Transcription
Computersecurity guidelinesA self assessment guide and checklist for general practice3rd edition iStockphoto.com/Marcela Barsse
Computersecurity guidelinesA self assessment guide and checklist for general practice3rd edition
Computer security guidelinesA self assessment guide and checklist for general practice3rd editionDisclaimerThe information set out in this publication is current at the date of firstpublication and is intended for use as a guide of a general nature only. Thispublication is not exhaustive of the subject matter. Persons implementingany recommendations contained in this publication must exercise theirown independent skill or judgement or seek appropriate professionaladvice relevant to their own particular circumstances when so doing.Compliance with any recommendations cannot of itself guaranteedischarge of the duty of care owed to patients and others coming intocontact with the health professional and the premises from which thehealth professional operates.Whilst the text is directed to health professionals possessing appropriatequalifications and skills in ascertaining and discharging their professional(including legal) duties, it is not to be regarded as definitive technicaladvice and, in particular, is no substitute for a full investigation andconsideration of a particular environment by an expert in the fieldin reaching a final recommendation tailored to personal needs andcircumstances.Accordingly The Royal Australian College of General Practitionersand its employees and agents shall have no liability (including withoutlimitation liability by reason of negligence) to any users of the informationcontained in this publication for any loss or damage (consequentialor otherwise), cost or expense incurred or arising by reason of anyperson using or relying on the information contained in this publicationand whether caused by reason of any error, negligent act, omission ormisrepresentation in the information.Published byThe Royal Australian College of General PractitionersCollege House1 Palmerston CrescentSouth Melbourne VIC 3205 AustraliaTel 03 8699 0414Fax 03 9696 0400Email ehealth@racgp.org.auwww.racgp.org.auISBN: 978-0-86906-322-4Published October 2010 The Royal Australian College of General Practitioners. All rights reserved.
Healthy Profession.Healthy Australia.The RACGPComputer security guidelines 3rd editionAcknowledgmentsThe RACGP Computer security guidelines: a self assessment guide and checklist for generalpractice (3rd edition) is based on the Computer security self-assessment guideline andchecklist for general practitioners (2nd edition), published in 2005 by the General PracticeComputing Group, and on previous work by The Royal Australian College of GeneralPractitioners and the Australian Medical Association.The Royal Australian College of General Practitioners gratefully acknowledges the followingorganisations and people who were involved in the development, review, writing and fundingof the 3rd edition:The National E-Health Transition AuthorityAssociate Professor Peter SchattnerAssociate Professor Ron TomlinsDr John W BennettDr Nathan PinskierJudy EvansNamanita MussThe RACGP e-health Standards and e-health Working GroupsDr Trish Williams (PhD)
The RACGPComputer security guidelines 3rd editionHealthy Profession.Healthy Australia.ContentsPreface11. Introduction41.1 How should you use this guide?42. Computer security checklist53. The 10 item computer security guide6Organisational issues63.1 Practice computer security coordinator63.2 Practice security policies and procedures manual83.3 Access control and management93.4 Business continuity and disaster recovery plans11Technical issues123.5 Backup123.6 Malware and viruses143.7 Network perimeter controls153.8 Portable devices and remote access security163.9 Computer and network maintenance183.10 Secure electronic communication204. Conclusion23Appendices24Appendix A – Practice computer security coordinator role description20Appendix B – Computer security policies and procedures manual documents27Appendix C – Contractual agreements with technical service providers30Appendix D – Business continuity plan31Appendix E – Internet and email policies33Appendix F – Computer security terms35
Healthy Profession.Healthy Australia.The RACGPComputer security guidelines 3rd editionPrefaceThe use of clinical desktop systems and the electronic management of informationhas become a vital tool in the delivery of safe and high quality care for patients. Manypractices utilise a combination of the skills of their staff and the engagement of externalinformation technology (IT) consultants to install and maintain their computer systemsand security. Generally it has not been easy to access appropriate training to developIT security skills for practice staff and this has meant that staff in general practicehave been working without important knowledge and skills in IT. General practice hasspecific requisites for computer and information security and it can be a challengeto find external security experts and technical service providers who understand thebusiness of delivering care in the general practice environment.Some of the issues that general practices may face Lack of risk analysis. Risk analysis involves reviewing the