Information Security
Policy Template

Provided By:

National Learning Consortium

The National Learning Consortium (NLC) is a virtual and evolving body of knowledge and tools designed to support healthcare providers and health IT professionals working towards the implementation, adoption and meaningful use of certified EHR systems. 

The NLC represents the collective EHR implementation experiences and knowledge gained directly from the field of ONC’s outreach programs (REC, Beacon, State HIE) and through the Health Information Technology Research Center (HITRC) Communities of Practice (CoPs).

Instructions

INFORMATION SECURITY POLICY

Last Revision Date

Date²

Document Owner

Name³

Table of Contents

1.4 Applicable Statutes / Regulations 11

1.5 Privacy Officer 11

2.3 Electronic Communication, E-mail, Internet Usage¹² 14

2.4 Internet Access 16

2.9 Internet Considerations 18

2.10 Installation of authentication and encryption certificates on the e-mail system 18

3.2 Passwords 20

3.3 Confidentiality Agreement 21

4.1 Dial-In Connections 23

4.2 Dial Out Connections 23

5 Malicious Code 26

5.1 Antivirus Software Installation 26

6.2 Encryption Key 28

6.3 Installation of authentication and encryption certificates on the e-mail system 28

8 Telecommuting 31

8.1 General Requirements 31

9 Specific Protocols and Devices 34

9.1 Wireless Usage Standards and Policy 34

11.2 Requirements Regarding Equipment 38

11.3 Disposition of Excess Equipment 38

16 Contingency Plan 45

17 Security Awareness and Training 48

22 Employee Background Checks 65

23 Discovery Policy: Production and Disclosure 67

Appendix C – Approved Software 86

Appendix D – Approved Vendors 87

Introduction

Purpose

Scope

Acronyms / Definitions

Common terms and acronyms that may be used throughout this document.

CEO – The Chief Executive Officer is responsible for the overall privacy and security practices of the company.

CST – Confidentiality and Security Team

DoD – Department of Defense

FTP – File Transfer Protocol

HIPAA - Health Insurance Portability and Accountability Act

User - Any person authorized to access an information resource.

Privileged Users – system administrators and others specifically identified and authorized by Practice management.

WAN – Wide Area Network – A computer network that enables communication across a broad area, i.e. regional, national.

Virus - a software program capable of reproducing itself and usually capable of causing great harm to files or other programs on the computer it attacks. A true virus cannot spread to another computer without human assistance.

Applicable Statutes / Regulations

Privacy Officer

Name – Telephone Number⁸

Confidentiality / Security Team (CST)

The Practice has established a Confidentiality / Security Team made up of key personnel whose responsibility it is to identify areas of concern within the Practice and act as the first line of defense in enhancing the appropriate security posture.

Title – Name

Title – Name

Employee Responsibilities

Employee Requirements

Unattended Computers - Unattended computers should be locked by the user when leaving the work area. This feature is discussed with all employees during yearly security training. Practice policy states that all computers will have the automatic screen lock function set to automatically activate upon fifteen (15)¹¹ minutes of inactivity. Employees are not allowed to take any action which would override this setting.

Home Use of Practice Corporate Assets - Only computer hardware and software owned by and installed by the Practice is permitted to be connected to or installed on Practice equipment. Only software that has been approved for corporate use by the Practice may be installed on Practice equipment. Personal computers supplied by the Practice are to be used solely for business purposes. All employees and contractors must read and understand the list of prohibited activities that are outlined below. Modifications or configuration changes are not permitted on computers supplied by the Practice for home use.

Prohibited Activities

• Introducing, or attempting to introduce, computer viruses, Trojan horses, peer-to-peer (“P2P”) or other malicious code into an information system.

• Exception: Authorized information system support personnel, or others authorized by the Practice Privacy Officer, may test the resiliency of a system. Such personnel may test for susceptibility to hardware or software failure, security against hacker attacks, and system infection.

Electronic Communication, E-mail, Internet Usage¹²

As a productivity enhancement tool, The Practice encourages the business use of electronic communications. However, all electronic communication systems and all messages generated on or handled by Practice owned equipment are considered the property of the Practice – not the property of individual users. Consequently, this policy applies to all Practice employees and contractors, and covers all electronic communications including, but not limited to, telephones, e-mail, voice mail, instant messaging, Internet, fax, personal computers, and servers.

Practice provided resources, such as individual computer workstations or laptops, computer systems, networks, e-mail, and Internet software and services are intended for business purposes. However, incidental personal use is permissible as long as:

4. 1. Copyright violations – This includes the act of pirating software, music, books and/or videos or the use of pirated software, music, books and/or videos and the illegal duplication and/or distribution of information and other intellectual property that is under copyright.

