MedStack Technology Compliance Policies

Software development and operations

Applicability

• people: This policy applies to all employees, contractors, suppliers and vendors who develop software that interacts with PHI.

To conduct software development and operations

• Perform these activities
  • Define operational procedures and responsibilities
  • Control operational software and authorize changes
  • Acquire, develop, test, document and maintain systems
  • Implement security requirements for information systems
  • Protect data used for testing
• On these entities
  • configurations
  • infrastructure
  • data
  • software

Implement all operations activities as software development

• Make all changes to operational systems by
  • modifying source code
  • executing the source code
  • using automated tools
• Use software development methods to
  • test development, staging and operational systems
  • ensure that performance matches expectations
  • document software and processes (where they are not self-documenting)
  • log modifications to the systems

Make security a key part of software development and operations

• Design and develop systems to be secure
  • Design using Privacy by Design and Security by Design.
  • Develop using security best-practices (e.g. OWASP).
  • Use secure development environments.
  • Avoid unnecessary changes.
  • Design systems to be continuously auditable and testable.
• Scan and test operational systems applications for vulnerabilities
  • Scan operational systems for security flaws.
  • Commission third-party network scans.
  • Commission third-party penetration tests.
• Manage vulnerabilities
  • Document, review and manage vulnerabilities.
  • Monitor security news for new vulnerabilities.

Control changes to software and systems

• Use a source control system
  • to control changes to software
  • to manage access to source code
• Control and automate the deployment of software to production
  • Peer review new and modified software before deployment to production.
  • Use a continuous deployment system.
• In case of emergency changes outside of the normal process
  • document the changes made
  • incorporate the changes back into the normal process
• Use the principle of least privilege
  • Grant software the minimum necessary access to perform its function.
  • Limit only production engineers to have access to production systems.

Operate reliable systems with appropriate redundancy and availability

Perform testing of software

• Automate testing in a secure manner
  • Implement automated tests of systems.
  • Perform testing primarily on non-production systems.
  • Do not use real data or PHI for testing or demonstrations.
• Test for
  • regressions
  • security flaws
  • acceptance criteria

Have PHI only on production systems

• Do not copy PHI to non-production systems
  • only production systems are secured and managed correctly to handle PHI
• If PHI is on a non-production system
  • Evaluate the security of the non-production system (e.g. a secure workstation).
  • Securely delete the data as soon as possible.
  • Report the incident.

Do not outsource software development and operations

• All development and operations is performed by employees or contractors directly managed by employees.

Respect Intellectual Property Rights and licenses

• Identify and comply with IPR for source code of external origin (including open source software).
• Identify and comply with IPR for software tools (including open source software).

Enforcement

• Responsible party: All managers and supervisors
• sanctions: standard

References