CUPS

Monitoring and alerts are configured by the security team to identify and notify management of incidents when thresholds are crossed on security and operational metrics. Issues, if any, are routed through incident management for resolution.

Processing capacity is monitored monthly by management to ensure that current system performance meets operational requirements.

PR.AA-01: Identities and credentials for authorized users, services, and hardware are managed by the organization

PR.AA-03: Users, services, and hardware are authenticated

PR.AA-05: Access permissions, entitlements, and authorizations are defined in a policy, managed, enforced, and reviewed, and incorporate the principles of least privilege and separation of duties

PR.PS-01: Configuration management practices are established and applied

PR.PS-02: Software is maintained, replaced, and removed commensurate with risk

ePHI Protection 9 - Are there mechanisms in place to protect ePHI from unauthorized modification or deletion?

ePHI Protection 4 - Do mobile devices that contain or have access to ePHI have encryption enabled?

ePHI Access 7 - Is there a procedure to ensure access to ePHI is severed and documented when employment or vendor relationship is terminated?

ePHI Audit Reports - Does the organization retain Audit Report records for a minimum of (6) years, consistent with retention requirements for all information security documentation?

ePHI Access 4 - Is there a mechanism for alerting a support team if there are issues with login or changes to user accounts controlled by Active Directory?

ePHI Protection 3 - Is confidential, private and ePHI data in backed-up storage (data at rest) encrypted - this applies to on-site data storage and cloud stored data, including transit from on-site to cloud/remote storage?

ePHI Protection 5 - Does user training include specific training about the appropriate handling of ePHI?

ePHI Access 6 - If the organization's EHR or other ePHI container is self-hosted/on-site, is there a mechanism to control which devices can access it?

ePHI Access 5 - If the organization does not use an EHR, is there a mechanism or procedure in place to control the access of personnel to read, modify, or delete ePHI?

ePHI Access 3 - Do user account passwords, at a minimum:Contain 8 or more charactersComplexity - upper/lower-case letters, numbers, and special charactersPasswords expire on user accounts at 90 days or lessPasswords on user accounts cannot be changed for a minimum of 7 daysPassword history is greate

ePHI Systems - Are organization owned assets categorized for accessibility to ePHI?

ePHI Protection 7 - Does the organization (or its IT support) regularly evaluate information system configurations for security best practices?

Rules for reporting major ICT-related incidents.

Specifies deadlines and required content for incident reports.