Information Security And Controls Director At A Publicly Traded Hospital System

Myranda Aguilar has been working in health care for 15 years and for the past two years she’s been working as a privacy analyst for Sutter Health located in Sacramento California. As a privacy analyst her duties are protection of patients’ privacy, compliance, and information security. Her responsibilities are to monitor and investigate any suspicious activity by taking a proactive standpoint against hackers, educate hospital staff on how to protect patients’ privacy, and ensure patients safety during their stay in the hospital. She works with elected board members of the health committee program she works for. One of the projects that she is currently working on is privacy auditing and monitoring where she tracks patients records to determine

There are many essential features found in a heath information system that are designed to protect patient privacy. For starters, at this candidate’s organization, every login is specific to an individual nurse and the

The fifth member of the team is the medical records manager. She has a bachelors in healthcare management. Her expertise with HIPAA rules and regulations is crucial. It is her job to evaluate security of the new systems to ensure that patient confidentiality is not breached. She will have input form other healthcare managers as well as others in the medical records department.

Joint Commission International, Centers for Medicare and Medicaid Services (CMS), Lab is accredited by College of American Pathologist (CAP) (K.E., personal communication, 2016).

Another step involves security checks upon implementation and describes agency-level threat to the business scenario or the mission. It similarly entails sanctioning the information system for processing and lastly constant monitoring of the security controls. FISMA and NIST's standards are aimed at offering the ways for agencies to achieve their identified missions with safety commensurate with the threat (United States Department of Agriculture, 2015). Together with guidelines from the Office of Management and Budget (OMB), FISMA and NIST create a framework for advancing and growing an information security scheme (SecureIT, 2008). Such framework includes control descriptions and evaluation, program development, and system certification and accreditation. The final objective involves conducting daily functioning of the agency and achieving the agency's articulated objectives with sufficient security commensurate with risk.

The College of American Pathologists or CAP is the accrediting organization for laboratory and testing personnel. CAP’s “accreditation process is so thorough, the Joint Commission [and CMS] accepts …their standards” in place of conducting their own survey of the hospital’s laboratory and personnel (Gartee, 2011, p. 47). This is because of the guidelines they follow to maintain their integrity and to remain the industry standard. In recent years, the “CAP [has] developed new check list” for continued improvements. Additionally, they are continuing to vet the requirements for the new next-generation sequencing or NGC-based test that is speeding laboratory procedures. So much so that the recent adoption of the new technology for clinical testing” was done prior to the new standards being approved (Aziz, et.al. 2015, p. 481).

The MSMC has established the mission, vision, and values statements within their organization, which is extremely important to them because of the importance of management. Both Larry and Sarah must believe in these core values because of the improvement in privacy and safety for their organization. The purpose should be to sustain and establish patients’ needs in a well-defined mission, vision, and value statement. Larry and Sarah must work together with culture groups or teams to provide patients with their ideal care. This aspect of care may connect with different organizational branches to create a strong relationship with their local community as they devise ways to implement an effective standard based system that ensures safety. Hence,

access or use of patient information, detect threats and intrusion attempts, and assist with evaluating the effectiveness of WHINs security policy (AHIMA, 2011, p. 46).

Other security elements are in reference to data recovery, database administration, handling a breach in security and administrative security policies such as access procedure, employee transfer and excessive user access. As I assume the role of the chief security officer, database designer, database administrator, and chief applications designer this project is very important to the armed services and the Virgin Islands National Guard as we strive to provide global security.

The operating system planning process should consider the categories of users on the system, and the privileges they have.

Numerous steps have been taken to maintain HIPAA compliance in the HIM Department. The facility utilizes Cerner electronic health record. This vendor is HIPAA compliant with security measures built into the software. Additionally there are other technical and physical security measures in place. No individual that is not an employee can enter the HIM Department. All employees have access cards to access areas they are employed in. Additionally, all employees have to log on to their workstation with their access cards and unique passwords.

I evaluate security control test plans and conducts detail security assessments of information systems that evaluate compliance of administrative, physical, technical, and organizational polices safeguards in order to maintain HIPAA compliance base on the Office of Civil Right (OCR) protocol, NIST SP 800-66 Rev1 and security controls (NIST SP 800-53).

The CISO will face several challenges while implementing an information security governance program since management as well as employee are novel to such environment.

Security Officers must obtain a consensus for which mitigating controls are key, which can be a trying negotiation between the CISO, Chief Technology Officer, Cyber Threat Intelligence (CTI), Infrastructure Engineering, Audit and Assurance teams, and the Investment and Audit committees. How do you harness your entire organization to focus on a common agreed-upon list of key security controls?

In order to effectively implement security governance, the Corporate Governance Task Force (CGTF) recommends that organizations follow an established framework, such as the IDEAL framework from the Carnegie Mellon University Software Engineering Institute. This framework, which is described in the document “Information Security Governance: Call to Action,” defines the responsibilities of (1) the board of directors or trustees, (2) the senior organizational executive (i.e., CEO), (3) executive team members, (4) senior managers, and (5) all employees and users. This important document can be found at the Information Systems Audit and Control Association (ISACA) Web site at www.isaca.org/ContentManagement/ContentDisplay.cfm?ContentID=34997.