Netsurion EventTracker

GV.OC-02: Internal and external stakeholders are understood, and their needs and expectations regarding cybersecurity risk management are understood and considered

GV.OC-03: Legal, regulatory, and contractual requirements regarding cybersecurity - including privacy and civil liberties obligations - are understood and managed

GV.RM-03: Cybersecurity risk management activities and outcomes are included in enterprise risk management processes

GV.RM-05: Lines of communication across the organization are established for cybersecurity risks, including risks from suppliers and other third parties

RS.MA-02: Incident reports are triaged and validated

RS.MA-04: Incidents are escalated or elevated as needed

RS.MA-05: The criteria for initiating incident recovery are applied

RS.MI-02: Incidents are eradicated

Access Control 7 P & P - Is there a policy to control the access of staff, vendors, and 3rd party personnel to critical equipment (network devices, servers, etc.)?

Passwords P & P - Is there a password policy to ensure that minimum HIPAA password compliance is met?

3rd Party Access Controls 2 - Are there procedures for terminating or changing 3rd party access when the BAA, contract, or relationship ends or changes?

Protections 4 P & P - Are there processes in place to ensure that members of the public and staff without authorization cannot see ePHI (on computer screens, printers, desktops, etc)?

Access Control 3 P & P - Are there both policies and procedures to ensure that user accounts are unique, not shared amongst users?

Protections 3 P & P - Are there both Policies and Procedures to ensure that confidential, private, and ePHI data is encrypted throughout the organization's domain?

Protections 1 P & P - Are there both policies and procedures that ensure that systems are protected with anti-virus/anti-malware programs?

IT Procedure Alignment Process - Does the org have a process by which IT management develops, implements, reviews, and updates digital security procedures to align to written policy?

3rd Party Access Controls 1 - Are unique credentials used for 3rd party, partner, contractor, and/or vendor access to systems that connect to the organization's domain?

Sanctions - Does the organization have sanctioning in its policies to help enforce security procedures?

Access Control 5 P & P - Are there both policies and procedures to ensure that users are permitted only those permissions necessary to perform their role (Principle of Least Privilege)?

Access Control 6 P & P - Are there both policies and procedures to ensure that idle account access to EHR portals and systems lock-out (require credentials to log back in)?

Protections 2 P & P - Are there both policies and procedures that ensure that systems receive regular (at least monthly) updates and patches to minimize vulnerabilities?

Have you designated an employee or employees to coordinate your information security program?

Have you currently Designated a qualified individual responsible for overseeing and implementing your information security program and enforcing your information security program? The Qualified Individual may be employed by you, an affiliate, or a service provider.

Have you designated a senior member of your personnel responsible for direction and oversight of the Qualified Individual?

Mandates risk controls for ICT third-party services.

Providers must be vetted prior to engagement.

Requires exit and transition strategies for continuity.