   2. Illegal activities – Use of Practice information resources for or in support of illegal purposes as defined by federal, state or local law is strictly prohibited.

Generally, while it is NOT the policy of the Practice to monitor the content of any electronic communication, the Practice is responsible for servicing and protecting the Practice’s equipment, networks, data, and resource availability and therefore may be required to access and/or monitor electronic communications from time to time. Several different methods are employed to accomplish these goals. For example, an audit or cost analysis may require reports that monitor phone numbers dialed, length of calls, number of calls to / from a specific handset, the time of day, etc. Other examples where electronic communications may be monitored include, but are not limited to, research and testing to optimize IT resources, troubleshooting technical problems and detecting patterns of abuse or illegal activity.

The Practice reserves the right, at its discretion, to review any employee’s files or electronic communications to the extent necessary to ensure all electronic media and services are used in compliance with all applicable laws and regulations as well as Practice policies.

Internet Access

Reporting Software Malfunctions

Users should inform the appropriate Practice personnel when the user's software does not appear to be functioning correctly. The malfunction - whether accidental or deliberate - may pose an information security risk. If the user, or the user's manager or supervisor, suspects a computer virus infection, the Practice computer virus policy should be followed, and these steps should be taken immediately:

• Stop using the computer

• Inform the appropriate personnel or Practice ISO as soon as possible. Write down any unusual behavior of the computer (screen messages, unexpected disk access, unusual responses to commands) and the time when they were first noticed.

• Write down any changes in hardware, software, or software use that preceded the malfunction.

Report Security Incidents

Security breaches shall be promptly investigated. If criminal action is suspected, the Practice Privacy Officer shall contact the appropriate law enforcement and investigative authorities immediately, which may include but is not limited to the police or the FBI.

Transfer of Sensitive/Confidential Information

When confidential or sensitive information from one individual is received by another individual while conducting official business, the receiving individual shall maintain the confidentiality or sensitivity of the information in accordance with the conditions imposed by the providing individual. All employees must recognize the sensitive nature of data maintained by the Practice and hold all data in the strictest confidence. Any purposeful release of data to which an employee may have access is a violation of Practice policy and will result in personnel action, and may result in legal action.

Transferring Software and Files between Home and Work

Internet Considerations

The following security and administration issues shall govern Internet usage.

Prior approval of the Practice Privacy Officer or appropriate personnel authorized by the Practice shall be obtained before:

• Confidential or sensitive data - including credit card numbers, telephone calling card numbers, logon passwords, and other parameters that can be used to access goods or services - shall be encrypted before being transmitted through the Internet.

• The encryption software used, and the specific encryption keys (e.g. passwords, pass phrases), shall be escrowed with the Practice Privacy Officer or appropriate personnel, to ensure they are safely maintained/stored. The use of encryption software and keys, which have not been escrowed as prescribed above, is prohibited, and may make the user subject to disciplinary action.

Installation of authentication and encryption certificates on the e-mail system

Use of WinZip encrypted and zipped e-mail

De-identification / Re-identification of Personal Health Information (PHI)

PHI includes:

• Names

• Facsimile numbers

• Driver’s license numbers

• Account numbers, certificate/license numbers

• Vehicle identifiers and serial numbers

• Full face photographic images and any comparable images

Re-identification of confidential information: A cross-reference code or other means of record identification is used to re-identify data as long as the code is not derived from or related to information about the individual and cannot be translated to identify the individual. In addition, the code is not disclosed for any other purpose nor is the mechanism for re-identification disclosed.

Identification and Authentication

User Logon IDs

• Each user shall be assigned a unique identifier.

• Users shall be responsible for the use and misuse of their individual logon ID.

Passwords

User IDs and passwords are required in order to gain access to all Practice networks and workstations. All passwords are restricted by a corporate-wide password policy to be of a "Strong" nature. This means that all passwords must conform to restrictions and limitations that are designed to make the password difficult to guess. Users are required to select a password in order to obtain access to any electronic information both at the server level and at the workstation level. When passwords are reset, the user will be automatically prompted to manually change that assigned password.

Password Length – Passwords are required to be a minimum of eight characters¹⁵.

Restrictions on Recording Passwords - Passwords are masked or suppressed on all online screens, and are never printed or included in reports or logs. Passwords are stored in an encrypted format.

