serves as your organization's privacy and security officer, or otherwise has assigned responsibility for privacy and security. If none, type None. Your Risk: Low lk This fulfills the need to formally assign HIPAA compliance responsibility. Ensure this position is maintained appropriately. Question 5: When was the last time you updated your documented privacy and information security policies and procedures? lk Information security and privacy policies must be documented kept updated to meet HIPAA requirements. Update the documented information security and privacy policies and supporting procedures, forms and other documentation.

3 Question 6: Describe how the privacy and information security policies and procedures are communicated to all personnel, and made available for them to review at any time. Check all that apply. Your Risk: Low Question 7: Do you provide regular training and ongoing awareness communications for information security and privacy for all your workers. Question 8: Provide the date for the most recent information security and privacy training. lk It is good, and required by HIPAA, to provide regular training and ongoing awareness communications. This should occur at least annually for all employees, and to appropriately mitigate risks, additional training and awareness for those with access to a large amount of PHI and/or directly answering patient/insureds questions about their accounts. Provide regular training (at least annually) to all employees, targeted training to higher risk areas, and ongoing awareness communications. Question 9: Provide the date for when you performed your most recent information security risk assessment: lk It is necessary for effective information security and privacy efforts, and required by HIPAA, perform regular risk assessments. Considering the speed with which businesses change technology, services, personnel, etc., risk assessments should occur at least once a year and when major business changes or breaches occur. Perform risk assessments at least once a year and when major business changes or breaches occur. Question 10: When was the last time you performed a vulnerability or penetration scan on your networks and systems? lk Performing vulnerability and/or penetration scans is not explicitly required within the HIPAA regulatory text, but NIST guidance documents recommend them as part of an effective risk management program. They will catch vulnerabilities before they can be exploited, and can also identify threats that were otherwise unknown.

4 Perform vulnerability and/or penetration scans on a regular basis. Question 11: Do you require information, in all forms, to be disposed of using secure methods? Question 12: Do you have a documented security event monitoring, security incident plan, and breach response and notification plan, and teams or staff to support the plan? Question 13: External Parties: Do you outsource any activities involving protected health information (PHI) or other confidential information obtained from the covered entity? Question 14: Does your organization perform background checks to examine and assess an employee's or contractor's work and criminal history? Question 15: If yes to above, does your organization have Business Associate agreements in place with each of these third parties? Question 16: Do you follow a process to identify new data protection legal requirements? (e.g., new state breach notification requirements)?

5 Question 17: Are your employees required to sign a non-disclosure agreement upon hire, and then again annually? Question 18: Check all the following standards and regulations for which you can verify compliance: Your Risk: Low Question 19: Do you have a formal process to manage the termination and/or transfer of employees? Question 20: Do you have physical security controls (e.g., door locks) to prevent unauthorized access to facilities and a facility security plan? Question 21: Do you have controls on systems and networks that host, process and/or transfer sensitive information, including the use of firewalls and controls for protecting network devices from unauthorized access and data-theft?

6 Question 22: Are connections to your networks and systems logged and monitored? Question 23: Do you have a formal access authorization process based on 'least privilege' (employees are granted the least amount of access possible in order to perform their assigned duties) and need to know (access permissions are granted based upon the legitimate business need of the user to access the information)? Question 24: Do you require each user ID to be unique and not shared with others, and have a process to remove them when the user leaves the organization? Question 25: Have you implemented anti-malware (e.g., anti-virus, spam filters, etc.) on your computers and supporting systems? Question 26: Media handling: Do procedures exist to protect documents (e.g., paper files, prescription labels, print materials, etc.) and computer media (e.g., tapes, disks, CD-ROMs, etc.), from unauthorized disclosure, modification, removal, and destruction? Is sensitive data encrypted when stored on laptop, desktop and server hard drives, flash drives, backup tapes, etc.? If the answer is "No" to either of these questions, answer "No". Question 27: Segregation of Computing Environments: Are development, test and production

7 environments separated from operational IT environments to protect production (actively used) applications from inadvertent changes or disruption? Are the data files of your business clients segregated from one another? If the answer to either question is "No" indicate "No" as your answer. Or, is this not applicable at your organization? Question 28: Segregation of Duties: Are duties separated, where appropriate, to reduce the opportunity for unauthorized modification, unintentional modification or misuse of the organization's IT assets? Or, is this not applicable at your organization? Question 29: Change Management: Do formal change management procedures exist for networks, systems, desktops, software releases, deployments, and software vulnerability (e.g., virus or spyware) patching activities? Or, is this not applicable at your organization? If not, please explain why it is not applicable. Question 30: How would you evaluate your current implementation of all of the above controls? Question 31: Could you provide documentation (e.g., information security policies, supporting business documentation, etc.) for all the controls above within 24 hours or request?

8