Security And Controls Director At A Publicly Traded Hospital System

Critical “1” risk, threats, and vulnerability User Domain Risks Threats, and Vulnerabilities Risk Impact/Factor None Critical

Issue 4: Information Security officials failed to effectively trigger appropriate notifications and begin an investigation of the stolen data. The information security official’s incident report contained omissions and significant errors. This resulted in missed opportunity to re-create the contents of the laptop and external drive and to recognize the severity of the potential loss of data. The cybersecurity operations officials failed to ensure a timely investigation and notifications were made regarding the severity of the lost data (Opfer, 2006).

Joint Commission International, Centers for Medicare and Medicaid Services (CMS), Lab is accredited by College of American Pathologist (CAP) (K.E., personal communication, 2016).

Based on the premises that Richman has 5000 employees throughout the main office and several branch offices, this document dictates research solutions and details the appropriate access controls including policies, standards, and procedures that define who users are, what they can do, which resources they can access, and which operations they can perform on a system. |

Lab #1 – Part A – List of Risks, Threats, and Vulnerabilities Commonly Found in an IT Infrastructure

The College of American Pathologists or CAP is the accrediting organization for laboratory and testing personnel. CAP’s “accreditation process is so thorough, the Joint Commission [and CMS] accepts …their standards” in place of conducting their own survey of the hospital’s laboratory and personnel (Gartee, 2011, p. 47). This is because of the guidelines they follow to maintain their integrity and to remain the industry standard. In recent years, the “CAP [has] developed new check list” for continued improvements. Additionally, they are continuing to vet the requirements for the new next-generation sequencing or NGC-based test that is speeding laboratory procedures. So much so that the recent adoption of the new technology for clinical testing” was done prior to the new standards being approved (Aziz, et.al. 2015, p. 481).

access or use of patient information, detect threats and intrusion attempts, and assist with evaluating the effectiveness of WHINs security policy (AHIMA, 2011, p. 46).

Other security elements are in reference to data recovery, database administration, handling a breach in security and administrative security policies such as access procedure, employee transfer and excessive user access. As I assume the role of the chief security officer, database designer, database administrator, and chief applications designer this project is very important to the armed services and the Virgin Islands National Guard as we strive to provide global security.

Robin R. Nelson, MSA, patient relations manager, privacy officer, and recipient rights director is responsible for monitoring and assuring the facilities compliance with regulations pertaining to the privacy of patient records. Robin has a bachelor’s degree in Health Administration; a master’s in Public Health Administration and holds a registration in social work. She had originally intended to work in substance abuse, counseling, education, however according to her “it wasn’t a right fit” so transferred over to long-term care and worked as a an admissions manager. It was there, she established her relationship with MidMichigan health. When the patient relations director retired, she applied and got the job and has been working for MidMichigan Health since.

Numerous steps have been taken to maintain HIPAA compliance in the HIM Department. The facility utilizes Cerner electronic health record. This vendor is HIPAA compliant with security measures built into the software. Additionally there are other technical and physical security measures in place. No individual that is not an employee can enter the HIM Department. All employees have access cards to access areas they are employed in. Additionally, all employees have to log on to their workstation with their access cards and unique passwords.

I evaluate security control test plans and conducts detail security assessments of information systems that evaluate compliance of administrative, physical, technical, and organizational polices safeguards in order to maintain HIPAA compliance base on the Office of Civil Right (OCR) protocol, NIST SP 800-66 Rev1 and security controls (NIST SP 800-53).

College of American Pathologists (CAP) accreditation helps laboratories meet Clinical Laboratory Improvement Amendments (CLIA) regulatory requirements and certifies compliance through the guidance a complete list of the most recent clinical and laboratory standards. By doing this it ensures accuracy of lab results and maintains correct patient diagnosis. This increases the value of the laboratory. The CAP accreditation program is based on peer based inspections that use working laboratory professionals who are qualified through a CAP training program. It is the responsibility of the laboratory supervisors, managers, and directors to attend this training and participate in the CAP accreditation process.

Each medical and research facility will have sensitive equipment and data. There are many different stakeholders who invest and depend on the accountability of the all the equipment at all times (Washington University). The CISO’s will need too implement accountability over the equipment and data in each of the medical and research facilities. The following, which will need to be addressed in each of the policies, will be as follows

Security Officers must obtain a consensus for which mitigating controls are key, which can be a trying negotiation between the CISO, Chief Technology Officer, Cyber Threat Intelligence (CTI), Infrastructure Engineering, Audit and Assurance teams, and the Investment and Audit committees. How do you harness your entire organization to focus on a common agreed-upon list of key security controls?

In order to effectively implement security governance, the Corporate Governance Task Force (CGTF) recommends that organizations follow an established framework, such as the IDEAL framework from the Carnegie Mellon University Software Engineering Institute. This framework, which is described in the document “Information Security Governance: Call to Action,” defines the responsibilities of (1) the board of directors or trustees, (2) the senior organizational executive (i.e., CEO), (3) executive team members, (4) senior managers, and (5) all employees and users. This important document can be found at the Information Systems Audit and Control Association (ISACA) Web site at www.isaca.org/ContentManagement/ContentDisplay.cfm?ContentID=34997.