RingCentral Contact Center

A formal risk management process is established to evaluate risks based on identified threats and specified tolerances. This process includes defining risk assessment methodologies, risk categories, and evaluation criteria.

Risk assessments are performed at least annually during security committee management meetings and include evaluations of the following: -Organizational structure, capability, capacity, reporting lines, authorities, and responsibilities. -Environmental, regulatory, and technological changes that have occurred. -The need for additional tools and resources to achieve business objectives. -Threats and vulnerabilities affecting the achievement of commitments to clients.

Results of the risk assessment, including identified risks and recommended actions, are communicated to the respective owners to ensure accountability for addressing risks.

Business Continuity Plan 2 - Does the organization have a documented plan to receive, access, maintain, and record PHI in the event of a digital failure, and restore those records electronically after an incident has been recovered from?

Business Continuity Plan 1 - Does the organization have a Business Continuity Plan that identifies business critical services and data sets needed to continue patient/client service?

Disaster Recovery Plan 2 - Is critical data (backed up at least weekly) to a network or cloud repository available for data recovery?

Requires regular, secure backups and recovery processes.

What measures are in place to protect sensitive employee and customer data from unauthorized access or data breaches? (Data Security and Privacy)

What measures are in place to address the risk of employee misconduct or non-compliance with policies and regulations? (Employee Misconduct)

How does the organization manage the risk of employee turnover and its impact on business operations? (Employee Turnover)