6.6. ERMUSR 05-16-2006 - Laserfiche WebLink

Home Browse Search

a. Periodically evaluate this Policy and the procedures implemented to protect ePHI. The Security Official will maintain reasonable and appropriate policies and procedures to comply with the HIPAA Security Standards and make appropriate changes when necessary. § 164.308(a)(8), § 164.316(a) b. Regularly review the activity of any information systems involved in the maintenance or transmission of PHI to determine if ePHI has been used or disclosed in an inappropriate manner as required by § 164.308(a)(1)(ii)(D). c. Report to appropriate Plan Administrator and/or corporate office of Plan Sponsor any suspected or known security incidents as defined by § 164.308(a)(6)(ii). 4. Workforce Security [§164.308(a)(3) and §164.308(a)(4), §164.312(d)] Employee authorization to access systems that maintain or transmit ePHI, including determination of appropriate employee clearance level, person authentication, and effective and timely termination of system access for employees who no longer qualify for system access will be the responsibility of The Plan(s) Security Official. The Security Official may delegate these duties to appropriate parties based on exiting plan sponsor information system access policies and procedures. The Plan(s) and Plan Sponsor do not perform clearinghouse functions as defined by HIPAA so no procedures are necessary to meet security standards defined in § 164.308(a)(3)(ii)(B). 5. Security Awareness and Training The Plan(s) will require any employee of The Plan(s) or Plan Sponsor who is involved in the administration or management of The Plan(s) to certify in writing that they have received training and have read and understood The Plan's Security Policy. Employees will also be provided additional existing Plan Sponsor security training when available and appropriate. This training may include (but not be limited to) security reminders, protection from malicious software, and log-in monitoring if The Plan Sponsor has existing procedure to identify inappropriate system access attempts. Employees will be trained on procedures for creating and maintaining appropriate and effective passwords consistent with existing Plan Sponsor information system password policies and procedures. At least once per year, The Plan's Security Officer will review the Security Policy with individuals involved in the administration and management of The Plan(s). 6. Contingency Plan Data Backup Plan and Application and Data Analysis [§164.308(a)(7)(ii)(A), §164.308(a)(1)(ii)(E), §164.310(d)(2)(iv)]