DataStream

Access to client data requires a unique ID assigned to each user.

MFA is enabled on all production servers or in all environments where changes can be promoted.

Requests to remove or disable access for terminated or disabled employees, temporary employees, or consultants are documented in the Jira ticketing system to maintain an auditable record.

Job descriptions are defined for all personnel responsible for designing, developing, implementing, operating, monitoring, and maintaining the system. These descriptions outline roles, responsibilities, and required skills to ensure alignment with organizational objectives.

ID.AM-01: Inventories of hardware managed by the organization are maintained

ID.AM-02: Inventories of software, services, and systems managed by the organization are maintained

ID.AM-04: Inventories of services provided by suppliers are maintained

ID.AM-07: Inventories of data and corresponding metadata for designated data types are maintained

ID.RA-01: Vulnerabilities in assets are identified, validated, and recorded

Access Control 7 P & P - Is there a policy to control the access of staff, vendors, and 3rd party personnel to critical equipment (network devices, servers, etc.)?

Passwords P & P - Is there a password policy to ensure that minimum HIPAA password compliance is met?

Access Control 2 P & P - Are there both policies and procedures to ensure that idle computing devices enable lock screen after 10 minutes of non-use?

3rd Party Access Controls 2 - Are there procedures for terminating or changing 3rd party access when the BAA, contract, or relationship ends or changes?

Security event reporting - Are there both policies and procedures that define a security event and provide instruction for communicating the event to appropriate personnel?

Protections 4 P & P - Are there processes in place to ensure that members of the public and staff without authorization cannot see ePHI (on computer screens, printers, desktops, etc)?

Access Control 1 P & P - Are there both an Access Control policy and procedure to manage the authenticated and authorized access of people and systems to internal org resources?

3rd Party Access Controls 1 - Are unique credentials used for 3rd party, partner, contractor, and/or vendor access to systems that connect to the organization's domain?

Sanctions - Does the organization have sanctioning in its policies to help enforce security procedures?

Defines ESAs??? supervisory and coordinating roles.

Clarifies ECB involvement in oversight activities.