Overview

Purpose

To define and document appropriate procedures and controls to protect the confidentiality and integrity of Sensitive information stored on Digital Media.

Scope and Applicability

This policy applies to all AI.io Incorporated Digital Media containing Sensitive information.

Policy Statement

AI.io Incorporated shall:

1. Implement procedures for the authorization and/or supervision of AI.io Incorporated Workforce Members who work with electronic protected health information or in locations where it might be accessed.
2. Implement physical safeguards for all workstations that access electronic protected health information, to restrict access to authorized users.
3. Implement policies and procedures that govern the receipt and removal of hardware and electronic media that contain electronic protected health information.
4. Implement policies and procedures to address the final disposition of electronic protected health information, and/or the hardware or electronic media on which it is stored.
5. Implement procedures for removal of electronic protected health information from electronic media before the media are made available for re-use.
6. Maintain a record of the movements of hardware and electronic media and any person responsible therefore.
7. Create a retrievable, exact copy of electronic protected health information, when needed, before movement of equipment.
8. Implement policies and procedures to protect electronic protected health information from improper alteration or destruction.

Procedures

Digital Media

1. Only authorized AI.io Incorporated Workforce Members are permitted to access Digital Media containing ePHI.
2. Digital Media must be managed and tracked throughout its lifecycle including acquisition, movement, and destruction.
3. Portable Digital Media, including USB storage and external hard drives are not authorized to store ePHI.
4. Only cloud storage approved by the Director of Cybersecurity and Corporate Compliance is authorized to store ePHI.

Backup Media

1. Backup media containing protected health information (PHI), personally identifiable information (PII), or other Sensitive information shall be encrypted.
2. Backup media must be stored in a secure manner or in a cloud solution that meets HIPAA standards.
3. Only personnel specifically authorized may access the backup media or secure cloud backups and records of that access must be maintained.
4. Cloud backups that are no longer used or needed, must be destroyed in accordance with applicable data sanitation procedures.

Media Transport

1. The physical transport of media containing ePHI is not authorized.

Media Sanitation

1. Cloud providers shall have media sanitation abilities in accordance with NIST 800-88 to provide a secure deletion of the data.
2. Records shall be maintained that track and document sanitization and disposal actions.

Review and Revision

1. Media Protection controls and procedures shall be periodically reviewed for appropriateness and effectiveness.

Enforcement & Exception Handling

Failure to comply with this policy, associated procedures and guidelines may result in disciplinary actions up to and including termination of employment or termination of contracts. Legal actions also may be taken for violations of applicable regulations and laws.

Request for exceptions to this policy must be submitted in writing. Prior to official approval of any exception, this policy must continue to be observed.

The Director of Cybersecurity and Compliance will be responsible for performing tests of the internal controls of this policy for adequacy and completeness.

Definitions

Digital Media – Means any electronic media used to store information in a machine readable format (ex. hard drives, random access memory, read only memory, tapes, CD’s, cloud storage, network equipment, etc.)

Portable Digital Media – Digital Media capable of storing information that can be used to transport information including external or removable hard drives, USB storage devices, CDs, DVDs and mobile computing devices capable of storing information including laptops, tablets, and smartphones.

AI.io Incorporated Workforce Member – Means employees and other persons whose conduct, in the performance of work, are under the direct control of AI.io Incorporated, whether or not they are paid by AI.io Incorporated. This includes full and part time employees, contractors, affiliates, associates, students, and volunteers.

Distribution

This policy will be distributed to applicable AI.io Incorporated Employees. All recipients of this policy must acknowledge their receipt and understanding of this policy by referring any questions or problems with the policy within ten days of the issue date to their immediate supervisor. If no questions or problems are stated, it will be assumed that the policy has been read and understood. All questions regarding this policy or its implementation may be referred to the Director of Cybersecurity and Compliance.

Applicable Regulations