Shells

7.10 Storage media - Storage media shall be managed through their life cycle of acquisition, use, transportation, and disposal in accordance with the organization's classification scheme and handling requirements.

Access Control 7 P & P - Is there a policy to control the access of staff, vendors, and 3rd party personnel to critical equipment (network devices, servers, etc.)?

ePHI Protection 9 - Are there mechanisms in place to protect ePHI from unauthorized modification or deletion?

Access Control 2 P & P - Are there both policies and procedures to ensure that idle computing devices enable lock screen after 10 minutes of non-use?

Access Control 3 P & P - Are there both policies and procedures to ensure that user accounts are unique, not shared amongst users?

ePHI Access 2 - Does each user with access to ePHI and systems with ePHI access have a unique set of credentials for login?

Access Control 1 P & P - Are there both an Access Control policy and procedure to manage the authenticated and authorized access of people and systems to internal org resources?

ePHI Protection 5 - Does user training include specific training about the appropriate handling of ePHI?

Access Control 5 P & P - Are there both policies and procedures to ensure that users are permitted only those permissions necessary to perform their role (Principle of Least Privilege)?

Access Control 6 P & P - Are there both policies and procedures to ensure that idle account access to EHR portals and systems lock-out (require credentials to log back in)?

ePHI Access 3 - Do user account passwords, at a minimum:Contain 8 or more charactersComplexity - upper/lower-case letters, numbers, and special charactersPasswords expire on user accounts at 90 days or lessPasswords on user accounts cannot be changed for a minimum of 7 daysPassword history is greate

Address Unauthorized Assets

Assign Key Roles and Responsibilities