Low Medium High Related Information: Things to Consider to Help Answer the Question: Consider whether your practice: Identifies the roles that will participate in incident response and reporting Provides appropriate role-based training Engages in incident response testing Makes observations and recommendations for improving incident response in formal reports Identifies who may (and who may not) speak to business associates, patients, the media, and law enforcement in the event of an incident Possible Threats and Vulnerabilities: Your practice may not be able to safeguard its information systems, applications, and ePHI if it does not identify members of its incident response team and assure workforce members are trained and that incident response plans are tested. Some potential impacts include: Unauthorized or inappropriate access to ePHI can compromise the confidentiality, integrity, and availability of your practice’s ePHI. Unauthorized disclosure, loss, or of ePHI can lead to medical identity theft. Accurate ePHI may not be available when needed, which can adversely impact your healthcare professionals’ ability to diagnose and treat their patients. Examples of Safeguards: are some potential safeguards to use against possible threats/vulnerabilities. NOTE: The safeguards you choose will depend on the degree of risk and the potential harm that the threat/vulnerability poses to you and the individuals who are the subjects of the ePHI. Identify and respond to suspected or known security incidents; mitigate, to the extent practicable, harmful effects of security incidents that are known to the covered entity or business associate; and document security incidents and their outcomes. [45 CFR §164.308(a)(6)(ii)]
Low Medium High Related Information: Things to Consider to Help Answer the Question: Consider whether your practice: Identifies the roles that will participate in incident response and reporting Provides appropriate role-based training Engages in incident response testing Makes observations and recommendations for improving incident response in formal reports Identifies who may (and who may not) speak to business associates, patients, the media, and law enforcement in the event of an incident Possible Threats and Vulnerabilities: Your practice may not be able to safeguard its information systems, applications, and ePHI if it does not identify members of its incident response team and assure workforce members are trained and that incident response plans are tested. Some potential impacts include: Unauthorized or inappropriate access to ePHI can compromise the confidentiality, integrity, and availability of your practice’s ePHI. Unauthorized disclosure, loss, or of ePHI can lead to medical identity theft. Accurate ePHI may not be available when needed, which can adversely impact your healthcare professionals’ ability to diagnose and treat their patients. Examples of Safeguards: are some potential safeguards to use against possible threats/vulnerabilities. NOTE: The safeguards you choose will depend on the degree of risk and the potential harm that the threat/vulnerability poses to you and the individuals who are the subjects of the ePHI. Identify and respond to suspected or known security incidents; mitigate, to the extent practicable, harmful effects of security incidents that are known to the covered entity or business associate; and document security incidents and their outcomes. [45 CFR §164.308(a)(6)(ii)]
attachment_b_-_20140312_sratool_content_-_administrative_volume_v6_clean.docx