Outline

Access to client data requires a unique ID assigned to each user.

GV.OV-01: Cybersecurity risk management strategy outcomes are reviewed to inform and adjust strategy and direction

PR.AT-01: Personnel are provided with awareness and training so that they possess the knowledge and skills to perform general tasks with cybersecurity risks in mind

RS.MA-01: The incident response plan is executed in coordination with relevant third parties once an incident is declared

ePHI Protection 9 - Are there mechanisms in place to protect ePHI from unauthorized modification or deletion?

Employment Screening - Does the organization screen potential employees during the hiring process, to determine trustworthiness?

Responsibilities - ePHI - Does the organization have personnel classifications or job descriptions for which staff have access to ePHI?

Roles - Authority - If there is not a job role identified for development and implementation of security policies, is there a recognized personnel that staff contact in the case of security events?

ePHI Access 1 - Is there a mechanism to both control and log user access to systems that contain ePHI or contain or access an EHR?

Steps for handling ICT-related incidents.

Establish and Maintain Detailed Enterprise Asset Inventory

Ensure Authorized Software is Currently Supported

Periodically assess the risk to organizational operations, organizational assets, and individuals, resulting from the operation of organizational systems and the associated processing, storage, or transmission of CUI.