Does your hospital have: An information technology system malfunction alert and notification procedure? Trained personnel for information technology response and recovery operations? Standards for the development and security of systems and substructures (i.e., departments), including non information systems staff with special levels of cybersystems knowledge? Policies for the interface and deployment of wireless data and voice systems communications? Backup or alternate contingencies in for communications, network failure, or equipment failure? Data backup and data redundancy processes and policies for enterprise wide and departmental specific data systems, including testing to ensure backups are functional? Data security exchange protocols for secure interface with authorized emergency management 6. agencies? A management process to approve all information technologies utilized in the organization including, but not limited to, different systems sharing like data and how shared or exchanged data is protected from corruption while allowing access to critical data under emergent conditions? A protocol to monitor the number of cybersystem response incidents involving external attacks by deliberate attempts to penetrate security and to take appropriate protective actions? A system of cyber security audits using a scenario based evaluation or a series of critical benchmarks approved by a multidisciplinary committee within your organization? Policies and procedures for notification of patients and appropriate officials in the event of a protected health information breach? Departmental Business Continuity with clear recovery time objectives in place? Are these plans tested and exercised? Does your hospital comply with current standards on disaster and emergency management and 7. business continuity as they apply to all third party vendors that support and supply cyber technology services, such as offsite backup and data recovery processes? Does your hospital comply with current standards on disaster and emergency management and 8. business continuity as they apply to all third party vendors that support and supply cyber technology services, such as offsite backup and data recovery processes? Immediate and Intermediate Response Does your hospital have: Systems and procedures to determine what information technology systems are affected by the incident? Procedures to obtain information on possible entry points of an information technology failure 1. incident? Procedures to evaluate firewall management and containment, and to respond accordingly? Policies for the Chief Information Officer or Information Technology Manager to direct staff in identifying potential problem areas? 2. Does your hospital have communication methods to:
6. Does your hospital have: An information technology system malfunction alert and notification procedure? Trained personnel for information technology response and recovery operations? Standards for the development and security of systems and substructures (i.e., departments), including non information systems staff with special levels of cybersystems knowledge? Policies for the interface and deployment of wireless data and voice systems communications? Backup or alternate contingencies in for communications, network failure, or equipment failure? Data backup and data redundancy processes and policies for enterprise wide and departmental specific data systems, including testing to ensure backups are functional? Data security exchange protocols for secure interface with authorized emergency management agencies? A management process to approve all information technologies utilized in the organization including, but not limited to, different systems sharing like data and how shared or exchanged data is protected from corruption while allowing access to critical data under emergent conditions? A protocol to monitor the number of cybersystem response incidents involving external attacks by deliberate attempts to penetrate security and to take appropriate protective actions? A system of cyber security audits using a scenario based evaluation or a series of critical benchmarks approved by a multidisciplinary committee within your organization? Policies and procedures for notification of patients and appropriate officials in the event of a protected health information breach? Departmental Business Continuity with clear recovery time objectives in place? Are these plans tested and exercised? 7. Does your hospital comply with current standards on disaster and emergency management and business continuity as they apply to all third party vendors that support and supply cyber technology services, such as offsite backup and data recovery processes? 8. Does your hospital comply with current standards on disaster and emergency management and business continuity as they apply to all third party vendors that support and supply cyber technology services, such as offsite backup and data recovery processes? Immediate and Intermediate Response 1. Does your hospital have: Systems and procedures to determine what information technology systems are affected by the incident? Procedures to obtain information on possible entry points of an information technology failure incident? Procedures to evaluate firewall management and containment, and to respond accordingly? Policies for the Chief Information Officer or Information Technology Manager to direct staff in identifying potential problem areas? 2. Does your hospital have communication methods to:
IT-Failure-IPG.docx