Confidentiality Agreement

Users of Practice information resources shall sign, as a condition for employment, an appropriate confidentiality agreement (Appendix D). The agreement shall include the following statement, or a paraphrase of it:

Access Control

Rules for access to resources (including internal and external telecommunications and networks) have been established by the information/application owner or manager responsible for the resources. Access is granted only by the completion of a Network Access Request Form (Appendix C). This form can only be initiated by the appropriate department head, and must be signed by the department head and the Security Officer or appropriate personnel.

This guideline satisfies the "need to know" requirement of the HIPAA regulation, since the supervisor or department head is the person who most closely recognizes an employee's need to access data. Users may be added to the information system, network, or EHR only upon the signature of the Security Officer or appropriate personnel who is responsible for adding the employee to the network in a manner and fashion that ensures the employee is granted access to data only as specifically requested.

User Login Entitlement Reviews

No less than annually, the IT Manager shall facilitate entitlement reviews with department heads to ensure that all employees have the appropriate roles, access, and software necessary to perform their job functions effectively while being limited to the minimum necessary data to facilitate HIPAA compliance and protect patient data.

Termination of User Logon Account

Upon termination of an employee, whether voluntary or involuntary, employee’s supervisor or department head shall promptly notify the IT Department by indicating “Remove Access” on the employee’s Network Access Request Form (Appendix C) and submitting the Form to the IT Department. If employee’s termination is voluntary and employee provides notice, employee’s supervisor or department head shall promptly notify the IT Department of employee’s last scheduled work day so that their user account(s) can be configured to expire. The employee’s department head shall be responsible for insuring that all keys, ID badges, and other access devices as well as Practice equipment and property is returned to the Practice prior to the employee leaving the Practice on their final day of employment.

Network Connectivity

Dial-In Connections

Access to Practice information resources through modems or other dial-in devices / software, if available, shall be subject to authorization and authentication by an access control system. Direct inward dialing without passing through the access control system is prohibited.

Dial-up numbers shall be unlisted.

Dial Out Connections

Telecommunication Equipment

• phone lines

• fax lines

• cell phones

• Blackberry type devices

• long distance lines

• 800 lines

Permanent Connections

Emphasis on Security in Third Party Contracts

Access to Practice computer systems or corporate networks should not be granted until a review of the following concerns have been made, and appropriate restrictions or covenants included in a statement of work (“SOW”) with the party requesting access.

• Applicable sections of the Practice Information Security Policy have been reviewed and considered.

• A description of each service to be made available.

• Each service, access, account, and/or permission made available should only be the minimum necessary for the third party to perform their contractual obligations.

• The right to monitor and revoke user activity should be included in each agreement.

• Language on restrictions on copying and disclosing information should be included in all agreements.

• Mechanisms should be in place to ensure that security measures are being followed by all parties to the agreement.

• Because annual confidentiality training is required under the HIPAA regulation, a formal procedure should be established to ensure that the training takes place, that there is a method to determine who must take the training, who will administer the training, and the process to determine the content of the training established.

Firewalls

Malicious Code

Antivirus Software Installation

Antivirus software is installed on all Practice personal computers and servers. Virus update patterns are updated daily on the Practice servers and workstations. Virus update engines and data files are monitored by appropriate administrative staff that is responsible for keeping all virus patterns up to date.

New Software Distribution

Although shareware and freeware can often be useful sources of work-related programs, the use and/or acquisition of such software must be approved by the Privacy Officer or appropriate personnel. Because the software is often provided in an open distribution environment, special precautions must be taken before it is installed on Practice computers and networks. These precautions include determining that the software does not, because of faulty design, “misbehave” and interfere with or damage Practice hardware, software, or data, and that the software does not contain viruses, either originating with the software designer or acquired in the process of distribution.

All data and program files that have been electronically transmitted to a Practice computer or network from another location must be scanned for viruses immediately after being received. Contact the appropriate Practice personnel for instructions for scanning files for viruses.

Retention of Ownership

Encryption

Definition

Encryption Key

Installation of authentication and encryption certificates on the e-mail system

Use of WinZip encrypted and zipped e-mail

This software allows Practice personnel to exchange e-mail with remote users who have the appropriate encryption software on their system. The two users exchange private keys that will be used to both encrypt and decrypt each transmission. Any Practice staff member who desires to utilize this technology may request this software from the Privacy Officer or appropriate personnel.

File Transfer Protocol (FTP)

Files may be transferred to secure FTP sites through the use of appropriate security precautions. Requests for any FTP transfers should be directed to the Privacy Officer or appropriate personnel.

