Physical Security. Is physical access to your facility secured with ID cards, biometrics, onsite security forces, security procedures, etc.?

Information Security. Is your transmitted data secured with 128 bit encryption, PKI, SSL, etc.?

Desktop Access. Is access to your network limited by auto-logoff, ID/password protection,password protected screensavers, security-enabled OS (WinNT/2000PRO not Win95/98/ME),appropriate personnel classifications, etc.?

Continuity. Is your operation prepared to continue in the event of an emergency with well distributed Emergency Response Procedures, Disaster Recovery Plan(s), and Business Continuity Plan(s), all based on a Business Impact Analysis?

Human Resources. Is an employee educational training program in place to ensure the requisite HIPAA knowledge 'level of awareness'?

Privacy. Do you enable the patients to control their health records including access, disclosures,'minimum necessary' standard, consent and authorization, etc.

Business Associates and Partners. Do you maintain up-to-date contractual agreements with all business parties AND do you audit their compliance?

Auditing. Do you maintain on-site and off-site capability to retrieve pertinent records (including patient medical records with the disclosure/access trail) within the specified timeframes and will it be maintained for the requisite period?

Documentation. Do you have all the necessary policies documented and are they followed,enforced, taught to employees, etc.?

Certification and Maintenance. Who is your certification entity, what was the certification procedure, what standards were applied, and is it periodically reviewed, updated, and maintained?


I recommend the ISAlliance's "Common Sense Guide for Senior Managers: Top Ten Recommended Information Security Practices." Please follow the link below to the online version (.pdf).

https://www.isalliance.org/news/BestPractices.pdf


Sanjay Garg