computer and informationsecurity measures and practices and then identifying gaps in security and developingstrategies to mitigate security risks. Ensuring that information held on practice computersystems is secure is essential to running a general practice, to maintaining professionalresponsibilities to patients, and to making sure that practice information is accurate andavailable when it is needed Lack of designated authority. In this situation there is no one person with the designatedauthority to ensure that all computer function and security processes are documentedand followed. This includes a lack of clarity about the role of the external technicalservice providers and when it is appropriate to engage their services. Computer securityrequires regular attention at a practice level and all staff need to be aware of theirresponsibility in protecting practice information. Unfortunately, staff position descriptionsmay not reflect responsibility for information security and often staff are not provided withprofessional development to gain the required skills in IT and security awareness Lack of data management processes. This is when backup procedures are poorlydocumented and not appropriately tested. It is important to ensure that the backupsystem functions correctly and that data can be recovered if there is an incident such asa server failure Lack of business continuity and disaster recovery planning. A lack of a properlydocumented business continuity plan or disaster recovery procedures means that inthe event of a ‘disaster’ there is an inadequately planned response, which may lead toinconvenience and potential loss or corruption of information Lack of password security. Poor password management means it might be hard toascertain who within a practice has entered or altered data, including clinical records. Italso leaves the practice vulnerable to unauthorised system and information access Lack of security ‘culture’ and leadership. It is important that one or more people withinthe practice take responsibility for computer security. It is beneficial to promote a cultureof security within the practice. This includes educating practice staff about the risks tothe information systems and the maintenance of practical policies that direct staff in theirmanagement of the security risks.1
2The RACGPComputer security guidelines 3rd editionPreface continued.The RACGP Computer security guidelines: a self assessment guide and checklist forgeneral practice (3rd edition) places greater emphasis on the roles of the personnelinvolved with protecting practice information. These guidelines detail the knowledgeneeded by practice staff, the basic security processes that are required, and indicatewhen it may be necessary to engage external IT and security expertise.This 3rd edition of the security guidelines takes into account the increased use oflaptops, remote access devices (eg. personal digital assistants (PDAs), USB flashdrives, and removable hard drives) and wireless (Wi-Fi) connections. The practiceserver and network now assumes an increasingly vital role, clinical and practicemanagement software is more complex, and there is widespread uptake of broadbandinternet and secure messaging.Note: The security guidelines 3rd edition do not address patient access to medical records orthe management of pathology and/or radiology results. Staff need to be aware of the RACGPStandards for general practices (4th edition) that detail the overarching professional standardsrelated to patient access to information and the associated security and privacy issues. Theprincipal aim of the computer security guidelines is to highlight the processes, policies andprocedures that will protect your practice’s information.Healthcare IdentifiersGeneral practice has entered the era of e-health (e-health is the use in the healthsector of digital data that is transmitted, stored and retrieved electronically in supportof healthcare, both at the local site and at a distance. The World Health Organization’sdefinition is at www.who.int.) Secure transmission of data and patient identification willbe underpinned by the allocation of unique healthcare identifiers, which are 16 digitnumbers to be used to identify healthcare providers, healthcare organisations andindividuals. Unique healthcare identifiers will better support the management of healthinformation and the communication of health information between healthcare providersand healthcare organisations.Three types of healthcare identifiers will be assigned by the Australian HealthcareIdentifiers (HI) Service: Individual Healthcare Identifier (IHI) – for individuals receiving healthcare services Healthcare Provider Identifier – Individual (HPI-I) – for healthcare professionals and otherhealth personnel involved in providing patient care Healthcare Provider Identifier – Organisation (HPI-O) – for organisations (eg. the hospitaland/or general practice) where healthcare is provided.The identifiers will be assigned and administered through the HI Service. A keyaim of the healthcare identifier is to ensure individuals and providers have increasedconfidence that the right health information is associated with the right individual at thepoint-of-care.Healthy Profession.Healthy Australia.