Secure Socket Layer (SSL) Web Interface

Building Security

It is the policy of the Practice to provide building access in a secure manner. Each site, if applicable, is somewhat unique in terms of building ownership, lease contracts, entranceway access, fire escape requirements, and server room control. However, the Practice strives to continuously upgrade and expand its security and to enhance protection of its assets and medical information that has been entrusted to it. The following list identifies measures that are in effect at the Practice. All other facilities, if applicable, have similar security appropriate for that location.

Description of building, location, square footage, and the use of any generator.

• The reception area is staffed at all times during the working hours of 8:00 AM to 5:00 PM22.

• Any unrecognized person in a restricted office location should be challenged as to their right to be there. All visitors must sign in at the front desk, wear a visitor badge (excluding patients), and be accompanied by a Practice staff member. In some situations, non-Practice personnel, who have signed the confidentiality agreement, do not need to be accompanied at all times.

• Fire Protection: Use of local building codes will be observed. Manufacturer’s recommendations on the fire protection of individual hardware will be followed.

Telecommuting

General Requirements

• Need to Know: Telecommuting Users will have the access based on the same ‘need to know’ as they have when in the office.

• Password Use: The use of a strong password, changed at least every 90 days²⁷, is even more critical in the telecommuting environment. Do not share your password or write it down where a family member or visitor can see it.

Required Equipment

Practice Provided:

A cable lock to secure the workstation to a fixed object.

If using VPN, a Practice issued hardware firewall is required.

Employee Provided:

Secure office environment isolated from visitors and family,

A lockable file cabinet or safe to secure documents when away from the home office.

Hardware Security Protections

Data Security Protection

Data Backup: Backup procedures have been established that encrypt the data being moved to an external media. Use only that procedure – do not create one on your own. If there is not a backup procedure established, or if you have external media that is not encrypted, contact the appropriate Practice personnel for assistance. Protect external media by keeping it in your possession when traveling.

Transferring Data to the Practice: Transferring of data to the Practice requires the use of an approved VPN connection to ensure the confidentiality and integrity of the data being transmitted. Do not circumvent established procedures, nor create your own method, when transferring data to the Practice.

Hard Copy Reports or Work Papers: Never leave paper records around your work area. Lock all paper records in a file cabinet at night or when you leave your work area.

Data Entry When in a Public Location: Do not perform work tasks which require the use of sensitive corporate or patient level information when you are in a public area, i.e. airports, airplanes, hotel lobbies. Computer screens can easily be viewed from beside or behind you.

Disposal of Paper and/or External Media

• Return all external media to your supervisor

• External media must be wiped clean of all data. The Privacy Officer or appropriate personnel has very definitive procedures for doing this – so all external media must be sent to them.

Specific Protocols and Devices

Wireless Usage Standards and Policy

Due to an emergence of wireless access points in hotels, airports, and in homes, it has become imperative that a Wireless Usage policy be developed and adopted to ensure the security and functionality of such connections for Practice employees. This policy outlines the processes and procedures for acquiring wireless access privileges, utilizing wireless access, and ensuring the security of Practice laptops and mobile devices.

Approval Procedure - In order to be granted the ability to utilize the wireless network interface on your Practice laptop or mobile device you will be required to gain the approval of your immediate supervisor or department head and the Privacy Officer or appropriate personnel of the Practice. The Network Access Request Form (found in Appendix A) is used to make such a request. Once this form is completed and approved you will be contacted by appropriate Practice personnel to setup your laptop and schedule training.

• Appropriate VPN Client, if applicable

• Internet Explorer 6.0 SP2 or Greater

Use of Transportable Media

The use of transportable media in various formats is common practice within the Practice. All users must be aware that sensitive data could potentially be lost or compromised when moved outside of Practice networks. Transportable media received from an external source could potentially pose a threat to Practice networks. Sensitive data includes all human resource data, financial data, Practice proprietary information, and personal health information (“PHI”) protected by the Health Insurance Portability and Accountability Act (“HIPAA”).

USB key devices are handy devices which allow the transfer of data in an easy to carry format. They provide a much improved format for data transfer when compared to previous media formats, like diskettes, CD-ROMs, or DVDs. The software drivers necessary to utilize a USB key are normally included within the device and install automatically when connected. They now come in a rugged titanium format which connects to any key ring. These factors make them easy to use and to carry, but unfortunately easy to lose.

• Non-Practice workstations and laptops may not have the same security protection standards required by the Practice, and accordingly virus patterns could potentially be transferred from the non-Practice device to the media and then back to the Practice workstation.

Example: Do not copy a work spreadsheet to your USB key and take it home to work on your home PC.

