G.12 HIC device/tool and software on the device, reducing the possibility of it – being compromised and data disclosed. antivirus configuration maintenance H Physical Security Standard – SCOPE CONSIDERATIONS H.13 Protecting systems at the HICs premises Scope includes your organization’s network and – computing devices which are permitted to SCOPE CONSIDERATIONS participate in [the EHR Solution]. Scope includes the physical HIC premises and IMPLEMENTATION GUIDELINES destruction of information assets. Malware detection (e.g., Antivirus software) should be IMPLEMENTATION GUIDELINES deployed on HIC-approved tools, processes, and workstations that are used to participate in [the EHR HICs must ensure that their physical premises have Solution]. security controls in place to protect from malicious parties accessing or stealing HIC-approved Malware (e.g., Antivirus Software) detection and tools/devices and information. repair software should be kept up-to-date to best detect malicious software that may be able to Access cards, locks, or secure areas that separate the compromise the network and the HIC-approved tools. public from the office space should be implemented to Often this software can be configured to check for reduce physical security risks. updates automatically and scan the HIC- approved tool. HICs must ensure that there are procedures in place to address the destruction of data. Refer to guidance HIC approved should be kept up-to-date from the related to Order HO-001. to ensure security patches have been applied to all
G.12 – HIC device/tool and antivirus configuration maintenance SCOPE CONSIDERATIONS Scope includes your organization’s network and computing devices which are permitted to participate in [the EHR Solution]. IMPLEMENTATION GUIDELINES Malware detection (e.g., Antivirus software) should be deployed on HIC-approved tools, processes, and workstations that are used to participate in [the EHR Solution]. Malware (e.g., Antivirus Software) detection and repair software should be kept up-to-date to best detect malicious software that may be able to compromise the network and the HIC-approved tools. Often this software can be configured to check for updates automatically and scan the HIC- approved tool. HIC approved should be kept up-to-date to ensure security patches have been applied to all software on the device, reducing the possibility of it being compromised and data disclosed. H – Physical Security Standard H.13 – Protecting systems at the HICs premises SCOPE CONSIDERATIONS Scope includes the physical HIC premises and destruction of information assets. IMPLEMENTATION GUIDELINES HICs must ensure that their physical premises have security controls in place to protect from malicious parties accessing or stealing HIC-approved tools/devices and information. Access cards, locks, or secure areas that separate the public from the office space should be implemented to reduce physical security risks. HICs must ensure that there are procedures in place to address the destruction of data. Refer to guidance from the related to Order HO-001.
EHR_Security_Assessment_for_Viewing_Organizations_EN.docx