Healthy Profession.Healthy Australia.The RACGPComputer security guidelines 3rd editionPreface continued.Healthcare providers who are identified with an HPI-I, or an authorised employee, canaccess the HI Service to obtain the IHI of a patient being treated. This means generalpractice staff will require training on the implications of healthcare identifier numbersand how they are assigned.For further information RACGP Standards for general practices (4th edition) (www.racgp.org.au/standards) The Australian Government Practice Incentives Program (PIP) eHealth Incentiverequirements pip/index.jsp) The National Privacy Principles (www.privacy.gov.au) Standards Australia. HB 174-2003 Information security management – implementationguide for the health sector. Sydney: Standards Australia International, 2003. (Note: Thishandbook is about to be updated) International Organization for Standardization. ISO27799 Health Informatics – Informationsecurity management in health using ISO/IEC 27002 (2008) (www.iso.org)It is a challenge to produce guidelines that will suit all practices. The computer systemsrequirements of large practices differ form those of solo practices; practices varyin their level of staff computer skills; ‘paperless’ practices will have different needsto those with a hybrid system; and rural practitioners may have less opportunity forobtaining technical support. It is therefore important for all practices to apply a riskanalysis of their particular systems and security needs, and to document the policiesand procedures to which staff will need to adhere, so that there is assurance ofavailability, integrity and confidentiality of data held within the practice’s clinical andadministrative systems.3
4The RACGPComputer security guidelines 3rd edition1. IntroductionMaintaining information security is vital and requires planning and technical knowledge.These guidelines have been developed to provide a framework to enable practice staffto work through the elements of computer security and information management. It isnot a technical manual, but will assist practices to understand what is needed in orderto put in place a series of computer security strategies.When reading these guidelines, bear in mind that it is about computer and informationsecurity and refers to: availability of information – available and accessible when needed integrity of information – not altered or destroyed in unauthorised ways confidentiality of information – only authorised people can access the information.1.1 How should you use this guide?There are three sections to these guidelines: A checklist that will determine whether you have established reasonable computersecurity measures in your practice to protect the information the practice uses, recordsand is responsible for A guideline for each security risk category. Each category section is divided into threesubcategories to assist in understanding and implementing the correct action:1. What does this risk category mean? This describes the risk in some detail2. Why is it important? This explains why practices should spend time and moneyon protection from the risk and the potential consequences of ignoring therecommendations3. What should be done about it? This outlines the step-by-step processes whichshould be followed in order to manage the risk A series of proformas provide useful lists of information such as how to produce abusiness continuity and disaster recovery plan. The policies and procedures documentis available as a template you can download from the RACGP website (www.racgp.org.au/ehealth/csg). By adding information relevant to your practice, you can incorporate thistemplate directly into your practice’s policies and procedures manual.Healthy Profession.Healthy Australia.
Healthy Profession.Healthy Australia.The RACGPComputer security guidelines 3rd edition52. Computer security checklistThis is a checklist to provide an overall assessment of the basic computer security processes currently in place.The checklist should be reviewed annually. These guidelines describe each item in the checklist in more detail.IT categoryTasksHas this beenimplemented?(Tick if yes andadd date)Practicecomputer securitycoordinatorPractice computer security coordinator/s appointed (insert name)Practice computer security coordinator/s’ role documentedComputer security training for practice computer securitycoordinator/s providedPractice computer security coordinator/s’ role reviewed (yearly)Computer security policies and procedures documentedComputer security policies and procedures documentation reviewedStaff trained in computer security policies and procedures/ // /Practice computersecurity policiesand procedures/ // // // /Access control andmanagementStaff policy developed on levels of access to data and information systemsStaff are assigned appropriate access levelStaff have individual passwords which are kept secret and secure/ // // /Business continuityand disasterrecovery plansBusiness continuity and disaster recovery plans developedBusiness continuity and disaster recovery plans testedBusiness continuity and disaster recovery plans reviewed and updated/ // // /BackupBackup of data performed daily, with weekly, monthly and yearly copiesretainedBackups encryptedBackup of data stored securely offsiteBackup procedure tested by performing a restoration of dataBackup procedure included in a documented business continuity anddisaster recovery planAntivirus and antimalware software installed on all computersAutomatic updating of virus definitions is enabled on all computers/serverStaff trained in antimalware proceduresAutomatic weekly scans of hardware enabled/ /Network perimetercontrolsHardware and/or software network perimeter controls installedHardware and/or software network perimeter controls tested periodicallyIntrusion activity logs monitored and breaches reported/ // // /Portable devicesand remote accesssecurityPortable devices, memory devices, backup media kept secureWireless networks and remote access systems configured securelyPolicy on the use of mobile devices documented/ // // /Computerand networkmaintenancePhysical security of the server and network maintainedSensitive screen information kept appropriately confidential (eg. viascreen positioning or ‘clear screen’ function keys)Computer programs maintained (eg. with automatic upgrades andpatches, and performance reviewed periodically)Uninterruptible power supply and surge protectors installedSecure messaging system (involving encryption) used for the electronictransfer of confidential informationSafe and secure use of email, internet and the practice website policydeveloped and reviewed periodically/ // /Malware andvirusesSecure electroniccommunication/ // // // // // // // // // // // /
6The RACGPComputer security guidelines 3rd edition3. The 10 item computer security guideComputer security is more about people and their actions (or inaction) than it is abouttechnical matters. Communication, documentation of processes and identifyingappropriate training for staff and GPs is essential to maintaining good computersecurity. Above all, a ‘computer security culture’ is required. It is essential that practicestaff become aware of the risks to information and the responsibility and contributionthey make to maintaining the confidentiality, integrity and availability of that information.All staff need training in the fundamentals of computer security, and staff knowledgeand competency in these areas need to be reviewed on a regular basis, at least onceper year.Organisational issues3.1 Practice computer security coordinatorWhat does this risk category mean?The practice computer security coordinator is the person responsible for drawingtogether the computer security issues that confront the practice – it is very much aleadership role. The computer security coordinator is responsible for managing thetraining of staff and maintaining staff knowledge of computer security principles andpractice, and security policy and procedures. The practice security coordinator mightbe one of the doctors, a nurse, a senior receptionist or the practice manager. Thesetasks can be allocated to more than one person in the practice.Specific tasks include: clarifying and documenting the computer security roles and responsibilities of all staff w riting, reviewing and regularly updating the security policies and procedures manual.This will include policy and procedures on (but not limited to):– backup– access control– internet and email usage– malware (eg. virus) protection– wireless and mobile connections– perimeter controls and intrusion detection (eg. firewalls)– physical security (as it relates to the computer systems)– disaster recovery plans– business continuity plans– security management and reporting including: i dentifying the role of the external IT consultant and when it is appropriate to seektheir advice monitoring and ensuring security policies and procedures are being followed vulnerability management and risk assessmentHealthy Profession.Healthy Australia.
Healthy Profession.Healthy Australia.The RACGPComputer security guidelines 3rd edition staff training – training needs identified, completed and documented including:– ongoing security awareness education– secure messaging usage maintenance of the asset register including:– hardware– software licences and associated installation keys– configuration information– digital certificate and signature information– secure storage of all operating manuals, installation media– ensure the practice management is aware of any outstanding security issues andregularly report on security in practice management meetings.A generic role description for the computer security coordinator is outlined inAppendix A. While many practices now outsource aspects of computer maintenanceto IT professionals, a practice computer security coordinator needs to be aware ofwhat needs to be done, even though they may not have the technical knowledge toperform these tasks themselves.Why is it important?Clearly documented action plans will minimise the risk of the practice being unableto function normally. The practice security coordinator should ensure that securitypolicies and procedures are developed systematically.The coordinator’s role is primarily to raise computer security awareness rather than tobe a technical ‘fix-it’ person. They should help to engender interest, even enthusiasm,for an IT security ‘culture’ and to ensure that there is adequate and appropriate trainingfor all staff. They also need to understand that while many aspects of computersecurity are rightly outsourced to IT companies, certain responsibilities and tasksneed to be carried out by practice staff, eg. checks on the backup procedure. Therole of the coordinator is to ensure that all practice staff have a clear view of theirresponsibility and role in protecting the practice’s information.What should be done about it? Practice computer security coordinator appointedPractice computer security coordinator’s role description documentedComputer security training for coordinator providedSecurity coordinator’s role reviewed (eg. annually) and ongoing training provided.Note: All practice staff should be aware of their responsibility for information security. Whilethe role of the coordinator is well defined, it should be made explicit in the practice policies therole and responsibilities each member of the practice must assume to ensure the protection ofinformation. Staff awareness of their role in information security is vital to enhance this protection.This includes password management, recognition of errors or abnormal software behaviour, andcommitment to practice policy and procedures.7
8The RACGPComputer security guidelines 3rd edition3.2 Practice security policies and procedures manualWhat does this risk category mean?Practices need to document their computer security policies and procedures. Asecurity manual should include: the roles and responsibilities of the practice staff (clinical and nonclinical) in relation toprotecting the practice’s information, and in particular the role of the practice computersecurity coordinator a complete set of policies and procedures for:– backup– access control and password management (to define the various levels of access forclinical and nonclinical staff)– internet and email usage– malware (eg. virus) protection– wireless and mobile connections– perimeter controls and intrusion detection (eg. firewalls)– physical security (eg. restricted access to the practice server)– a disaster recovery plan– a business continuity plan (this is particularly important as it enables the practice tofunction when the computer systems are inoperable)– security management and reporting– an IT asset register of hardware, software, and support services– a register of digital certificates and their expiry dates where appropriate– timeline for review of policies– the communication strategy to ensure that all staff are aware of any changes to policyand their responsibilities in managing computer security. list of the essential computer security policies can be found in Appendix B. A genericAtemplate for these policies can be downloaded from www.racgp.org.au/ehealth/csg.Why is it important?A policy and procedures manual provides information and guidance to staff on theaccepted practice in managing the computer systems. It also provides key information,such as a list of phone numbers of software suppliers and details about operatingsystem configuration. It is a source of information to clarify roles and responsibilities,and to facilitate the orientation of new staff.The manual also encourages practices to review and evaluate their computersystems and think through their requirements in both human and financial terms. Thedevelopment of practice policies is informative and educative. Practices can engage inQuality Improvement and Continuing Professional Development (QI&CPD) activities asHealthy Profession.Healthy Australia.
