Symantec DLP

ID.IM-01: Improvements are identified from evaluations

Access Control 7 P & P - Is there a policy to control the access of staff, vendors, and 3rd party personnel to critical equipment (network devices, servers, etc.)?

Protections 4 P & P - Are there processes in place to ensure that members of the public and staff without authorization cannot see ePHI (on computer screens, printers, desktops, etc)?

Access Control 3 P & P - Are there both policies and procedures to ensure that user accounts are unique, not shared amongst users?

Protections 3 P & P - Are there both Policies and Procedures to ensure that confidential, private, and ePHI data is encrypted throughout the organization's domain?

Protections 1 P & P - Are there both policies and procedures that ensure that systems are protected with anti-virus/anti-malware programs?

Access Control 5 P & P - Are there both policies and procedures to ensure that users are permitted only those permissions necessary to perform their role (Principle of Least Privilege)?

Access Control 6 P & P - Are there both policies and procedures to ensure that idle account access to EHR portals and systems lock-out (require credentials to log back in)?

Access Control 4 P & P - Are there both policies and procedures to ensure that administrative rights are not allocated inappropriately?

Protections 2 P & P - Are there both policies and procedures that ensure that systems receive regular (at least monthly) updates and patches to minimize vulnerabilities?