ITarian Endpoint Manager

Public-facing Web Applications (6.6)

Anti-virus Capabilities (5.1.1)

Disabling Anti-virus (5.3)

Security of Custom Application Accounts (6.3.1)

Policies and Procedures for Protecting Against Malware (5.4)

Anti-virus Maintenance (5.2)

Change Control Processes and Procedures (6.4)

Monitoring and alerts are configured by the security team to identify and notify management of incidents when thresholds are crossed on security and operational metrics. Issues, if any, are routed through incident management for resolution.

ID.AM-08: Systems, hardware, software, services, and data are managed throughout their life cycles

Meeting HIPAA regulations. - The practice (with IT support) reviews the practice's Security Policies and IT Procedures to meet the requirements for HIPAA compliance, at least annually.

Business Continuity Plan 2 - Does the organization have a documented plan to receive, access, maintain, and record PHI in the event of a digital failure, and restore those records electronically after an incident has been recovered from?

Disaster Recovery Plan 1 - Does the organization have a Disaster Recovery Plan that outlines the steps needed to restore critical services and processes for business continuity in the case of a disastrous event?

Business Continuity Plan 1 - Does the organization have a Business Continuity Plan that identifies business critical services and data sets needed to continue patient/client service?

Remediating Vulnerabilities - In the past 12 months, has the organization implemented remediation steps for identified 'critical' and 'important' vulnerabilities?