VMware NSX

Production Data for Development (6.4.3)

Access to Publicly Accessible Network Jacks (9.1.2)

Installing Critical Security Patches (6.2)

Security of Custom Application Accounts (6.3.1)

Insecure Cryptographic Storage (6.5.3)

Facility Entry Controls (9.1)

Agreements with Vendors and Business Partners include privacy and confidentially clauses. If any of the vendors are SaaS, then their respective SOC1/2 reports are obtained and reviewed periodically.

DE.AE-02: Potentially adverse events are analyzed to better understand associated activities

DE.AE-03: Information is correlated from multiple sources

DE.AE-04: The estimated impact and scope of adverse events are understood

DE.AE-06: Information on adverse events is provided to authorized staff and tools

DE.AE-08: Incidents are declared when adverse events meet the defined incident criteria

PR.DS-10: The confidentiality, integrity, and availability of data-in-use are protected

PR.DS-11: Backups of data are created, protected, maintained, and tested

RS.MA-01: The incident response plan is executed in coordination with relevant third parties once an incident is declared

RS.MA-02: Incident reports are triaged and validated

RS.MA-03: Incidents are categorized and prioritized

RS.MA-04: Incidents are escalated or elevated as needed

RS.MA-05: The criteria for initiating incident recovery are applied

5.15 Access Control - Rules to control physical and logical access to information and other associated assets shall be established and implemented based on business and information security requirements.

5.16 Identity Management - The full lifecycle of identities shall be managed.

5.18 Access Rights - Access rights to information and other associated assets shall be provisioned, reviewed, modified, and removed in accordance with the organization's topic-specific policy on and rules for access control.

Facility Access 6 - Is there a mechanism(s) in place to restrict physical access to electronic devices, including mobile devices that contain or can access ePHI?

Meeting HIPAA regulations. - The practice (with IT support) reviews the practice's Security Policies and IT Procedures to meet the requirements for HIPAA compliance, at least annually.

Facility Access 1 - Is there a procedure or mechanism to control the access of staff, vendors, and 3rd party personnel to critical equipment (network devices, servers, etc.) and are staff educated about the process?

Facility Access 4 - Are all network devices (servers, power supplies, switches, routers, firewalls, WAPs) located in an area where they cannot be easily damaged by users or environmental factors?

Equipment Changes - Are network changes and equipment changes documented and updated appropriately?

55