Social Network Security Reminder Workforce members are not allowed to access social networking sites company-owned equipment. Yet, you might access these sites from your personal computing devices. If so, here are some security tips: Don’t click links if you’re unsure of the destination. Check the domain to make sure it’s [...]

Keep Physical Assets Secure Assets like files, computing equipment, and information must be secure. The EHR system must be safe from unauthorized access. The single most common way that PHI is compromised is through the loss of devices themselves, either through theft or accidentally. Incidents reported to the HHS Office [...]

Security Reminders HIPAA 164.308(a)(4) Security Reminders Questions an Auditor may ask you (from NIST 800-66): What methods are available or already in use to make or keep employees aware of security, e.g., posters or booklets? Is security refresher training performed on a periodic basis (e.g., annually)? Is security awareness discussed with all new [...]

Mobile Phone Use If you are authorized to use your cell phone/smartphone for business, remember: Password-protect your device. Cell phone conversations should not occur in any area where patients or visitors are present. Cell phones should be turned off or set to silent or vibrate mode during meetings, conferences and [...]

Electronic Media Disposal We all need to ensure that we are careful when transporting or disposing of any type of electronic device. Consider what information might be stored on that media. Know your company’s policy for electronic media disposal.  For example: all workforce members should direct the disposal of all [...]

Do Not Install Unauthorized Programs Malicious applications often pose as legitimate programs. They aim to fool you into installing the program which then infects your computer. And if your computer is infected, that infection could spread throughout the network. Do not install programs unless they are authorized by Information Security. [...]

Shred Paper PHI Shred copies of sensitive information when disposing – do not simply toss them in the trash. Cross-cut shredders are very useful in making printed sensitive information both unreadable and unusable. Or place in locked shredder bins which may be located throughout your facility. Remember to shred any [...]

Use Email Encryption Encryption is a procedure that scrambles information in a way that is decipherable only to authorized individuals or computers. Encryption should be used whenever sensitive data is at rest or in transition – email, electronic file transfers, laptops, USB drives, CDs, etc. Encryption is used when visiting [...]

Computer Security Log out of and lock your computer when stepping away, even for a moment. For a quick way to lock your PC, press Windows Key + L. Forgetting to log out poses a security risk with any computer that is accessible to other people because it leaves your [...]

Identify the Risk Groups and Safeguard PHI Sensitive information, such as PHI and PII, is a critical asset within a health care organization. Identifying the risk groups helps clarify operational context and reveals potential vulnerabilities across the IT infrastructure. By doing this, we establish clear priorities for making security investments [...]