Showing 92 controls
3rd Party Access Controls 2 - Are there procedures for terminating or changing 3rd party access when the BAA, contract, or relationship ends or changes?
The goal is to ensure that appropriate safeguards are in place and effective.
Business Agreements 1 - Does the organization have a list of all business associates and vendors with access to ePHI, and is there a Business Agreement in place with each partner, contractor, and vendor that recognizes each party's responsibility for data protection?
The goal is to ensure that appropriate safeguards are in place and effective.
Business Agreements 2 - Is there a Business Agreement in place with each partner, contractor, and vendor that ensures disclosure if the 3rd party experiences a cyber attack, data breach, of other security event?
The goal is to ensure that appropriate safeguards are in place and effective.
3rd Party Access Controls 3 - Do the organization's Business Agreements clearly identify which vendors, partners, suppliers, 3rd party organizations will or may have access to ePHI, how they will use it, and their commitment to protecting it?
The goal is to ensure that appropriate safeguards are in place and effective.
3rd Party Access Controls 1 - Are unique credentials used for 3rd party, partner, contractor, and/or vendor access to systems that connect to the organization's domain?
The goal is to ensure that appropriate safeguards are in place and effective.
Business Agreements 3 - Do Business Associate Agreements (BAAs) describe how the businesses will communicate security/network/and interface technology changes and events to one another?
The goal is to ensure that appropriate safeguards are in place and effective.
Business Agreements 4 - Does each BAA give assurance(s) that the partner or vendor will follow best practices and/or compliance to protect ePHI/PCI/PII?
The goal is to ensure that appropriate safeguards are in place and effective.
Segmentation - Are there mechanisms in place to segment the organization's internal network from any shared network space occupied by vendors and partners?
The goal is to ensure that appropriate safeguards are in place and effective.
Meeting HIPAA regulations. - The practice (with IT support) reviews the practice's Security Policies and IT Procedures to meet the requirements for HIPAA compliance, at least annually.
The goal is to ensure that appropriate safeguards are in place and effective.
Identifying Vulnerabilities - In the past 12 months, has the practice performed (or caused to be performed) recommended tests to identify vulnerabilities?
The goal is to ensure that appropriate safeguards are in place and effective.
Previous Assessment(s) - Has the organization or practice had a Security Risk Assessment (SRA) within the last 12 months?
The goal is to ensure that appropriate safeguards are in place and effective.
Inventory Maintenance 1 - In the past 6 months, has the organization maintained a current asset (computing devices) list?
The goal is to ensure that appropriate safeguards are in place and effective.
Inventory Maintenance 2 - In the past 6 months, has the organization maintained a current software asset list?
The goal is to ensure that appropriate safeguards are in place and effective.
Remediating Vulnerabilities - In the past 12 months, has the organization implemented remediation steps for identified 'critical' and 'important' vulnerabilities?
The goal is to ensure that appropriate safeguards are in place and effective.
Events and Incidents 1 - Does the organization or its IT MSP have procedures documented and implemented to detect, prevent, and respond to security incidents?
The goal is to ensure that appropriate safeguards are in place and effective.
Business Continuity Plan 2 - Does the organization have a documented plan to receive, access, maintain, and record PHI in the event of a digital failure, and restore those records electronically after an incident has been recovered from?
The goal is to ensure that appropriate safeguards are in place and effective.
Disaster Recovery Plan 1 - Does the organization have a Disaster Recovery Plan that outlines the steps needed to restore critical services and processes for business continuity in the case of a disastrous event?
The goal is to ensure that appropriate safeguards are in place and effective.
Disaster Recovery Plan 5 - In the case of a critical incident have both facility access and data access been addressed in the organization's documentation?
The goal is to ensure that appropriate safeguards are in place and effective.
Disaster Recovery Plan 3 - Does the organization or its IT MSP have an identified incident response team with a documented incident response plan?
The goal is to ensure that appropriate safeguards are in place and effective.
Business Continuity Plan 1 - Does the organization have a Business Continuity Plan that identifies business critical services and data sets needed to continue patient/client service?
The goal is to ensure that appropriate safeguards are in place and effective.
Business Continuity Plan 3 - Is the end of a critical incident clearly defined and does the organization designate a party to determine when an emergency or incident response process can be terminated?
The goal is to ensure that appropriate safeguards are in place and effective.
