Mosyle MDM

Access Control 7 P & P - Is there a policy to control the access of staff, vendors, and 3rd party personnel to critical equipment (network devices, servers, etc.)?

ePHI Protection 9 - Are there mechanisms in place to protect ePHI from unauthorized modification or deletion?

Access Control 2 P & P - Are there both policies and procedures to ensure that idle computing devices enable lock screen after 10 minutes of non-use?

Security event reporting - Are there both policies and procedures that define a security event and provide instruction for communicating the event to appropriate personnel?

Protections 4 P & P - Are there processes in place to ensure that members of the public and staff without authorization cannot see ePHI (on computer screens, printers, desktops, etc)?

Business Continuity Plan 2 - Does the organization have a documented plan to receive, access, maintain, and record PHI in the event of a digital failure, and restore those records electronically after an incident has been recovered from?

ePHI Access 7 - Is there a procedure to ensure access to ePHI is severed and documented when employment or vendor relationship is terminated?

Access Control 3 P & P - Are there both policies and procedures to ensure that user accounts are unique, not shared amongst users?

ePHI Access 2 - Does each user with access to ePHI and systems with ePHI access have a unique set of credentials for login?

Protections 3 P & P - Are there both Policies and Procedures to ensure that confidential, private, and ePHI data is encrypted throughout the organization's domain?

Disaster Recovery Plan 1 - Does the organization have a Disaster Recovery Plan that outlines the steps needed to restore critical services and processes for business continuity in the case of a disastrous event?

Protections 1 P & P - Are there both policies and procedures that ensure that systems are protected with anti-virus/anti-malware programs?

Access Control 1 P & P - Are there both an Access Control policy and procedure to manage the authenticated and authorized access of people and systems to internal org resources?

ePHI Access 4 - Is there a mechanism for alerting a support team if there are issues with login or changes to user accounts controlled by Active Directory?

Sanctions - Does the organization have sanctioning in its policies to help enforce security procedures?

ePHI Protection 8 - Are gateway and network devices configured with reasonable settings to protect the network and ePHI data in the network?

Access Control 5 P & P - Are there both policies and procedures to ensure that users are permitted only those permissions necessary to perform their role (Principle of Least Privilege)?

Access Control 6 P & P - Are there both policies and procedures to ensure that idle account access to EHR portals and systems lock-out (require credentials to log back in)?

Business Continuity Plan 1 - Does the organization have a Business Continuity Plan that identifies business critical services and data sets needed to continue patient/client service?

Access Control 4 P & P - Are there both policies and procedures to ensure that administrative rights are not allocated inappropriately?

Protections 2 P & P - Are there both policies and procedures that ensure that systems receive regular (at least monthly) updates and patches to minimize vulnerabilities?

Have you Evaluated and adjusted your information security program in light of the results of the testing and monitoring required, or any material changes to your operations or business arrangements due to the results of risk assessments performed?

Rules for reporting major ICT-related incidents.

Specifies deadlines and required content for incident reports.