• Before initial use and before any sensitive data may be transferred to transportable media, the media must be sent to the Privacy Officer or appropriate personnel to ensure appropriate and approved encryption is used. Copy sensitive data only to the encrypted space on the media. Non-sensitive data may be transferred to the non-encrypted space on the media.

• Report all loss of transportable media to your supervisor or department head. It is important that the CST team is notified either directly from the employee or contractor or by the supervisor or department head immediately.

Retention / Destruction of Medical Information

Disposal of External Media / Hardware

Disposal of External Media

• When no longer needed all forms of external media are to be sent to the Privacy Officer or appropriate personnel for proper disposal.

• The media will be secured until appropriate destruction methods are used based on NIST 800-88 guidelines.

Requirements Regarding Equipment

Disposition of Excess Equipment

• Older machines are used for testing new software.

• Older machines are used as backups for other production equipment.

Change Management

Statement of Policy

To ensure that Practice is tracking changes to networks, systems, and workstations including software releases and software vulnerability patching in information systems that contain electronic protected health information (“ePHI”). Change tracking allows the Information Technology (“IT”) Department to efficiently troubleshoot issues that arise due to an update, new implementation, reconfiguration, or other change to the system.

3. The employee implementing the change shall also be familiar with the rollback process in the event that the change causes an adverse effect within the system and needs to be removed.

Audit Controls

Procedure

1. See policy entitled Information System Activity Review for the administrative safeguards for auditing system activities.

Information System Activity Review

Statement of Policy

To establish the process for conducting, on a periodic basis, an operational review of system activity including, but not limited to, user accounts, system access, file access, security incidents, audit logs, and access reports. Practice shall conduct on a regular basis an internal review of records of system activity to minimize security violations.

4. Such reviews shall be conducted annually. Audits also shall be conducted if Practice has reason to suspect wrongdoing. In conducting these reviews, the Information Technology Services shall examine audit logs for security-significant events including, but not limited to, the following:

1. Logins – Scan successful and unsuccessful login attempts. Identify multiple failed login attempts, account lockouts, and unauthorized access.

1. The Information Technology Services shall forward all completed reports, as well as recommended actions to be taken in response to findings, to the Security Officer for review. The Security Officer shall be responsible for maintaining such reports. The Security Officer shall consider such reports and recommendations in determining whether to make changes to Practice’s administrative, physical, and technical safeguards. In the event a security incident is detected through such auditing, such matter shall be addressed pursuant to the policy entitled Employee Responsibilities (Report Security Incidents).

Data Integrity

Procedure

To the fullest extent possible, Practice shall utilize applications with built-in intelligence that automatically checks for human errors.

1. Practice will install and regularly update antivirus software on all workstations to detect and prevent malicious code from altering or destroying data.

2. To prevent exposing magnetic media to a strong magnetic field, workforce members shall keep magnetic media away from strong magnetic fields and heat. For example, computers should not be left in automobiles during the summer months.

Contingency Plan

Practice is committed to maintaining formal practices for responding to an emergency or other occurrence that damages systems containing ePHI. Practice shall continually assess potential risks and vulnerabilities to protect health information in its possession, and develop, implement, and maintain appropriate administrative, physical, and technical security measures in accordance with the HIPAA Security Rule.

Procedure

1. 4. The Security Officer shall test backup procedures on an annual basis to ensure that exact copies of ePHI can be retrieved and made available. Such testing shall be documented by the Security Officer. To the extent such testing indicates need for improvement in backup procedures, the Security Officer shall identify and implement such improvements in a timely manner.

2. Disaster Recovery and Emergency Mode Operations Plan

   2. 1. Current copies of the information systems inventory and network configuration developed and updated as part of Practice’s risk analysis.

      2. Current copy of the written backup procedures developed and updated pursuant to this policy.

      4. 3. Retrieving lost data.

         4. Identifying and implementing appropriate “work-arounds” during such time information systems are unavailable.
      6. 2. Facilities at which backup data is stored,

         3. Information systems vendors, and
   3. 3. Review the written disaster recovery and emergency mode operations plan and make appropriate changes to the plan. The Security Officer shall be responsible for convening and maintaining minutes of such meetings. The Security Officer also shall be responsible for revising the plan based on the recommendations of the disaster recovery team.

Security Awareness and Training

Procedure

1. Security Training Program

2. The Security Officer shall generate and distribute special notices to all workforce members providing urgent updates, such as new threats, hazards, vulnerabilities, and/or countermeasures.

   3. Protection from Malicious Software

1. 4. Recognizing signs of a potential virus that could sneak past antivirus software or could arrive prior to an update to anti-virus software,

   5. The importance of backing up critical data on a regular basis and storing the data in a safe place,

4. 1. 1. Passwords must be changed every 90 days.

