Varonis

Physically Securing Media (9.5)

Monitoring Physical Access (9.1.1)

Compliance Scorecard has an established policy that identifies and designates what information is considered confidential information, and details the information handling, retention and destruction requirements.

PR.AA-01: Identities and credentials for authorized users, services, and hardware are managed by the organization

Access Control 7 P & P - Is there a policy to control the access of staff, vendors, and 3rd party personnel to critical equipment (network devices, servers, etc.)?

Passwords P & P - Is there a password policy to ensure that minimum HIPAA password compliance is met?

Security event reporting - Are there both policies and procedures that define a security event and provide instruction for communicating the event to appropriate personnel?

Protections 4 P & P - Are there processes in place to ensure that members of the public and staff without authorization cannot see ePHI (on computer screens, printers, desktops, etc)?

Employment Screening - Does the organization screen potential employees during the hiring process, to determine trustworthiness?

Roles - CISO - Is there an employee in the organization that oversees the development and implementation of security policies and procedures?

Access Control 3 P & P - Are there both policies and procedures to ensure that user accounts are unique, not shared amongst users?

Responsibilities - ePHI - Does the organization have personnel classifications or job descriptions for which staff have access to ePHI?

Responsibilities - Perms - Is/are there personnel responsible for determining and implementing the appropriate access and permissions levels for users?

Protections 3 P & P - Are there both Policies and Procedures to ensure that confidential, private, and ePHI data is encrypted throughout the organization's domain?

Responsibilities - CISO - Are the job role and responsibilities of the employee who oversees the development and implementation of security policies and procedures fully documented?

Protections 1 P & P - Are there both policies and procedures that ensure that systems are protected with anti-virus/anti-malware programs?

IT Procedure Alignment Process - Does the org have a process by which IT management develops, implements, reviews, and updates digital security procedures to align to written policy?

Access Control 1 P & P - Are there both an Access Control policy and procedure to manage the authenticated and authorized access of people and systems to internal org resources?

Sanctions - Does the organization have sanctioning in its policies to help enforce security procedures?

Access Control 5 P & P - Are there both policies and procedures to ensure that users are permitted only those permissions necessary to perform their role (Principle of Least Privilege)?

Access Control 6 P & P - Are there both policies and procedures to ensure that idle account access to EHR portals and systems lock-out (require credentials to log back in)?

Roles - Authority - If there is not a job role identified for development and implementation of security policies, is there a recognized personnel that staff contact in the case of security events?

Information Technology Responsibilities - Is the party responsible for Information Technology (IT) internal to the organization, or a contracted IT support firm (MSP)?

Access Control 4 P & P - Are there both policies and procedures to ensure that administrative rights are not allocated inappropriately?

Protections 2 P & P - Are there both policies and procedures that ensure that systems receive regular (at least monthly) updates and patches to minimize vulnerabilities?

Outlines ICT governance roles for senior management.

Details structural organization to manage ICT risk.

Defines the scope of digital resilience testing.

Details tools for vulnerability and performance testing.

Ensures fund managers also comply with digital operational resilience obligations.