Please rate the impact of a threat/vulnerability affecting your ePHI: Low Medium High Overall Security Risk: Low Medium High Related Information: Things to Consider to Help Answer the Question: A “user” can be any entity that accesses your practice’s ePHI, whether it is a person or a device. Consider whether your practice: Defines roles and responsibilities in sufficient detail to demonstrate whether access to ePHI is necessary. Determines whether remote access is necessary from physical environments that are not under your practice’s control. If so, determine by whom, how (e.g., electronic device), and when. Possible Threats and Vulnerabilities: If your practice does not analyze activities performed by your workforce and service providers, you not be able to identify the minimum necessary level of access necessary for ePHI. Some potential impacts include: Human threats, such as a workforce member or service provider with excessive access privileges, can compromise the privacy, confidentiality, integrity or availability of ePHI. Unauthorized disclosure (including disclosure through theft or loss) of ePHI can lead to identity theft. Accurate ePHI might not be available, which can adversely impact a practitioner’s ability to diagnose and treat the patient. Examples of Safeguards:
Low Medium High Related Information: Things to Consider to Help Answer the Question: Logoff refers to a user logging off of the system. Information system refers to an interconnected set of information resources under the same direct management control that shares common functionality. A system normally includes hardware, software, information, data, applications, communications, and people. Electronic devices include nonstationary electronic apparatus with singular or multiple capabilities of recording, storing, and/or transmitting data, voice, video, or photo images. This includes but is not limited to laptops, personal digital assistants, pocket personal computers, palmtops, MP3 players, cellular telephones, thumb drives, video cameras, and pagers. Many software applications and devices are able to engage a screen lock or terminate a session when the user is inactive for a period of time. This capability is designed to limit access to the device or software and the ePHI can be recalled, modified, transmitted, and stored. Evaluate your practice to determine if its information systems and electronic devices have an automatic log off function and how it can be activated. Possible Threats and Vulnerabilities: Your practice might not be able to protect, secure and control access to its ePHI if it does not enforce automatic logoff procedures that terminate an electronic session after a predetermined period of inactivity. Some potential impacts include: Human threats, such as personnel with unauthorized access, can compromise the privacy, confidentiality, integrity or availability of ePHI. Unauthorized disclosure (including disclosure through or loss) of ePHI can lead to identity theft. Examples of Safeguards:
Below are some potential safeguards to use against possible threats/vulnerabilities. NOTE: The safeguards you choose will depend on the degree of risk and the potential harm that the threat/vulnerability poses to you and the individuals who are the subjects of the ePHI. Implement hardware, software, and/or procedural mechanisms that record and examine activity in information systems that contain or use ePHI. [45 CFR §164.312(b)] Document and disseminate an audit and accountability policy that addresses purpose, scope, roles, responsibilities, management commitment, compliance, procedures, and the coordination necessary among organizational entities to implement the audit. [NIST SP 800-53 AU-1] Identify and categorize key audit events (e.g., those that create, store, and transmit ePHI) as high, medium or low risk. Identify those that are significant to the security of information systems and the environments in which those operate in order to meet specific ongoing audit needs. [NIST SP 800-53 AU-2] T26 - §164.312(b) Standard Does your practice use the evaluation from its risk analysis to help determine the frequency and scope of its audits, when identifying the activities that will be tracked? Yes No If no, please select from the following: Cost Practice Size Complexity Alternate Solution Please detail your current activities:
Unauthorized access can go undetected and your practice not be able to reduce the risk to the privacy, confidentiality, integrity or availability of ePHI. Unauthorized disclosure (including disclosure through and loss) of ePHI can lead to identity theft. Accurate ePHI is not available, adversely impacting the practitioner’s ability to diagnose and treat the patient. Examples of Safeguards: Below are some potential safeguards to use against possible threats/vulnerabilities. NOTE: The safeguards you choose will depend on the degree of risk and the potential harm that the threat/vulnerability poses to you and the individuals who are the subjects of the ePHI. Implement a mechanism to encrypt ePHI whenever deemed appropriate. [45 CFR §164.312(e)(2)(ii)] Develop, document, and disseminate to workforce members a system and communications protection policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and procedures to facilitate the implementation of the system and communications protection policy and associated system and communications protection controls. [NIST SP 800-53 SC-1] T45 - §164.312(e)(2)(ii) Addressable When analyzing risk, does your practice consider the value of encryption for assuring the integrity of ePHI is not accessed or modified when it is stored or transmitted? Yes No If no, please select from the following: Cost Practice Size Complexity Alternate Solution Please detail your current activities: