Document360

Policies and Procedures (11.6)

Incident Response Procedures (11.1.2)

ID.AM-01: Inventories of hardware managed by the organization are maintained

ID.AM-02: Inventories of software, services, and systems managed by the organization are maintained

ID.AM-04: Inventories of services provided by suppliers are maintained

ID.AM-07: Inventories of data and corresponding metadata for designated data types are maintained

ID.AM-08: Systems, hardware, software, services, and data are managed throughout their life cycles

ePHI Protection 9 - Are there mechanisms in place to protect ePHI from unauthorized modification or deletion?

ePHI Access 7 - Is there a procedure to ensure access to ePHI is severed and documented when employment or vendor relationship is terminated?

ePHI Access 2 - Does each user with access to ePHI and systems with ePHI access have a unique set of credentials for login?

ePHI Audit Reports - Does the organization retain Audit Report records for a minimum of (6) years, consistent with retention requirements for all information security documentation?

ePHI Protection 5 - Does user training include specific training about the appropriate handling of ePHI?

ePHI Access 1 - Is there a mechanism to both control and log user access to systems that contain ePHI or contain or access an EHR?

Rules for reporting major ICT-related incidents.

Specifies deadlines and required content for incident reports.