Related Information: Things to Consider to Help Answer the Question: Consider that written policies and procedures that: Can drive the development of processes and adoption of standards and controls, which reduce risk to ePHI Can provide essential information for privacy and security awareness and role-based training. Possible Threats and Vulnerabilities: If your practice does not have policies regarding mechanisms (hardware and software) that can record and examine information system activity, then inappropriate use of information systems and access of ePHI can go undetected. Examples of Safeguards: Some potential safeguards to use against possible threats/vulnerabilities. NOTE: The safeguards you may choose will depend on the degree of risk (likelihood) and the potential harm that the threat/vulnerability poses to you and the individuals who are the subjects of the ePHI. Implement hardware, software, and/or procedural mechanisms that record and examine activity in information systems that contain or use ePHI. [45 CFR §164.312(b)] Develop, document, and disseminate to workforce members an audit and accountability policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; procedures to facilitate the implementation of the audit and accountability policy and associated audit and accountability controls. [NIST SP 800-53 AU-1] Identify and periodically review and update key events (e.g., activities that create, store, and transmit ePHI) and those that are significant to the security of information systems and the environments in which they operate in order to support ongoing audit needs. [NIST SP 800-53 AU-2] T24 - §164.312(b) Standard Does your practice identify its activities that create, store, and transmit ePHI and the information systems that support these business processes? Yes No
Related Information: Things to Consider to Help Answer the Question: Consider that written policies and procedures that: Can drive the development of processes and adoption of standards and controls, which reduce risk to ePHI Can provide essential information for privacy and security awareness and role-based training. Possible Threats and Vulnerabilities: If your practice does not have policies regarding mechanisms (hardware and software) that can record and examine information system activity, then inappropriate use of information systems and access of ePHI can go undetected. Examples of Safeguards: Some potential safeguards to use against possible threats/vulnerabilities. NOTE: The safeguards you may choose will depend on the degree of risk (likelihood) and the potential harm that the threat/vulnerability poses to you and the individuals who are the subjects of the ePHI. Implement hardware, software, and/or procedural mechanisms that record and examine activity in information systems that contain or use ePHI. [45 CFR §164.312(b)] Develop, document, and disseminate to workforce members an audit and accountability policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; procedures to facilitate the implementation of the audit and accountability policy and associated audit and accountability controls. [NIST SP 800-53 AU-1] Identify and periodically review and update key events (e.g., activities that create, store, and transmit ePHI) and those that are significant to the security of information systems and the environments in which they operate in order to support ongoing audit needs. [NIST SP 800-53 AU-2] T24 - §164.312(b) Standard Does your practice identify its activities that create, store, and transmit ePHI and the information systems that support these business processes? Yes No
20140320_sratool_content_-_technical_volume_v1.docx