Healthy Profession.Healthy Australia.The RACGPComputer security guidelines 3rd editionthey work through the issues. For instance, developing a ‘plan, do, study, act’ (PDSA)cycle will provide a framework for identifying and resolving issues.All aspects of the manual, including the individual security policies, are important toboth the protection of information and recovery from computer incidents. An essentialdocument is the asset register. The asset register includes hardware, software andservices components as it provides a reference to the set up of the computer systemand network in the practice. The asset register in the manual should include: a detailed description of the equipment including: make, model, serial numbers, date ofpurchase and warranty information location of the equipment in the practice l ocation of software installation discs (where appropriate) and installation keys and serialnumbers, configuration and set up details (where appropriate) the contact details of external support providers.An asset register template can be found in the policies template atwww.racgp.org.au/ehealth/csg.What should be done about it?Computer security policies and procedures documented omputer security policies and procedures documentation reviewed at specifiedCintervals, eg. annuallyStaff trained in computer security policies and procedures.3.3 Access control and managementWhat does this mean?One of the key features of information security is information access by authorisedpersonnel which is appropriate to their role and position in the practice. Practicesshould develop a policy on who can have access to specific information and systems.Generally, there are four levels of access. Systems administrator – this level of access is usually the highest and often is only usedby IT/security trained (external) service providers for the server, operating system andnetwork functions Practice manager – this access usually includes administrative functionality on variousfinancial, clinical and network systems used in the practice Receptionists – this level of access is for patient administration such as appointmentsand billing Clinical staff – this level is for use of the clinical programs. This access level maybe further subdivided where delineation between the physician, nursing and alliedhealthcare staff access is required.9
10The RACGPComputer security guidelines 3rd editionOnce a policy on access has been determined (ie. the rights, roles and permissions forstaff), then practice staff can be given appropriate authentication methods. These canbe divided into the following types: something you know (eg. a password) something you have (eg. a smartcard) something you are (eg. a fingerprint).Passwords are the most common form of access authentication.It is important for the practice to consider the implications of staff who no longer workat the practice. The process for removal of access needs to be detailed in the accesssecurity policy and procedures manual. This will also form part of the policy relating tostaff leaving the employment of the practice.There are two other access issues that need to be considered.1. Access to practice systems by external service providers – it is advisable to putin place a confidentiality agreement with anyone who works on or supports yourcomputer system. This should include support for the practice computer systemvia modem or internet support. A suggested confidentiality agreement is given inAppendix C2. In addition to internal policies that are concerned with access rights and other datahandling processes, privacy laws require organisations that deal with personalinformation to make available to the public a policy about their data handling practicesincluding collection, use and disclosure. Practices should obtain legal advice aboutthis and other obligations under state, territory and national privacy laws, and codes ofconduct and indemnity.Why is it important?It is essential to comply with governing privacy principles and all relevant state, territoryand national privacy laws. Restricting access to only those who are authorised willprotect the practice against misuse of any information that the practice retains.Best practice principles are that staff retain the responsibility for their own passwordsand do not share them with other staff members. Practices will need to develop theirpolicy after identifying and applying a risk analysis to the needs of the practice. Itis suggested that practices seek the support of suitably qualified IT professionals ifneeded.What should be done about it? Staff policy developed on levels of access to electronic data and informationsystems Individual staff are assigned an appropriate access level Staff have individual passwords which are kept secret and secure.Healthy Profession.Healthy Australia.
Healthy Profession.Healthy Australia.The RACGPComputer security guidelines 3rd edition3.4 Business continuity and disaster recovery plansWhat does this risk category mean?This is a documented plan that details what should be done when there areinterruptions to the function of the computer system, so that
3.3 Access control and management 9 3.4 Business continuity and disaster recovery plans 11 Technical issues 12 3.5 Backup 12 3.6 Malware and viruses 14 3.7 Network perimeter controls 15 3.8 Portable devices and remote access security 16 3.9 Computer and network maintenance 18 3.10 Secure electronic communication 20 4. Conclusion 23