      2. A user cannot reuse the last 12 passwords.

      7. Passwords must not be written down, posted, or exposed in an insecure manner such as on a notepad or posted on the workstation.

      8. Employees should refuse all offers by software and/or Internet sites to automatically login the next time that they access those resources.

Security Management Process

To ensure Practice conducts an accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity, and availability of ePHI held by Practice.

Practice shall conduct an accurate and thorough risk analysis to serve as the basis for Practice’s HIPAA Security Rule compliance efforts. Practice shall re-assess the security risks to its ePHI and evaluate the effectiveness of its security measures and safeguards as necessary in light of changes to business practices and technological advancements.

2. 1. 1. Update/develop information systems inventory. List the following information for all hardware (i.e., network devices, workstations, printers, scanners, mobile devices) and software (i.e., operating system, various applications, interfaces): date acquired, location, vendor, licenses, maintenance schedule, and function. Update/develop network diagram illustrating how organization’s information system network is configured.

      2. Update/develop facility layout showing location of all information systems equipment, power sources, telephone jacks, and other telecommunications equipment, network access points, fire and burglary alarm equipment, and storage for hazardous materials.

3. Determine whether the data is maintained within the organization only or transmitted to third parties. If data is transmitted to a third party, identify that party and the purpose and manner of transmission.

4. Define the criticality of the application and related data as high, medium, or low. Criticality is the degree of impact on the organization if the application and/or related data were unavailable for a period of time.

2. Environmental threats, e.g., fire and smoke damage, power outage, utility problems.

3. Human threats

   4. 4. Identify and document vulnerabilities in Practice’s information systems. A vulnerability is a flaw or weakness in security policies and procedures, design, implementation, or controls that could be accidentally triggered or intentionally exploited, resulting in unauthorized access to ePHI, modification of ePHI, denial of service, or repudiation (i.e., the inability to identify the source and hold some person accountable for an action). To accomplish this task, conduct a self-analysis utilizing the standards and implementation specifications to identify vulnerabilities.

         6. Determine and document probability and criticality of identified risks.

3. 2. Assign criticality level.

1. "High" (3) is defined as having a catastrophic impact on the medical practice including a significant number of medical records which may have been lost or compromised.

3. 3. 8. Develop and document an implementation strategy for critical security measures and safeguards.

1. Determine timeline for implementation.

5. 9. Evaluate effectiveness of measures and safeguards following implementation and make appropriate adjustments.

      3. The Security Officer shall be responsible for identifying appropriate times to conduct follow-up evaluations and coordinating such evaluations. The Security Officer shall identify appropriate persons within the organization to assist with such evaluations. Such evaluations shall be conducted upon the occurrence of one or more of the following events: changes in the HIPAA Security Regulations; new federal, state, or local laws or regulations affecting the security of ePHI; changes in technology, environmental processes, or business processes that may affect HIPAA Security policies or procedures; or the occurrence of a serious security incident. Follow-up evaluations shall include the following:

Emergency Operations Procedures

Electronic Health Record (EHR) – Electronic records of patient encounters in a healthcare delivery setting. An electronic health record typically consists of information including: patient demographics, progress notes, medication history, vital signs and laboratory results.

Practice Management (PM) – A practice Management System is usually a computer based system used to manage the day-to-day operations of a healthcare practice. Tasks typically performed by a PM system include: scheduling appointments, maintaining patient and insurance information, billing functions and generating various reports.

• unexpected outage of EHR systems, and

• resumption of EHR services following an outage such that normal operations may resume.

Telephone encounters should be entered onto the paper telephone encounter form and transferred to a nurse for triage.

Out folders should be used as temporary charts.

Paper progress note templates should be used to record usual nurse intake.

Out folder is placed on exam room door as before, using the flag system to notify provider that the patient is ready.

System Restoration:

Patient encounters occurring during system downtime should be entered into the system via the following procedures:

• Scheduling telephone calls should be returned. A telephone encounter does not need to be entered into the EHR.

• Telephone encounters for all other issues should be entered into the system and routed as appropriate.

All other phone/fax information will be scanned into the patient’s record when the EHR system is operational and normal operations have resumed.

Emergency Access “Break the Glass”

Definitions  

Medical emergency means medically necessary care which is immediately needed to preserve life, prevent serious impairment to bodily functions, organs, or parts, or prevent placing the physical or mental health of the patient in serious jeopardy.