Disaster Recovery Plan 4 - In the organization's documentation are security incidents and activation of an emergency procedure clearly defined?
The goal is to ensure that appropriate safeguards are in place and effective.
Disaster Recovery Plan 2 - Is critical data (backed up at least weekly) to a network or cloud repository available for data recovery?
The goal is to ensure that appropriate safeguards are in place and effective.
Events and Incidents 2 - Are the procedures to detect, prevent, and respond to security and IT events documented and available for analysis for a reasonable amount of time?
The goal is to ensure that appropriate safeguards are in place and effective.
Training 5 - Does training include explaining security event reporting - who to contact and what to do in case of suspicious activity?
The goal is to ensure that appropriate safeguards are in place and effective.
Training 6 - Is there ongoing training or communication regarding security awareness and requirements for all staff?
The goal is to ensure that appropriate safeguards are in place and effective.
Training 1 - Are all workforce members (including managers) given cyber, digital, and/or information security training, at least annually?
The goal is to ensure that appropriate safeguards are in place and effective.
Training 2 - Are all workforce members given email phishing training regularly (monthly or quarterly)?
The goal is to ensure that appropriate safeguards are in place and effective.
Training 4 - Does training include password security, safeguarding passwords, compromised passwords, and how to create and change passwords.
The goal is to ensure that appropriate safeguards are in place and effective.
Training 3 - Are training sessions recorded or logged for each employee or staff member?
The goal is to ensure that appropriate safeguards are in place and effective.
ePHI Protection 9 - Are there mechanisms in place to protect ePHI from unauthorized modification or deletion?
The goal is to ensure that appropriate safeguards are in place and effective.
ePHI Protection 4 - Do mobile devices that contain or have access to ePHI have encryption enabled?
The goal is to ensure that appropriate safeguards are in place and effective.
ePHI Access 7 - Is there a procedure to ensure access to ePHI is severed and documented when employment or vendor relationship is terminated?
The goal is to ensure that appropriate safeguards are in place and effective.
ePHI Access 2 - Does each user with access to ePHI and systems with ePHI access have a unique set of credentials for login?
The goal is to ensure that appropriate safeguards are in place and effective.
ePHI Audit Reports - Does the organization retain Audit Report records for a minimum of (6) years, consistent with retention requirements for all information security documentation?
The goal is to ensure that appropriate safeguards are in place and effective.
ePHI Protection 1 - Is encryption enabled for confidential, private, and ePHI data as it is accessed within an EHR (in transit)?
The goal is to ensure that appropriate safeguards are in place and effective.
ePHI Access 4 - Is there a mechanism for alerting a support team if there are issues with login or changes to user accounts controlled by Active Directory?
The goal is to ensure that appropriate safeguards are in place and effective.
ePHI Protection 3 - Is confidential, private and ePHI data in backed-up storage (data at rest) encrypted - this applies to on-site data storage and cloud stored data, including transit from on-site to cloud/remote storage?
The goal is to ensure that appropriate safeguards are in place and effective.
ePHI Protection 8 - Are gateway and network devices configured with reasonable settings to protect the network and ePHI data in the network?
The goal is to ensure that appropriate safeguards are in place and effective.
ePHI Protection 5 - Does user training include specific training about the appropriate handling of ePHI?
The goal is to ensure that appropriate safeguards are in place and effective.
ePHI Access 6 - If the organization's EHR or other ePHI container is self-hosted/on-site, is there a mechanism to control which devices can access it?
The goal is to ensure that appropriate safeguards are in place and effective.
ePHI Access 5 - If the organization does not use an EHR, is there a mechanism or procedure in place to control the access of personnel to read, modify, or delete ePHI?
The goal is to ensure that appropriate safeguards are in place and effective.
ePHI Protection 2 - Is encryption enabled for confidential, private, and ePHI data that is communicated via email?
The goal is to ensure that appropriate safeguards are in place and effective.
ePHI Access 3 - Do user account passwords, at a minimum:Contain 8 or more charactersComplexity - upper/lower-case letters, numbers, and special charactersPasswords expire on user accounts at 90 days or lessPasswords on user accounts cannot be changed for a minimum of 7 daysPassword history is greate
The goal is to ensure that appropriate safeguards are in place and effective.
ePHI Systems - Are organization owned assets categorized for accessibility to ePHI?
The goal is to ensure that appropriate safeguards are in place and effective.
ePHI Protection 7 - Does the organization (or its IT support) regularly evaluate information system configurations for security best practices?
