WIXLIB

HIPAA Security Policies & Procedures (HITECH & Omnibus updated)20Security Incident Procedures21Response and Reporting22Contingency Plan23Data Backup Plan24Disaster Recovery Plan25Emergency Mode Operation Plan26Testing and Revision Procedure27Applications and Data Criticality Analysis28Evaluation29Business Associate Contracts and OtherArrangements30Business Associate Agreement(Standard.) Discusses what the organization should do tomaintain a system for addressing security incidents that mayimpact the confidentiality, integrity, or availability of its ePHI.Defines what the organization should do to be able to effectivelyrespond to security incidents involving its ePHI. (RequiredImplementation Specification for Security Incident Proceduresstandard.)(Standard.) Identifies what the organization should do to be ableto effectively respond to emergencies or disasters that impact itsePHI.Discusses organizational processes to regularly back up andsecurely store ePHI. (Required Implementation Specification forContingency Plan standard.)Indicates what the organization should do to create a disasterrecovery plan to recover ePHI that was impacted by a disaster.(Required Implementation Specification for Contingency Planstandard.)Discusses what the organization should do to establish a formal,documented emergency mode operations plan to enable thecontinuance of crucial business processes that protect thesecurity of its ePHI during and immediately after a crisis situation.(Required Implementation Specification for Contingency Planstandard.)Describes what the organization should do to conduct regulartesting of its disaster recovery plan to ensure that it is up-to-dateand effective. (Addressable Implementation Specification forContingency Plan standard.)Reviews what the organization should do to have a formalprocess for defining and identifying the criticality of its informationsystems. (Addressable Implementation Specification forContingency Plan standard.)(Standard.) Describes what the organization should do toregularly conduct a technical and non-technical evaluation of itssecurity controls and processes in order to document compliancewith its own security policies and the HIPAA Security Rule.(Standard.) Describes how to establish agreements that shouldexist between the organization and its various businessassociates that create, receive, maintain, or transmit ePHI on itsbehalf.(Standard.) Describes how to establish agreements that shouldexist between the organization and its various businessassociates that create, receive, maintain, or transmit ePHI on itsbehalf.Copyright 2008-2017 https://www.hipaatraining.net/Supremus Group LLC 855 SE Bell Ct, Suite 300, Waukee, IA 50263Page 5 of 20

HIPAA Security Policies & Procedures (HITECH & Omnibus updated)31Execution of Business Associate Agreementswith ContractsProvide guidance to Covered Entity regarding execution ofbusiness associate contracts.36II. HIPAA SECURITY POLICIES ON THE STANDARDS FOR PHYSICAL SAFEGUARDS(Standard.) Describes what the organization should do toappropriately limit physical access to the information systemscontained within its facilities, while ensuring that properlyFacility Access Controlsauthorized employees can physically access such systems.Identifies what the organization should do to have formal,documented procedures for allowing authorized employees toenter its facility to take necessary actions as defined in itsdisaster recovery and emergency mode operations plans.(Addressable Implementation Specification for Facility AccessContingency OperationsControls standard.)Discusses what the organization should do to establish a facilitysecurity plan to protect its facilities and the equipment therein.(Addressable Implementation Specification for Facility AccessFacility Security PlanControls standard.)Discusses what the organization should do to appropriatelycontrol and validate physical access to its facilities containinginformation systems having ePHI or software programs that canaccess ePHI. (Addressable Implementation Specification forAccess Control and Validation ProceduresFacility Access Controls standard.)Defines what the organization should do to document repairs andmodifications to the physical components of its facilities related tothe protection of its ePHI. (Addressable ImplementationMaintenance RecordsSpecification for Facility Access Controls standard.)37Workstation Use38Workstation Security39Device and Media Controls40Disposal32333435(Standard.) Indicates what the organization should do toappropriately protect its workstations.(Standard.) Reviews what the organization should do to preventunauthorized physical access to workstations that can accessePHI while ensuring that authorized employees have appropriateaccess.(Standard.) Discusses what the organization should do toappropriately protect information systems and electronic mediacontaining PHI that are moved to various organizationallocations.Describes what the organization should do to appropriatelydispose of information systems and electronic media containingePHI when it is no longer needed. (Required ImplementationSpecification for Device and Media Controls standard.)Copyright 2008-2017 https://www.hipaatraining.net/Supremus Group LLC 855 SE Bell Ct, Suite 300, Waukee, IA 50263Page 6 of 20