1. Electronic storage media including memory devices in computers (hard drives) and any removable/transportable digital memory medium, such as magnetic tape or disk, optical disk, or digital memory card; or

2. Transmission media used to exchange information already in electronic storage media. Transmission media include, for example, the internet, extranet (using internet technology to link a business with information accessible only to collaborating parties), leased lines, dial-up lines, private networks, and the physical movement of removable/transportable electronic storage media. Certain transmissions, including of paper, via facsimile, and of voice, via telephone, are not considered to be transmissions via electronic media, because the information being exchanged did not exist in electronic form before the transmission.

• Identifying and defining which the Practice workforce members authorized to access EPHI during an emergency.

• Identifying and defining manual and automated methods to be used by authorized Practice workforce members to access EPHI during a medical emergency.

Scope/Applicability

This policy is applicable to all divisions and workforce members that use or disclose electronic protected health information for any purposes. This policy’s scope includes all electronic protected health information, as described in definitions below.

Rule Language:

“Establish (and implement as needed) procedures for obtaining necessary electronic protected health information (EPHI) during a medical emergency.”

Procedures

Mechanism to Provide Emergency Access to EPHI

3. 2. Job title

   3. Reason for emergency access

6. The emergency access will be tracked and documented based on capabilities of the EHR. The tracking documentation will be reviewed by the Security Officer to determine that emergency access was appropriate.

7. At the conclusion of the event that precipitated the granting of emergency access, the Security Officer ensures the breakglass accounts are disabled, and new ones created in anticipation of the next emergency.

• Creating an extremely complicated password (but one an employee will be able to enter while under the stress of an emergency situation).

• Securing the password.

Sanction Policy

Policy
It is the policy of the Practice that all workforce members must protect the confidentiality, integrity, and availability of sensitive information at all times. The Practice will impose sanctions, as described below, on any individual who accesses, uses, or discloses sensitive information without proper authorization.

The Practice will take appropriate disciplinary action against employees, contractors, or any individuals who violate the Practice’s information security and privacy policies or state, or federal confidentiality laws or regulations, including the Health Insurance Portability and Accountability Act of 1996 (HIPAA).

Sensitive information, includes, but not limited to, the following:

• Protected Health Information (PHI) – Individually identifiable health information that is in any form or media, whether electronic, paper, or oral.

• Other information that is confidential – Any other information that is sensitive in nature or considered to be confidential.

Availability refers to data or information is accessible and useable upon demand by an authorized person.

In the event that a workforce member violates the Practice’s privacy and security policies and/or violates the Health Insurance Portability and Accountability Act of 1996 (HIPAA) or related state laws governing the protection of sensitive and patient identifiable information, the following recommended disciplinary actions will apply.

Important Note: The recommended disciplinary actions are identified in order to provide guidance in policy enforcement and are not meant to be all-inclusive. If formal discipline is deemed necessary, the Practice shall consult with Human Resources prior to taking action. When appropriate, progressive disciplinary action steps shall be followed allowing the employee to correct the behavior which caused the disciplinary action.

U.S. Department of Health and Human Services

Health Information Privacy. Retrieved April 24, 2009, from

I, the undersigned employee or contractor, hereby acknowledges receipt of a copy of the Sanction Policy for Practice Name¹.

Dated this ________ day of _________________, 20____.

Employee Background Checks

The Practice will conduct employment reference checks, investigative consumer reports, and background investigations on all candidates for employment prior to making a final offer of employment, and may use a third party to conduct these background checks. The Practice will obtain written consent from applicants and employees prior to ordering reports from third-party providers, and will provide a description of applicant and employee rights and all other documentation as required by law to each applicant or candidate in accordance with FCRA and applicable state and federal statutes (Appendix G). All background checks are subject to these notice and consent requirements.

An investigative consumer report compiles information on a candidate’s general reputation, personal characteristics, or mode of living. This information may be gathered online including social networking sites, through public or educational records, or through interviews with employers, friends, neighbors, associates, or anyone else who may have information about the employee or potential employee. In the pre-employment process, investigative consumer reports typically include such things as criminal records checks, education verification checks, and employment verification checks.

The type of information that will be collected by the Practice in background checks may include, but is not limited to, some or all of the following:

• Private and government agency reports related to any history of criminal, dishonest, or violent behavior, and other reports that relate to suitability for employment

• Credit reports

• Social security number scans

Discovery Policy: Production and Disclosure

Policy
It is the policy of this organization to produce and disclose relevant information and records in compliance with applicable laws, court procedures, and agreements made during the litigation process.