The goal is to ensure that appropriate safeguards are in place and effective.
ePHI Access 1 - Is there a mechanism to both control and log user access to systems that contain ePHI or contain or access an EHR?
The goal is to ensure that appropriate safeguards are in place and effective.
ePHI Protection 6 - Is encryption enabled for removable drives? Alternatively, is there a mechanism that blocks the connection of removable drives from systems?
The goal is to ensure that appropriate safeguards are in place and effective.
Facility Access 6 - Is there a mechanism(s) in place to restrict physical access to electronic devices, including mobile devices that contain or can access ePHI?
The goal is to ensure that appropriate safeguards are in place and effective.
Equipment Controls 2 - Does the organization or an MSP on their behalf, use an asset management solution to maintain an understanding of where physical assets are located?
The goal is to ensure that appropriate safeguards are in place and effective.
Facility Access 1 - Is there a procedure or mechanism to control the access of staff, vendors, and 3rd party personnel to critical equipment (network devices, servers, etc.) and are staff educated about the process?
The goal is to ensure that appropriate safeguards are in place and effective.
Facility Access 8 - Are records (hardcopy or digital) kept for at least a year that document visitors to a facility, or to secure areas in a facility?
The goal is to ensure that appropriate safeguards are in place and effective.
Equipment Controls 3 - Are electronic devices which held or accessed ePHI sanitized and disposed of properly at the time of device retirement/decommissioning?
The goal is to ensure that appropriate safeguards are in place and effective.
Facility Access 2: - Do procedures to restrict physical access to the organization's network equipment, servers, and data systems include at a minimum:Locking mechanisms to protect network closets and network devices.Environmental controls to protect network equipment (cooling).Fire control systems
The goal is to ensure that appropriate safeguards are in place and effective.
Equipment Controls 1 - Is there an asset list that contains the computing devices (servers, workstations, laptops, tablets) with identifiers (serial number, MAC address, etc.)?
The goal is to ensure that appropriate safeguards are in place and effective.
Facility Changes - Are physical changes to the facility documented and updated appropriately?
The goal is to ensure that appropriate safeguards are in place and effective.
Facility Access 4 - Are all network devices (servers, power supplies, switches, routers, firewalls, WAPs) located in an area where they cannot be easily damaged by users or environmental factors?
The goal is to ensure that appropriate safeguards are in place and effective.
Equipment Changes - Are network changes and equipment changes documented and updated appropriately?
The goal is to ensure that appropriate safeguards are in place and effective.
Facility Access 7 - Does the organization have access validation requirements for personnel and non-personnel seeking access to critical systems (servers, network equipment)?
The goal is to ensure that appropriate safeguards are in place and effective.
Facility Access 3 - Are all network devices (servers, power supplies, switches, routers, firewalls, WAPs) located in an area where they cannot be accessed by non-authorized users?
The goal is to ensure that appropriate safeguards are in place and effective.
Facility Access 5 - Does the organization implement a means of readily identifying authorized users when they are in private or secure areas?
The goal is to ensure that appropriate safeguards are in place and effective.
Access Control 7 P & P - Is there a policy to control the access of staff, vendors, and 3rd party personnel to critical equipment (network devices, servers, etc.)?
The goal is to ensure that appropriate safeguards are in place and effective.
Passwords P & P - Is there a password policy to ensure that minimum HIPAA password compliance is met?
The goal is to ensure that appropriate safeguards are in place and effective.
Access Control 2 P & P - Are there both policies and procedures to ensure that idle computing devices enable lock screen after 10 minutes of non-use?
The goal is to ensure that appropriate safeguards are in place and effective.
Security event reporting - Are there both policies and procedures that define a security event and provide instruction for communicating the event to appropriate personnel?
The goal is to ensure that appropriate safeguards are in place and effective.
Policy Development Process - Does the org have a process by which management develops, implements, reviews, and updates written security policy?
The goal is to ensure that appropriate safeguards are in place and effective.
Protections 4 P & P - Are there processes in place to ensure that members of the public and staff without authorization cannot see ePHI (on computer screens, printers, desktops, etc)?
The goal is to ensure that appropriate safeguards are in place and effective.
Access Control 3 P & P - Are there both policies and procedures to ensure that user accounts are unique, not shared amongst users?
The goal is to ensure that appropriate safeguards are in place and effective.