HIPAA Security Policies & Procedures (HITECH & Omnibus updated)41Media Re-use42Mobile Device Policy43Accountability44Data Backup and Storage454647484950Discusses what the organization should do to erase ePHI fromelectronic media before re-using the media. (RequiredImplementation Specification for Device and Media Controlsstandard.)Discusses what the organization should do specificallyaddressing mobile device security in support of the Device andMedia Controls Standard.)Defines what the organization should do to appropriately trackand log all movement of information systems and electronicmedia containing ePHI to various organizational locations.(Addressable Implementation Specification for Device and MediaControls standard.)Discusses what the organization should do to backup andsecurely store ePHI on its information systems and electronicmedia. (Addressable Implementation Specification for Deviceand Media Controls standard.)III. HIPAA SECURITY POLICIES ON THE STANDARDS FOR TECHNICAL SAFEGUARDS(Standard.) Indicates what the organization should do topurchase and implement information systems that comply with itsAccess Controlinformation access management policies.Discusses what the organization should do to assign a uniqueidentifier for each of its employees who access its ePHI for thepurpose of tracking and monitoring use of information systems.(Required Implementation Specification for Access ControlUnique User Identificationstandard.)Discusses what the organization should do to have a formal,documented emergency access procedure enabling authorizedemployees to obtain required ePHI during the emergency.(Required Implementation Specification for Access ControlEmergency Access Procedurestandard.)Discusses what the organization should do to develop andimplement procedures for terminating users' sessions after acertain period of inactivity on systems that contain or have theability to access ePHI. (Addressable ImplementationAutomatic LogoffSpecification for Access Control standard.)Discusses what the organization should do to appropriately useencryption to protect the confidentiality, integrity, and availabilityof its ePHI. (Addressable Implementation Specification forEncryption and DecryptionAccess Control standard.)(Standard.) Discusses what the organization should do to recordand examine significant activity on its information systems thatAudit Controlscontain or use ePHI.Copyright 2008-2017 https://www.hipaatraining.net/Supremus Group LLC 855 SE Bell Ct, Suite 300, Waukee, IA 50263Page 7 of 20

HIPAA Security Policies & Procedures (HITECH & Omnibus updated)51Integrity52Mechanism to Authenticate ElectronicProtected Health Information53Person or Entity Authentication54Transmission Security55Integrity Controls56Encryption(Standard.) Defines what the organization should do toappropriately protect the integrity of its ePHI.Discusses what the organization should do to implementappropriate electronic mechanisms to confirm that its ePHI hasnot been altered or destroyed in any unauthorized manner.(Addressable Implementation Specification for Integritystandard.)(Standard.) Defines what the organization should do to ensurethat all persons or entities seeking access to its ePHI areappropriately authenticated before access is granted.(Standard.) Describes what the organization should do toappropriately protect the confidentiality, integrity, and availabilityof the ePHI it transmits over electronic communicationsnetworks.Indicates what the organization should do to maintain appropriateintegrity controls that protect the confidentiality, integrity, andavailability of the ePHI it transmits over electroniccommunications networks. (Addressable ImplementationSpecification for Transmission Security standard.)Defines what the organization should do to appropriately useencryption to protect the confidentiality, integrity, and availabilityof ePHI it transmits over electronic communications networks.(Addressable Implementation Specification for TransmissionSecurity standard.)IV. ORGANIZATIONAL REQUIREMENTS57Policies and Procedures58Documentation59Isolating Healthcare Clearinghouse Function(Standard.) Defines what the requirements are relative toestablishing organizational policies and procedures.(Standard.) Discusses what the organization should do toappropriately maintain, distribute, and review the security policiesand procedures it implements to comply with the HIPAA SecurityRulePurpose is to implement policies and procedures that protect theelectronic protected health information of the clearinghouse fromunauthorized access by the larger organization (RequiredImplementation Specification for Information AccessManagement standard.)Copyright 2008-2017 https://www.hipaatraining.net/Supremus Group LLC 855 SE Bell Ct, Suite 300, Waukee, IA 50263Page 8 of 20

