Overview

Purpose

To implement security measures to restrict access to facilities and Information Systems from unauthorized physical access, tampering, theft, and physical damage, while ensuring that access by authorized workforce members is allowed.

Scope and Applicability

This policy applies to all facilities and Information Systems that house ePHI.

Policy Statement

AI.io Incorporated shall:

1. Implement policies and procedures to limit physical access to its electronic information systems and the facility or facilities in which they are housed, while ensuring that properly authorized access is allowed.
2. Establish and implement procedures that allow facility access in support of restoration of lost data under the disaster recovery plan and emergency mode operations plan in the event of an emergency.
3. Implement policies and procedures to safeguard the facility and the equipment therein from unauthorized physical access, tampering, and theft.
4. Implement procedures to control and validate a person’s access to facilities based on their role or function, including visitor control, and control of access to software programs for testing and revision.
5. Implement policies and procedures to document repairs and modifications to the physical components of a facility which are related to security (for example, hardware, walls, doors, and locks).

Procedures

General

1. Any ePHI stored or accessed by a AI.io Incorporated Workforce Member shall be stored in and/or accessed through Amazon Web Services (AWS).
2. Amazon Web Services (AWS) will assume all responsibility for physical access to the data center per the Business Associate Agreement.
3. No ePHI shall be saved or stored outside of the Amazon Web Services (AWS) environment.

Physical Access for Workforce Members

1. No AI.io Incorporated Workforce Member will have physical access to the Amazon Web Services (AWS) environment.

Contingency Operations

1. In the event of a disaster or other emergency, AI.io Incorporated shall move it’s data operations to another geo-redundant Amazon Web Services (AWS) location.

Review and Revision

1. The Director of Cybersecurity and Compliance shall review physical security on an annual basis.

Enforcement & Exception Handling

Failure to comply with this policy, associated procedures and guidelines may result in disciplinary actions up to and including termination of employment or termination of contracts. Legal actions also may be taken for violations of applicable regulations and laws.

Request for exceptions to this policy must be submitted in writing. Prior to official approval of any exception, this policy must continue to be observed.

The Director of Cybersecurity and Compliance will be responsible for performing tests of the internal controls of this policy for adequacy and completeness.

Definitions

ePHI– Protected Health Information that is stored in electronic format.

Information System – Means any combination of information technology and people’s activities that support operational, management and decision making processes. A system normally includes hardware, software, information, data, applications, communications, and people.

PHI – Protected Health Information. Means all individually identifiable health information held or transmitted by a Covered Entity or its Business Associate, in any form or media, whether electronic, paper, or oral.

AI.io Incorporated Workforce Member – Means employees and other persons whose conduct, in the performance of work, are under the direct control of the organization, whether or not they are paid by the organization. This includes full and part time employees, contractors, affiliates, associates, students, and volunteers.

Distribution

This policy will be distributed to applicable AI.io Incorporated Workforce Members. All recipients of this policy must acknowledge their receipt and understanding of this policy by referring any questions or problems with the policy within ten days of the issue date to their immediate supervisor. If no questions or problems are stated, it will be assumed that the policy has been read and understood. All questions regarding this policy or its implementation may be referred to the Director of Cybersecurity and Compliance.

Applicable Regulations