Cyber Security

HIPAA Security

Cyber Security Compliance

Not compliant

HIPAA Security Overall

Security

Data and ePHI Storage

Written policy and procedures are in place for appropriate methods for deleting ePHI from devices or after retention requirements.

Read more: Delete All Stored Health Information On Mobile Device FAQ

A written policy exists and is followed that states Electronic PHI (and paper) records are retained for a minimum of 10 years or until the patient reaches the age of 22 (whichever is longer), or longer if practice is aware of a potential claim.

Read more: How Long To Keep Medical Records, Record Retention, Maintaining, Copying, and Destroying Your Patient Records

All electronic PHI is backed up regularly, and backups are properly maintained safe and secure off-site or via HIPAA compliant cloud storage.

Read more: HIPAA Security 101 for Covered Entities, HIPAA Administrative Safeguards, Guide on HIPAA and Cloud Computing

Written procedure and policy is in place to perform regular backups. Backups should be performed at reasonable frequency (continual, hourly, daily, weekly, or monthly) based on your practice environment.

Read more: HIPAA Administrative Safeguards, Guide on HIPAA and Cloud Computing

Written procedures to create and maintain retrievable exact copies (backups) of electronic protected health information (ePHI) are established and implemented.

Computer Systems and Network Components

Each device that connects to the practice network or has access to ePHI has been examined to ensure the operating system is up to date. This includes desktop computers, laptops, tablets, mobile phones, and other mobile devices.

Read more: HIPAA Security Rule Compliance, HIPAA Security Rule Guidance

A written policy [1] exists that limits access to administrative passwords and requires administrative passwords for all routers, access points, and modems to be changed when employee(s) with previous access to those passwords leave the employment of the practice.

Read more: FTC Safeguard of Personal Information (Twitter case)

All routers, access points, and modem passwords have been changed from the original default passwords.

Read more: IT Asset Inventory FAQ, Health Industry Cybersecurity Practices

Anti-virus software are enabled on all devices that connect to the practice network or have access to ePHI. This includes desktop computers, laptops, tablets, mobile phones, and other mobile devices.

Wifi, Router, and Firewall Protections

Firewalls are enabled on all devices that connect to the practice network or have access to ePHI. This includes desktop computers, laptops, tablets, mobile phones, and other mobile devices.

Read more: Firewall FAQ, HIPAA Security Rule Compliance

All available patches for routers and hardware firewall devices are installed.

Read more: Firewall FAQ, HIPAA Security Rule Compliance

Written policy [1] in place that prohibits devices that have access to or that store ePHI from connecting to public Wifi or other untrusted networks.

Read more: Mobile Device Security Checklist

Wifi networks that transmit ePHI are armed with passwords that are not shared with non-employees. These passwords should have appropriate levels of password complexity, periodic password changes, and be masked when entered by users.

Read more: Mobile Device Security Checklist

Written policy [1] in place that prohibit employees from sharing Wifi access and passwords with anyone unauthorized to have access to ePHI.

Read more: Mobile Device Security Checklist

Wifi router(s) and access point(s) are business class, and encryption is turned on.

Read more: HIPAA Security Rule Compliance, HIPAA Security Rule Guidance, Install and Enable A Firewall FAQ