HIPAA Security Policies & Procedures (HITECH & Omnibus updated)60Group Health Plan Requirements(Standard.) The purpose is to ensure that reasonable andappropriate safeguards are maintained on electronic protectedhealth information created, received, maintained, or transmittedto or by the plan sponsor on behalf of the group health plan.V. SUPPLEMENTAL POLICIES FOR REQUIRED POLICIESThe purpose is to implement security measures sufficient toreduce risks and vulnerabilities of the wireless infrastructure.The purpose is to establish management direction, procedures,and requirements to ensure safe and successful delivery of email.61Wireless Security Policy62Email Security Policy63Analog Line Policy64Dial-in Access Policy65Automatically Forwarded Email Policy66Remote Access PolicyThe purpose is to prevent the unauthorized or inadvertentdisclosure of sensitive company information.The purpose is to implement security measures sufficient toreduce risks and vulnerabilities of remote access connections tothe enterprise infrastructure.67Ethics PolicyThe purpose is to establish a culture of openness, trust andintegrity in business practices.68VPN Security PolicyThe purpose is to implement security measures sufficient toreduce the risks and vulnerabilities of the VPN infrastructureThe purpose is to explains Company's analog and ISDN lineacceptable use and approval policies and procedures.The purpose is to implement security measures sufficient toreduce risks and vulnerabilities of dial-in connections to theenterprise infrastructure69Extranet Policy70Internet DMZ Equipment PolicyThe purpose is to describes the policy under which third partyorganizations connect to Company's networks for the purpose oftransacting business related to CompanyThe purpose is to define standards to be met by all equipmentowned and/or operated by Company located outside Company'scorporate Internet firewalls.71Network Security PolicyThe purpose is to establish requirements for informationprocessed by computer networks.Copyright 2008-2017 https://www.hipaatraining.net/Supremus Group LLC 855 SE Bell Ct, Suite 300, Waukee, IA 50263Page 9 of 20

HIPAA Security Policies & Procedures (HITECH & Omnibus updated)View Sample HIPAA Security PolicyEffective Date of This Revision:June 22, 2017HIPAA Chief Security OfficerResponsible Department:"Insert Addressee Here"Contact:"Insert Street Address Here""Insert Phone Number Here"Copyright 2008-2017 https://www.hipaatraining.net/Supremus Group LLC 855 SE Bell Ct, Suite 300, Waukee, IA 50263Page 10 of 20

HIPAA Security Policies & Procedures (HITECH & Omnibus updated)HIPAA REGULATORY INFORMATION: Workforce Security StandardType:Administrative SafeguardCategory:StandardImplementation SpecificationPhysical SafeguardTechnical SafeguardRequiredOfficersStaff/ FacultyStudent cliniciansOther ies to:BACKGROUND:The Health Insurance Portability and Accountability Act of 1996 (HIPAA) requires that access to Protected HealthInformation (PHI) will be managed to guard the integrity, confidentiality, and availability of electronic PHI (ePHI) data.According to the law, all "Covered Entity's Name" officers, employees and agents of units within a "Covered / Hybrid"Entity must preserve the integrity and the confidentiality of individually identifiable health information (IIHI) pertaining toeach patient or client.SECURITY REGULATION IMPLEMENTATION SPECIFICATION LANGUAGE:“Implement procedures for terminating access to electronic protected health information when the employment ofa workforce member ends or as required by determinations made as specified in paragraph (a)(3)(ii)(B)[Workforce Clearance Procedure] of this section.”PURPOSE:Each Unit of "Covered Entity's Name" „s health care component (HCC), which handles ePHI, will have a documentedprocess for terminating access to ePHI when the employment of workforce members ends or access is no longerappropriate as set forth in "Covered Entity's Name" ‟s Workforce Clearance Procedure implemented specification("Policy Number" ), Information Access Management standard ("Policy Number" ) and Access Establishment andModification implementation specification ("Policy Number" ), for example due to a change in position such that theworkforce member no longer requires access to ePHI.This policy provides guidance for "Covered Entity's Name" „s Security Office in adopting the addressable TerminationProcedure Implementation Specification under the Workforce Security Standard [C.F.R. 164.308(a)(3)(i)].Copyright 2008-2017 https://www.hipaatraining.net/Supremus Group LLC 855 SE Bell Ct, Suite 300, Waukee, IA 50263Page 11 of 20

