Cyber Security

HIPAA Security

Cyber Security Compliance

Not compliant

HIPAA Security Overall

Security

Data and ePHI Storage

Written policy and procedures are in place for appropriate methods for deleting ePHI from devices or after retention requirements.

Read more: Delete All Stored Health Information On Mobile Device FAQ, Ask Paxson?

A written policy exists and is followed that states Electronic PHI (and paper) records are retained for a minimum of 10 years or until the patient reaches the age of 22 (whichever is longer), or longer if practice is aware of a potential claim.

Read more: How Long To Keep Medical Records, Record Retention, Maintaining, Copying, and Destroying Your Patient Records, Ask Paxson?

All electronic PHI is backed up regularly, and backups are properly maintained safe and secure off-site or via HIPAA compliant cloud storage.

Read more: HIPAA Security 101 for Covered Entities, HIPAA Administrative Safeguards, Guide on HIPAA and Cloud Computing, Ask Paxson?

Written procedure and policy is in place to perform regular backups. Backups should be performed at reasonable frequency (continual, hourly, daily, weekly, or monthly) based on your practice environment.

Read more: HIPAA Administrative Safeguards, Guide on HIPAA and Cloud Computing, Ask Paxson?

Written procedures to create and maintain retrievable exact copies (backups) of electronic protected health information (ePHI) are established and implemented.

Read more: HIPAA Security Guidance, Ask Paxson?

Business Associate Agreements are in place with HIPAA compliant cloud based backup companies (check box if utilizing other forms of backup).

Read more: Guide on HIPAA and Cloud Computing, Ask Paxson?

All backups are encrypted and passwords and/or encryption keys are accessible only to appropriate personnel.

Read more: HIPAA Technical Safeguards, Ask Paxson?

Backups should be tested regularly to ensure the backup is not corrupted and continues to be accessible.

Read more: Guide on Privacy and Security of EHI, Ask Paxson?

Written policy is in place outlining steps to take if and when a breach occurs.

Read more: Submitting a HIPAA Breach Notice , Cyber Attack Response FAQ, Ask Paxson?

Written facility access control policies are in place that limit and monitor physical access to medical records, PHI, and ePHI including network devices, routers, firewalls, servers, and workstations.

Read more: HIPAA Physical Safeguards Standards, Summary of HIPAA Security Rule, Ask Paxson?

Written policies and procedures are in place that address sending unencrypted email and/or require the use of encrypted email only that guards against unauthorized access to ePHI.

Read more: Can Health Care Providers Use Email to Communicate with Patients?, Does the Security Rule Allow PHI To Be Sent Via Email?, Ask Paxson?

Computer Systems and Network Components

Each device that connects to the practice network or has access to ePHI has been examined to ensure the operating system is up to date. This includes desktop computers, laptops, tablets, mobile phones, and other mobile devices.

Read more: HIPAA Security Rule Compliance, HIPAA Security Rule Guidance, Ask Paxson?

A written policy [1] exists that limits access to administrative passwords and requires administrative passwords for all routers, access points, and modems to be changed when employee(s) with previous access to those passwords leave the employment of the practice.

Read more: FTC Safeguard of Personal Information (Twitter case), Ask Paxson?

All routers, access points, and modem passwords have been changed from the original default passwords.

Read more: IT Asset Inventory FAQ, Health Industry Cybersecurity Practices, Ask Paxson?

Anti-virus software are enabled on all devices that connect to the practice network or have access to ePHI. This includes desktop computers, laptops, tablets, mobile phones, and other mobile devices.

Read more: Security Software FAQ, Ask Paxson?

Each device that connects to the practice network or has access to ePHI has been examined to ensure the anti-virus software is up to date. This includes desktop computers, laptops, tablets, mobile phones, and other mobile devices.

Read more: Security Software FAQ, Security Software Updates FAQ, Ask Paxson?

Anti-virus software specifications have been examined on every device and are capable of detecting, removing, and protecting against all known types of malicious software (i.e. viruses, trojans, spyware, adware, rootkits and encryption viruses installed). This includes desktop computers, laptops, tablets, mobile phones, and other mobile devices. Hint: Install the same software will all capabilities on all devices.

Read more: Security Software FAQ, Ask Paxson?

Written policy [1] in place that follows the HealthIT.gov guidelines for all mobile devices that have access to ePHI.

Read more: Protecting PHI On Mobile Device, How To Secure and Protect Helth Information on Mobile Device, Ask Paxson?

Wifi, Router, and Firewall Protections

Firewalls are enabled on all devices that connect to the practice network or have access to ePHI. This includes desktop computers, laptops, tablets, mobile phones, and other mobile devices.

Read more: Firewall FAQ, HIPAA Security Rule Compliance, Ask Paxson?

All available patches for routers and hardware firewall devices are installed.

Read more: Firewall FAQ, HIPAA Security Rule Compliance, Ask Paxson?

Written policy [1] in place that prohibits devices that have access to or that store ePHI from connecting to public Wifi or other untrusted networks.

Read more: Mobile Device Security Checklist, Ask Paxson?

Wifi networks that transmit ePHI are armed with passwords that are not shared with non-employees. These passwords should have appropriate levels of password complexity, periodic password changes, and be masked when entered by users.

Read more: Mobile Device Security Checklist, Ask Paxson?

Written policy [1] in place that prohibit employees from sharing Wifi access and passwords with anyone unauthorized to have access to ePHI.

Read more: Mobile Device Security Checklist, Ask Paxson?

Wifi router(s) and access point(s) are business class, and encryption is turned on.

Read more: HIPAA Security Rule Compliance, HIPAA Security Rule Guidance, Install and Enable A Firewall FAQ, Ask Paxson?

Cyber Security

Cyber Security Compliance

HIPAA Security Overall

Data and ePHI Storage

Computer Systems and Network Components

Wifi, Router, and Firewall Protections

What’s Next?

Congratulations!

Cyber Security

Cyber Security Compliance

HIPAA Security Overall

Data and ePHI Storage

Computer Systems and Network Components

Wifi, Router, and Firewall Protections

My Settings

What’s Next?

Congratulations!