Duo Access

Vulnerability Scanning (11.2)

Meeting HIPAA regulations. - The practice (with IT support) reviews the practice's Security Policies and IT Procedures to meet the requirements for HIPAA compliance, at least annually.

Identifying Vulnerabilities - In the past 12 months, has the practice performed (or caused to be performed) recommended tests to identify vulnerabilities?

Remediating Vulnerabilities - In the past 12 months, has the organization implemented remediation steps for identified 'critical' and 'important' vulnerabilities?

Entities must maintain a complete incident register.

How does the board monitor the organization's compliance with relevant cybersecurity regulations and standards? (Monitoring compliance with regulations)

Are regular internal or external cybersecurity audits or assessments conducted, and how are the findings communicated and addressed? (Frequency and follow-up on cybersecurity audits)

How are IT systems monitored, maintained, and protected against potential failures? (IT Systems Failure)

How frequently does the board receive updates on the organization's current cyber threat landscape and potential vulnerabilities? (Frequency of threat landscape updates)

What measures are in place to assess and manage cybersecurity risks at the organizational level? (Existence and effectiveness of risk assessment measures)

How does the organization monitor and ensure compliance with relevant regulations? (Regulatory Compliance Failure)