MedStack Technology Compliance Policies

Awareness, training, and reminders

Foster awareness of compliance

• Provide security reminders based on compliance training materials.
• Attend privacy and security conferences.
• Maintain awareness of new and evolving security threats.

Notify users of their responsibilities

• to protect their credentials (passwords)
• to apply information security in accordance with our policies

Provide compliance training that is clear and complete

• To
  • all employees
• When
  • during the new employee orientation period
  • before access is permitted to production systems
  • annually
• Train on
  • what is compliance and what compliance frameworks we follow
  • third party regulations on health data privacy and security
  • our internal information privacy and security policies and procedures
  • the duties and responsibilities of specific individuals, workgroups, departments, and divisions
  • security basics such as password management, malware protection, social engineering and phishing
• Maintain training records
  • including the training done and when it was done

Run simulated tabletop information security incident training

• annually or when the threat environment changes significantly
• for employees with operational PHI access

Third-party resources

• Use recognized independent third-party resources where possible.

Enforcement

• Responsible party: All managers and supervisors
• sanctions: standard

References