11 Configuring and HICs should implement and manage network controls in a way that ensures the separation of managing network different computing environments including the network perimeter (i.e., network zones). devices Typically an organization leverage a networking device such as a firewall to separate internal computers (your network) from the Internet (perimeter). If your organization provides WIFI “guest” Internet access to patients, ensure this network is separate from the HICs internal network, thus “guest” preventing unauthorized individuals from accessing the HICs network. Security gateway (i.e., firewall) configurations should be reviewed at annually. The process should ensure the: Review of the rule sets Removal of expired or unnecessary rules Resolution of conflicting rules, and Removal of unused or duplicate objects (e.g., network or computer systems). 12 HIC approved HICs should implement malware detection, virus scanning on all HIC-approved devices/tools used device/tool and to participate in [the EHR Solution]. antivirus configuration HICs should keep their malware detection, virus scanning, and patches up-to-date on all maintenance devices/tools used to participate in [the EHR Solution]. H Physical Security HICs must ensure that their physical premises have security controls in place to protect from malicious Standard parties accessing or stealing HIC-approved tools/ devices and information. These controls help with the following risk areas: Reducing the possibility of unauthorized access and breach of data confidentiality due to a compromise of the physical premises. 13 Securing the HIC HICs must ensure that HIC work spaces are protected against unauthorized physical access. Methods premise and data for preventing physical access may include: destruction Segmenting public and office work spaces Using locked cabinets to store equipment and sensitive information Fitting vulnerable doors and windows with locks or bolts Installing and monitoring closed-circuit television (CCTV) Employing security guards Installing intruder detection systems on external doors and testing accessible windows regularly HICs must ensure they have procedures to address the destruction of information in line with the guidance from the Information Privacy Commissioner.
11 Configuring and managing network devices HICs should implement and manage network controls in a way that ensures the separation of different computing environments including the network perimeter (i.e., network zones). Typically an organization leverage a networking device such as a firewall to separate internal computers (your network) from the Internet (perimeter). If your organization provides “guest” WIFI Internet access to patients, ensure this “guest” network is separate from the HICs internal network, thus preventing unauthorized individuals from accessing the HICs network. Security gateway (i.e., firewall) configurations should be reviewed at annually. The process should ensure the: Review of the rule sets Removal of expired or unnecessary rules Resolution of conflicting rules, and Removal of unused or duplicate objects (e.g., network or computer systems). 12 HIC approved device/tool and antivirus configuration maintenance HICs should implement malware detection, virus scanning on all HIC-approved devices/tools used to participate in [the EHR Solution]. HICs should keep their malware detection, virus scanning, and patches up-to-date on all devices/tools used to participate in [the EHR Solution]. H Physical Security Standard HICs must ensure that their physical premises have security controls in place to protect from malicious parties accessing or stealing HIC-approved tools/ devices and information. These controls help with the following risk areas: Reducing the possibility of unauthorized access and breach of data confidentiality due to a compromise of the physical premises. 13 Securing the HIC premise and data destruction HICs must ensure that HIC work spaces are protected against unauthorized physical access. Methods for preventing physical access may include: Segmenting public and office work spaces Using locked cabinets to store equipment and sensitive information Fitting vulnerable doors and windows with locks or bolts Installing and monitoring closed-circuit television (CCTV) Employing security guards Installing intruder detection systems on external doors and testing accessible windows regularly HICs must ensure they have procedures to address the destruction of information in line with the guidance from the Information Privacy Commissioner.