Zendesk Guide

Maintaining a List of Service Providers (12.8.1)

Written Acknowledgement of Service Provider Responsibility (12.9)

Administering User Accounts (12.5.4)

Verifying Personnel Understands Security Policies and Procedures (12.6.2)

Policy Reviews and Updates (12.1.1)

Usage Policies (12.3)

Personnel Education (12.6.1)

Security Awareness Program (12.6)

A business impact analysis (BIA) is performed annually that includes tabletop testing of the business continuity and disaster recovery plans.

On an annual basis, each in-scope system will be restored from a backup and validated to test the integrity of the backup and restore process.

Organizational structures and defined roles are maintained in the platform and made available to employees upon request to ensure accessibility and transparency.

Approved security policies are published to the Compliance Scorecard platform, ensuring all employees have access to the latest versions of company policies.

RC.CO-04: Public updates on incident recovery are shared using approved methods and messaging

5.1 Information security policy and topic-specific policies shall be defined, approved by management, published, communicated to, and acknowledged by relevant personnel and relevant interested parties, and reviewed at planned intervals and if significant changes occur

5.18 Access Rights - Access rights to information and other associated assets shall be provisioned, reviewed, modified, and removed in accordance with the organization's topic-specific policy on and rules for access control.

5.2 Information security roles and responsibilities shall be defined and allocated according to the organization needs.

5. 24 Information security incident management planning and preparation - The organization shall plan and prepare for managing information security incidents by defining, establishing, and communicating information security incident management processes, roles, and responsibilities.

5.27 Learning from information security incidents - Knowledge gained from information security incidents shall be used to strengthen and improve the information security controls.

Access Control 7 P & P - Is there a policy to control the access of staff, vendors, and 3rd party personnel to critical equipment (network devices, servers, etc.)?

Passwords P & P - Is there a password policy to ensure that minimum HIPAA password compliance is met?

Access Control 2 P & P - Are there both policies and procedures to ensure that idle computing devices enable lock screen after 10 minutes of non-use?

Security event reporting - Are there both policies and procedures that define a security event and provide instruction for communicating the event to appropriate personnel?

Events and Incidents 1 - Does the organization or its IT MSP have procedures documented and implemented to detect, prevent, and respond to security incidents?

Policy Development Process - Does the org have a process by which management develops, implements, reviews, and updates written security policy?

Protections 4 P & P - Are there processes in place to ensure that members of the public and staff without authorization cannot see ePHI (on computer screens, printers, desktops, etc)?

Business Continuity Plan 2 - Does the organization have a documented plan to receive, access, maintain, and record PHI in the event of a digital failure, and restore those records electronically after an incident has been recovered from?

Access Control 3 P & P - Are there both policies and procedures to ensure that user accounts are unique, not shared amongst users?

Protections 3 P & P - Are there both Policies and Procedures to ensure that confidential, private, and ePHI data is encrypted throughout the organization's domain?

Protections 1 P & P - Are there both policies and procedures that ensure that systems are protected with anti-virus/anti-malware programs?

IT Procedure Alignment Process - Does the org have a process by which IT management develops, implements, reviews, and updates digital security procedures to align to written policy?

Access Control 1 P & P - Are there both an Access Control policy and procedure to manage the authenticated and authorized access of people and systems to internal org resources?

Sanctions - Does the organization have sanctioning in its policies to help enforce security procedures?

Access Control 5 P & P - Are there both policies and procedures to ensure that users are permitted only those permissions necessary to perform their role (Principle of Least Privilege)?

Access Control 6 P & P - Are there both policies and procedures to ensure that idle account access to EHR portals and systems lock-out (require credentials to log back in)?

Business Continuity Plan 1 - Does the organization have a Business Continuity Plan that identifies business critical services and data sets needed to continue patient/client service?

Disaster Recovery Plan 4 - In the organization's documentation are security incidents and activation of an emergency procedure clearly defined?

Access Control 4 P & P - Are there both policies and procedures to ensure that administrative rights are not allocated inappropriately?

Protections 2 P & P - Are there both policies and procedures that ensure that systems receive regular (at least monthly) updates and patches to minimize vulnerabilities?

Outlines ICT governance roles for senior management.

Details structural organization to manage ICT risk.

Rules for reporting major ICT-related incidents.

Specifies deadlines and required content for incident reports.

58

Establish and Maintain a Software Inventory

Document Data Flows

Establish and Maintain an Inventory of Service Providers