Specific Security Policy

Passwords should be designed to prevent them from being discovered by unauthorized persons. All passwords should have at least eight (8) characters. The user-IS should never be used as the password. Words in dictionary, derivates of user-IDs, and common character sequences such as “123456789” should not be employed.

Discuss security standards and methods, including the need for data storage integrity and data backup and recovery. In addition to complying with Health Insurance Portability and Accountability Act (HIPPA), SMC needs to be valiant in how the organization will protect information and manage network security. Information security is the protection of information against risk to its integrity, inadvertent disclosure, or availability (Hawkins, 2013a). The most common threats an organization's network will face are hackers, spyware, viruses, worms, Trojan horses, and malicious insider (Hawkins, 2013a). To protect SMC from hackers, they will use firewalls and intrusion-detection devices. Firewalls protect network systems by obstructing unauthorized entry while allowing approved communications (Hawkins, 2013a). Intrusion-detection systems monitor who the user is and what the user accesses. To promote HIPPA, SMC will track the last names of users who accessed patients with the same last name to reveal inappropriate use of client information.

Risk Management or Assessment To lessen the exposure of the corporate network to outside sources, there are many matters to consider. Areas of concern with the VPN client that should be addressed include: the potential hazards of the “always connected” nature of broadband Internet connections, installation of personal firewalls, antivirus software, and the remote PC itself. Analysis of the client PC begins with the PC itself. It is recommended that security policy require the VPN host to be company issued equipment, rather than using the existing user’s personal property. This eliminates problems associated with mixing business and personal information. When under company ownership it is easier to require the end user to comply with policy, and insist the PC be used only for business-related purposes. As the hardware is company-owned, users will not be given administrator account rights on their desktop machines. Controlling user activity as well as checking and maintaining desktop integrity is very difficult (if not impossible) when users have complete control through administrator rights. Company provided hardware also serves to minimize management issues, as the computer should remain relatively static - with no unauthorized software installations, end-user configuration changes or device conflicts to troubleshoot, support calls are reduced. In addition to

The Licensee has the following controls are in place to secure sensitive customer information. Access controls are in place to limit user access to sensitive customer information. Access to physical data is under lock and key with limited access to IT administrators. Doors are closed and locked when IT room is not occupied. All workstations require LDAP access via Microsoft Active Directory and Data backups are located off site and locally.

i. Use of technology to bypass authorized remote access mechanisms (e.g. VPN) is strictly prohibited. For example, use of remote control software and applications such as PC anywhere or GoToMyPC.com to bypass VPN or Citrix access mechanisms is not permitted.

* Review the results of a qualitative Business Impact Analysis (BIA) for a mock organization

This policy applies to all the employees of XYZ health care who have remote access to the patient’s medical data.

As an information security officer for a small pharmacy there are a few things that need to be addressed. As with all companies it is top priority to make sure that the data that is input into the machines stays safe and to make sure that the people using the computers know it is their responsibility as well. As a security officer my supervisor has asked me to identify any inherent risks associated with the pharmacy and establish any physical and logical access control methods that will mitigate the risks identified.

“Employees are required to secure their personal workstations when not in use. Confidential health information must not be displayed on computer screens unless the employee is performing work functions on the computer and using the information. Employees may not access another employee’s computer while it is in use nor may employees use another’s password for any reason. Violation of this policy will result in disciplinary action, and depending upon nature of violation, termination may result.”

I used multiple office automation software with varied functions to produce a wide range of documents to provide miscellaneous clerical support. Machines and software used are standard business computers, laptops and tablets loaded eClincal  software for patient charting, electronic claim submission and practice financial reporting. Used external faxing devices. Used Microsoft Office Full Suite for all letter documentation and sorting financial reports from  eClinical. Used external copy machine. Used external electronic on-site deposit machine and software for daily check deposits to Bank.

National legislation and local guidelines influence the development of policies and procedures, which affect everyday work with children and young people.

Each medical and research facility will have sensitive equipment and data. There are many different stakeholders who invest and depend on the accountability of the all the equipment at all times (Washington University). The CISO’s will need too implement accountability over the equipment and data in each of the medical and research facilities. The following, which will need to be addressed in each of the policies, will be as follows

The fascination with technology and handheld devices impacts all of us at professional and personal level. I realize that electronic gadgets are very helpful, but at the same time, no one can deny the negative influence it has on quality of work performance. Therefore, to control inappropriate use of cell phones while caring for patients, the organizations must implement a policy outlining guidelines and rules of behavior related to BYOD. Correspondingly, every medical facility it is obligated to obtain HIPAA document signed by each employee to assure confidentiality of patient information and when a contract is broken one may be terminated on the grounds of illegal conduct. Therefore, the same way the BOYD policy should be introduced to all

When working in the healthcare system you have access to very important sensitive information. This information can be used to commit several crimes. An easy simple way to protect you and your patients are by using strong passwords. Strong passwords are considerably harder to crack or break and that’s even with the powerful password cracking software that is available today. Your health organization should have a mandatory password policy put in place. This policy will dictate that passwords must be strong, Is at least seven characters long, does not contain your user name, real name, or company name. Does not contain a complete dictionary word. Is significantly different from previous passwords, and also be changed after a set period of time.

A security policy is defined as the rules and regulations set forth by an organization, in this case, Booz Allen, guided by principals, standards, and guidelines for its effectiveness. (Kabay, & Robertson, 2009). Examples of security policies include acceptable use, network access, incident response, encryption, email, physical security, and mobile device. Booz Allen developed a framework for implementing security standards and controls for use of mobile devices (iOS) to protect against threats outlined in the National Institute of Standards and Technology (NIST) SP 800-88, R1, Defense Information Systems Agency (DISA), Security Technical Implementation Guide (STIG), and Defense Security Service and Industrial Security Field Operations (DSS ISFO) Manual, and National Security Agency (NSA/CSS 9-12). Once leaders define policy language and mandate compliance, user training oftentimes will follow where non-compliant employees consequently result in disciplinary action or even termination.