HIPAA Security Policies & Procedures (HITECH & Omnibus updated)POLICY:When a "Covered Entity's Name" „s workforce member will be ending their relationship with the covered entity, theaffected Human Resources department and the workforce member‟s supervisor will give reasonable notice to the"Covered Entity's Name" HIPAA Security Compliance Officer, who will then plan the termination of access to the ePHI forthe departing workforce member once s/he leaves in accordance with "Covered Entity's Name" „s Access Establishmentand Modification policy ("Policy Number" ) and document all modifications in the Access Authorization SheetEach Unit of "Covered Entity's Name" „s (HCC) will log, track, and securely maintain receipts and responses to suchtermination of access notices, including the following information: Date and time of notice of workforce member departure received Date of planned workforce member departure Description of access to be terminated Date, time, and description of actions takenWhen workforce members end their relationship with "Covered Entity's Name" , all privileges to access ePHI Systems,including both internal and remote information system privileges, will be disabled or removed by the time of departure, or ifnot feasible, as soon thereafter as possible.When "Covered Entity's Name" workforce members need to be terminated immediately, "Covered Entity's Name" and/or"Covered Entity's Name" „s HCC will remove or disable their information system privileges before they are notified of thetermination, when feasible. Information system privileges include workstations and server access, data access, networkaccess, email accounts, and inclusion on group email lists.Physical access to areas where ePHI is located will be terminated as appropriate in accordance with "Covered Entity'sName" „s Access Establishment and Modification policy ("Policy Number" )"Covered Entity's Name" „s HCC will be alert tosituations where workforce members are terminated and may pose risks to the security of ePHI following the FacilitySecurity Plan ("Policy Number" )."Covered Entity's Name" „s workforce members will have their ePHI information system privileges disabled after theiraccess methods or user IDs have been inactive for "Number of Days" . "Covered Entity's Name" HIPAA SecurityCompliance Office will review privileges that are disabled due to inactivity and take the necessary steps to determine thecause of the inactivity. If inactivity is due to termination of employment, "Covered Entity's Name" will promptly terminate allinformation system privileges and notify appropriate "Covered Entity's Name" personnel to terminate physical access toareas where ePHI is located. If inactivity is due to other causes, "Covered Entity's Name" will complete a review and takemeasures to terminate, limit, suspend, or maintain the workforce member‟s access, as appropriately documented in"Covered Entity's Name" „s Access Establishment and Modification policy ("Policy Number" )Each Unit of "Covered Entity's Name" „s HCC will ensure that cryptographic keys are recovered and made available to theappropriate managers or administrators if departing workforce members have used cryptography on ePHI.Copyright 2008-2017 https://www.hipaatraining.net/Supremus Group LLC 855 SE Bell Ct, Suite 300, Waukee, IA 50263Page 12 of 20

HIPAA Security Policies & Procedures (HITECH & Omnibus updated)A workforce member who ends employment with "Covered Entity's Name" will not retain, give away, or remove from"Covered Entity's Name" „s premises any ePHI. At the time of his or her departure, a workforce member will provide ePHIin his or her possession to his or her supervisor. "Covered Entity's Name" reserves the right to pursue any and allremedies against workforce members who violate this provision. Departing workforce members‟ supervisors willdetermine the appropriate handling of any ePHI that departing workforce members possess, in accordance with "CoveredEntity's Name" „s Device and Media Controls policy ("Policy Number" )."Covered Entity's Name" will deactivate or change physical security access codes used to protect ePHI Systems ofdeparting workforce members, when known.Each Unit of "Covered Entity's Name" „s HCC will implement a documented procedure for return of supplied equipmentand property that contains or allows access to ePHI, and will disable and remove access to ePHI Systems held by theworkforce member, by the time of, or if not feasible, immediately after, the workforce member‟s departure.Each Unit of "Covered Entity's Name" „s HCC will track and log the return of equipment and property containing or havingthe ability to access ePHI with the workforce member‟s name, date and time equipment and property was returned, andidentification of returned items, and will securely maintain the tracking and logging information on the Inventory trackingsheet. The equ

Contingency Plan standard.) 24 Disaster Recovery Plan Indicates what the organization should do to create a disaster recovery plan to recover ePHI that was impacted by a disaster. (Required Implementation Specification for Contingency Plan standard.) 25 Emergency Mode Operation Plan Discusses what the organization should do to establish a formal,