Small Pharmacy Risk Analysis

The primary purpose of this Risk assessment report is to identify the threats and vulnerabilities that are possible in an IT system domain called Electronic Medical Record (EMR) throughout its lifecycle. The Risk Assessment plan is needed for this Fictional Enterprise (Medco) as this uses the automated information to deal with the patient records and to process this information with the patient record for better use of their mission, risk management plan plays an important role in protecting the organization’s information assets. This report will provide the detailed summary of possible

Walgreens Pharmacy operates in an Oligopoly market structure. The retail pharmacy environment also has the Oligopoly characteristic of significant entry barriers. The barriers are restriction of ownership and restriction of where the business can be established (Walgreens). The ownership barriers are established by the government and state only Pharmacists or an incorporated company that has directors and shareholder members that are registered pharmacists are allowed to open and own a pharmacy. Licensed pharmacists are required to be on duty during the hours of operations.

We also need a more secure software to keep those who are not authorized from accessing the system. One of the ways we can achieve this is by making sure the software that we have is only accessible by the staff from audit department and not our normal hospital employees (Loshin, 2011). The software also needs to be designed that once the data has been retrieved for an audit, it can no longer be changed unless it is approved through the chain of command.

Some include administrative, physical and technical safeguards. In administrative safeguards it allows the reader to understand the security management process to reduce risk and vulnerabilities. Security personnel responsible for developing and implementing security policies. Information access management minimum access to perform duties. Physical safeguard is about the limit of physical access to facilities, and how workstation and device security policies and procedure covering transfer, removal, disposal, and reuse of electronic media. Finally, technical safeguard is about the access control that restricts access to authorized personnel’s. Audit controls for hardware, software, and transitions. Integrity controls to ensure data is not altered or destroyed. Transmissions security to protect against un authorized access to data transmitted on network and via email. Moreover, there are three pillars of data security confidentiality, availability, and integrity. Confidentiality refers to the prevention of data loss, and is the category most easily identified with HIPAA privacy and security within healthcare environments. Usernames, passwords, and encryption are common measures implemented to ensure confidentiality. Availability refers to system and network accessibility, and often focuses on power loss or network connectivity outages. Integrity describes the trustworthiness and permanence of data, an assurance that the lab results or personal medical history of a patient is not modifiable by unauthorized entities or corrupted by a poorly designed process. Database best practices, data loss solutions, and data backup and archival tools are implemented to prevent data manipulation, corruption, or loss; thereby maintaining the integrity of patient

Jean, a former pharmacist, is now the network administrator for the LM Pharmacy in the town of Paris, Virginia. His duties include enabling the electronic transfer of information between health care providers (i.e., doctors and hospitals), patients, and the pharmacy itself. One of Jean’s most important responsibilities is to protect health information in accordance with federal law and the pharmacy’s privacy policy.

Pharmacy owners and managers should have policies and procedures in place to handle a DEA investigation, well before one happens. Being prepared will make the DEA investigation go faster and smoother. It will protect the pharmacy, pharmacists, and other personnel. It will keep the pharmacy and its operations within legal parameters.

As an information security officer for a small pharmacy there are a few things that need to be addressed. As with all companies it is top priority to make sure that the data that is input into the machines stays safe and to make sure that the people using the computers know it is their responsibility as well. As a security officer my supervisor has asked me to identify any inherent risks associated with the pharmacy and establish any physical and logical access control methods that will mitigate the risks identified.

This paper will present a report that will assist with determining the controls required to implement to ensure that data are secure for the Northcentral University. This paper will summarize the security breaches of the Target Store Corporation over the previous year and make recommendations in the form of information technology security best practices to strengthen the University’s infrastructure.

Physical security will involve the company securing its assets by devices such as alarm system for off hour use, and identification cards for employees. A process should be in place to make sure that guests are properly identified before gaining assess to the facility. Users cannot take computer home unless they are protected by encryption software. Downloading proprietary information onto floppies, CD, thumb/flash/memory drives and other portable media should be disallowed unless such transactions are pre-approved and proper security measures are taken.

What can a pharmacy technician do if they encounter one of these situations, as a leader in health care, encourage being proactive. Also the national patient safety goal will be required, and identify how

The security plan is formulated to protect the information and important resources from a wide variety of potential threats. This will promote business continuity, reduce business risks and increase the return on investment together with business opportunities. The security of information technology is attained by executing a suitable set of control, efficient policies, processes, organization structures, software and the hardware. These given controls ought to be formulated, put into action, assessed, analyzed and developed for productivity, where necessary. This will allow the explicit security and business objectives of the United States Department of health and Human Services to be accomplished (Easttom, 2006, p.32).

Is there an approved, limited list (locked formulary) of Medications with escalation procedures to order outside the limited, approved list? •YES • NO

Information security is the protection of information against accidental or malicious disclosure, modification or destruction. Information is an important, valuable asset of IDI which must be managed with care. All information has a value to IDI. However, not all of this information has an equal value or requires the same level of protection. Access controls are put in place to protect information by controlling who has the rights to use different information resources and by guarding against unauthorised use. Formal procedures must control how access to information is granted and how such access is changed. This policy also mandates a standard for the creation of strong passwords, their protection and frequency of change.

Information security and privacy is occupying a most important role in the healthcare territory in order to deliver protected information process to their patients (Appari, & Johnson, 2010). As healthcare department is the organization with vast data and essential information the hospitals has to keep a useful information security technique in their enterprise process (Mishra et al., 2011). Information security is one such phase in the healthcare sphere which is extremely problematic to describe and evaluate even to the individuals who are working on the process. In the healthcare organization, information is of many types which required for the work and even the security is a main control for almost all the practices which are transmitted out in the healthcare field (Appari, & Johnson, 2010). Hospitals, in specific, have been instructed to create a new set of security specialists to protect healthcare data tools techniques upon which exists may rely. Healthcare data is very critical for patients because it is very confidential records. If a medical apparatus is filled with a computer virus it can even exemplify a possibility to patients ' lives. Hence, hospitals should design alertness of the risk, to defend against concerns to healthcare databanks and be concerned about the high risk of infected computers or medical tools being connected to their networks (Mishra et al., 2011).

In the Workstation Domain security controls are one of the biggest challenges. Physical security threats are concerns associated more with attackers who gain physical access to the premises. The attackers can cause physical destruction of equipment or sabotage the equipment. The attacker can sabotage the system if the attacker has sufficient knowledge of the system, such as a former employee, and gains access to the system and then renders the system unusable, or deletes and changes information.