Blumira SIEM

DE.AE-02: Potentially adverse events are analyzed to better understand associated activities

DE.AE-04: The estimated impact and scope of adverse events are understood

DE.AE-08: Incidents are declared when adverse events meet the defined incident criteria

DE.CM-06: External service provider activities and services are monitored to find potentially adverse events

GV.OC-02: Internal and external stakeholders are understood, and their needs and expectations regarding cybersecurity risk management are understood and considered

GV.OC-03: Legal, regulatory, and contractual requirements regarding cybersecurity - including privacy and civil liberties obligations - are understood and managed

GV.RR-01: Organizational leadership is responsible and accountable for cybersecurity risk and fosters a culture that is risk-aware, ethical, and continually improving

GV.RR-02: Roles, responsibilities, and authorities related to cybersecurity risk management are established, communicated, understood, and enforced

GV.RR-03: Adequate resources are allocated commensurate with the cybersecurity risk strategy, roles, responsibilities, and policies

GV.RR-04: Cybersecurity is included in human resources practices

RC.CO-03: Recovery activities and progress in restoring operational capabilities are communicated to designated internal and external stakeholders

RC.CO-04: Public updates on incident recovery are shared using approved methods and messaging

RS.AN-03: Analysis is performed to establish what has taken place during an incident and the root cause of the incident

RS.AN-06: Actions performed during an investigation are recorded, and the records' integrity and provenance are preserved

RS.AN-08: An incident's magnitude is estimated and validated

Conduct an accurate and thorough assessment of potential risks and vulnerabilities to the confidentiality, integrity, and availability of ePHI.

Access Control 7 P & P - Is there a policy to control the access of staff, vendors, and 3rd party personnel to critical equipment (network devices, servers, etc.)?

Passwords P & P - Is there a password policy to ensure that minimum HIPAA password compliance is met?

Protections 4 P & P - Are there processes in place to ensure that members of the public and staff without authorization cannot see ePHI (on computer screens, printers, desktops, etc)?

Roles - CISO - Is there an employee in the organization that oversees the development and implementation of security policies and procedures?

Access Control 3 P & P - Are there both policies and procedures to ensure that user accounts are unique, not shared amongst users?

Responsibilities - ePHI - Does the organization have personnel classifications or job descriptions for which staff have access to ePHI?

Responsibilities - Perms - Is/are there personnel responsible for determining and implementing the appropriate access and permissions levels for users?

Protections 3 P & P - Are there both Policies and Procedures to ensure that confidential, private, and ePHI data is encrypted throughout the organization's domain?

Responsibilities - CISO - Are the job role and responsibilities of the employee who oversees the development and implementation of security policies and procedures fully documented?

Protections 1 P & P - Are there both policies and procedures that ensure that systems are protected with anti-virus/anti-malware programs?

IT Procedure Alignment Process - Does the org have a process by which IT management develops, implements, reviews, and updates digital security procedures to align to written policy?

Sanctions - Does the organization have sanctioning in its policies to help enforce security procedures?

Access Control 5 P & P - Are there both policies and procedures to ensure that users are permitted only those permissions necessary to perform their role (Principle of Least Privilege)?

Access Control 6 P & P - Are there both policies and procedures to ensure that idle account access to EHR portals and systems lock-out (require credentials to log back in)?

Protections 2 P & P - Are there both policies and procedures that ensure that systems receive regular (at least monthly) updates and patches to minimize vulnerabilities?

58

Address Unauthorized Assets

Address Unauthorized Software

Perform Automated Backups

Establish and Maintain an Isolated Instance of Recovery Data

Designate Personnel to Manage Incident Handling

Assign Key Roles and Responsibilities

Define Mechanisms for Communicating During Incident Response

Establish and Maintain Security Incident Thresholds