Protections 3 P & P - Are there both Policies and Procedures to ensure that confidential, private, and ePHI data is encrypted throughout the organization's domain?
The goal is to ensure that appropriate safeguards are in place and effective.
Protections 1 P & P - Are there both policies and procedures that ensure that systems are protected with anti-virus/anti-malware programs?
The goal is to ensure that appropriate safeguards are in place and effective.
IT Procedure Alignment Process - Does the org have a process by which IT management develops, implements, reviews, and updates digital security procedures to align to written policy?
The goal is to ensure that appropriate safeguards are in place and effective.
Access Control 1 P & P - Are there both an Access Control policy and procedure to manage the authenticated and authorized access of people and systems to internal org resources?
The goal is to ensure that appropriate safeguards are in place and effective.
Sanctions - Does the organization have sanctioning in its policies to help enforce security procedures?
The goal is to ensure that appropriate safeguards are in place and effective.
Access Control 5 P & P - Are there both policies and procedures to ensure that users are permitted only those permissions necessary to perform their role (Principle of Least Privilege)?
The goal is to ensure that appropriate safeguards are in place and effective.
Access Control 6 P & P - Are there both policies and procedures to ensure that idle account access to EHR portals and systems lock-out (require credentials to log back in)?
The goal is to ensure that appropriate safeguards are in place and effective.
Access Control 4 P & P - Are there both policies and procedures to ensure that administrative rights are not allocated inappropriately?
The goal is to ensure that appropriate safeguards are in place and effective.
Protections 2 P & P - Are there both policies and procedures that ensure that systems receive regular (at least monthly) updates and patches to minimize vulnerabilities?
The goal is to ensure that appropriate safeguards are in place and effective.
System Monitoring - Are organization systems monitored for events or issues with an alerting or notification system?
The goal is to ensure that appropriate safeguards are in place and effective.
Practice - Vendor and Business Associate List - Provide a full and detailed list of the practice's vendors and business associates with: representative contact informationwhether the vendor provides cloud or other servicesscope of the service provided (application, supplies, equipment, etc)systems (
The goal is to ensure that appropriate safeguards are in place and effective.
Practice - Asset List - Provide a full asset list for practice owned computing devices and owned or leased network devices.
The goal is to ensure that appropriate safeguards are in place and effective.
Practice point of contact information - What is the title or role, the phone number, and the email contact for the point of contact of the practice?
The goal is to ensure that appropriate safeguards are in place and effective.
Practice Name, address, and primary phone - Practice name, primary address, and primary phone number.
The goal is to ensure that appropriate safeguards are in place and effective.
Information Technology Responsibilities - Is the party responsible for Information Technology (IT) internal to the organization, or a contracted IT support firm (MSP)?
The goal is to ensure that appropriate safeguards are in place and effective.
Remediation Documentation - Provide documentation of planned or on-going remediation from recent assessments. This may include Corrective Action Plans, remediation plans, or checklists that address identified vulnerabilities found in recent SRAs.
The goal is to ensure that appropriate safeguards are in place and effective.
Practice Point of Contact - Who is the primary point of contact for the Practice?
The goal is to ensure that appropriate safeguards are in place and effective.
Employment Screening - Does the organization screen potential employees during the hiring process, to determine trustworthiness?
The goal is to ensure that appropriate safeguards are in place and effective.
Roles - CISO - Is there an employee in the organization that oversees the development and implementation of security policies and procedures?
The goal is to ensure that appropriate safeguards are in place and effective.
Responsibilities - ePHI - Does the organization have personnel classifications or job descriptions for which staff have access to ePHI?
The goal is to ensure that appropriate safeguards are in place and effective.
Responsibilities - Perms - Is/are there personnel responsible for determining and implementing the appropriate access and permissions levels for users?
The goal is to ensure that appropriate safeguards are in place and effective.
Responsibilities - CISO - Are the job role and responsibilities of the employee who oversees the development and implementation of security policies and procedures fully documented?
The goal is to ensure that appropriate safeguards are in place and effective.
Roles - Authority - If there is not a job role identified for development and implementation of security policies, is there a recognized personnel that staff contact in the case of security events?
The goal is to ensure that appropriate safeguards are in place and effective.
Conduct an accurate and thorough assessment of potential risks and vulnerabilities to the confidentiality, integrity, and availability of ePHI.
Desired outcome.