similar access control methods. Some potential impacts include: Human threats, such as an unauthorized user or a disgruntled workforce member who can • compromise ePHI. Unauthorized disclosure, loss, or theft of ePHI can lead to identity theft. Examples of Safeguards: Some potential safeguards to use against possible threats/vulnerabilities. NOTE: The safeguards you may choose will depend on the degree of risk (likelihood) and the potential harm that the threat/vulnerability to you and the individuals who are the subjects of the ePHI. Establish policies and procedures to protect the facility and its equipment from unauthorized physical access, tampering, and theft. [45 CFR §164.310(a)(2)(ii)] Prepare an inventory of the keys, combinations, access cards, doors, locks, and the like and indicate the authorized users who possess them. Establish physical access control procedures to change combinations and keys at regular intervals and/or when keys are lost, combinations are compromised, or individuals are transferred or terminated. [NIST SP 800-53 PE-3] PH9 - §164.310(a)(2)(ii) Addressable Do you have policies and procedures governing when to re-key locks or change combinations when, for example, a key is lost, a combination is compromised, or a workforce member is transferred or terminated? Yes No If no, please select from the following: Cost Practice Size
similar access control methods. Some potential impacts include: • Human threats, such as an unauthorized user or a disgruntled workforce member who can compromise ePHI. Unauthorized disclosure, loss, or theft of ePHI can lead to identity theft. Examples of Safeguards: Some potential safeguards to use against possible threats/vulnerabilities. NOTE: The safeguards you may choose will depend on the degree of risk (likelihood) and the potential harm that the threat/vulnerability to you and the individuals who are the subjects of the ePHI. Establish policies and procedures to protect the facility and its equipment from unauthorized physical access, tampering, and theft. [45 CFR §164.310(a)(2)(ii)] Prepare an inventory of the keys, combinations, access cards, doors, locks, and the like and indicate the authorized users who possess them. Establish physical access control procedures to change combinations and keys at regular intervals and/or when keys are lost, combinations are compromised, or individuals are transferred or terminated. [NIST SP 800-53 PE-3] PH9 - §164.310(a)(2)(ii) Addressable Do you have policies and procedures governing when to re-key locks or change combinations when, for example, a key is lost, a combination is compromised, or a workforce member is transferred or terminated? Yes No If no, please select from the following: Cost Practice Size
20140318_sratool_content_-_physical_volume_v1.docx