Procedure

Accurate Patient Identification

Charges for Copying and Disclosure

APPROVALS:

e-Discovery Policy: Retention

This policy applies to all enterprise health information and records whether the information is paper based or electronic. It applies to any health record, regardless of whether it is maintained by the Health Information Management Department or by the clinical or ancillary department that created it.

Definitions

Unauthorized Destruction: The unauthorized destruction, removal, alteration, or use of health information and records is prohibited. Persons who destroy, remove, alter or use health information and records in an unauthorized manner will be disciplined in accordance with the organization’s Sanction Policy.

Procedure

Breach Notification Procedures

Purpose

To outline the process for notifying affected individuals of a breach of protected information under the Privacy Act, unsecured protected health information (PHI) for the purposes of the Health Insurance Portability and Accountability Act of 1996 (HIPAA), Health Information Technology for Economic and Clinical Health Act (HITECH), and/or state breach notification purposes.

Personal Information – Personal Information has many definitions including definitions by statute which may vary from state to state. Most generally, Personal Information is a combination of data elements which could uniquely identify an individual. Please review applicable state data breach statutes to determine what definition of Personal Information is applicable for purposes of the document.

HIPAA Breach – Unauthorized acquisition, access, use, or disclosure of unsecured PHI.

Protected Health Information (PHI) – Individually identifiable health information except for education records covered by FERPA and employment records.

Procedure

3. You may call the Privacy Officer directly at _____-_____³².

   1. Provide the Privacy Officer with as much detail as possible.

1. The Privacy Officer will take the following steps to limit the scope and effect of the breach.

   1. Work with department(s) to immediately contain the breach. Examples include, but are not limited to:

      5. Correcting weaknesses in security practices

      6. Notifying the appropriate authorities including the local Police Department if the breach involves, or may involve, any criminal activity

1. 2. The Privacy Officer, in collaboration with the Practice’s Legal Counsel, will consider several factors in determining whether to notify individuals affected by the breach including, but not limited to:

      1. Contractual obligations

      6. Number of individuals affected

Notification

2. 1. 1. 1. What happened

         2. Types of PHI involved

   2. If law enforcement authorities have been contacted, those authorities will assist in determining whether notification may be delayed in order not to impede a criminal investigation.

3. The required elements of notification vary depending on the type of breach and which law is implicated. As a result, the Practice’s Privacy Officer and Legal Counsel should work closely to draft any notification that is distributed.

1. Notices must be provided without reasonable delay and in no case later than sixty (60) days after discovery of the breach.

2. Business associates must cooperate with the Practice in investigating and mitigating the breach.

1. Once immediate steps are taken to mitigate the risks associated with the breach, the Privacy Officer will investigate the cause of the breach.

   1. If necessary, this will include a security audit of physical, organizational, and technological measures.

Compliance and Enforcement

All managers and supervisors are responsible for enforcing these procedures. Employees who violate these procedures are subject to discipline up to and including termination in accordance with the Practice’s Sanction Policy.

Appendix A – Network Access Request Form

Employee or Contractor Request for Network Access

Appendix B – Confidentiality Form

Date Signature

______________________________________

Appendix C – Approved Software

Appendix D – Approved Vendors

Appendix E – Incident Response Tools

Appendix F – Background Check Authorization

Under the provisions of the Fair Credit Reporting Act (15 U.S.C. §1681 et seq.), the Americans with Disabilities Act, and all applicable federal, state, and local laws, I hereby authorize and permit to obtain a consumer report and/or an investigative consumer report which may include the following:

1. My employment records;

I agree that a copy of this authorization has the same effect as an original.

I understand that information obtained in this authorized investigative consumer report and background investigation may result in not being offered a position of employment. I hereby release and hold harmless any person, firm, or entity that discloses information in accordance with this authorization, as well as from liability that might otherwise result from the request for use of and/or disclosure of any or all of the foregoing information except with respect to a violation of the Act. I authorize <Company Name> (“Practice”) and its designated agent and all associated entities to receive any criminal history information or credit report pertaining to me in the files of any state or local criminal justice agency. I authorize all corporations; companies; former employers; supervisors; credit agencies; educational institutions; law enforcement/ criminal justice agencies; city, state, county and federal courts; state motor vehicle bureaus; and other persons and entities to release information they may have about me to the Practice or their designated agent.

Other Names Used _____________________________________________

Social Security Number _____/___/_____ Date of Birth _______________

Driver's License # ___________________ State _____________________
 

Adapted from http://www.softechinternational.com/SampleReleaseForm.pdf and

http://www.national-employment-screening.com/background-check-release.htm.

Appendix G – Change Management Tracking Log

Appendix H – Employee Hiring and Termination Checklist

Worksheet: Excel Version Attached