Overview

Purpose

To define and document security awareness and user training procedures.

Scope and Applicability

This policy applies to all AI.io Incorporated Workforce Members, including management, that are Information System Users.

Policy Statement

AI.io Incorporated Workforce Members are required to attend formal security awareness training before being granted access to any Information Systems and at least annually thereafter. All Users shall be given appropriate end user training for the Information Systems that they are granted access to.

Procedures

General

1. A security awareness and training program shall be implemented for all members of its workforce including management.
2. Training programs shall be reviewed, and revised if needed, on an annual basis by the Director of Cybersecurity and Compliance.

User Training

1. General computer security awareness and end user training programs shall be developed for all Users including but not limited to:
   1. Acceptable use of Information Systems;
   2. Confidentiality and handling requirements of ePHI and other Sensitive information;
   3. Guarding against and reporting malicious software;
   4. Creating, changing, and safeguarding strong passwords;
   5. Monitoring of log-in attempts and discrepancies;
   6. Physical security of Information Systems including protecting output from displays and printers;
   7. Reporting of potential or suspected security incidents.
2. Users shall attend training programs as part of initial training for new Users and when required by system changes.
3. All Users shall receive training prior to being granted access to Information Systems. In the event that an exception must be granted for individual Users, training must be conducted within 30 days of receiving access.
4. All Users shall receive refresher security awareness training on an annual basis.

System and Security Personnel Training

1. AI.io Incorporated Workforce Members with security and compliance related roles shall receive specialized HIPAA Privacy and Security related training on an annual basis, including:
   1. Application managers, system and network administrators, super users;
   2. Personnel who have access to system-level software and/or elevated privileges;
   3. Physical security personnel;
   4. Compliance and Risk management personnel.

Security Reminders and Advisories

1. Security awareness reminders shall be distributed to AI.io Incorporated Workforce Members on an annual basis.
2. Incident or event driven security advisories shall be distributed to AI.io Incorporated Workforce Members as appropriate.

Security Training Records

1. Security awareness training records shall be developed and retained for individual Users.

Enforcement & Exception Handling

Failure to comply with this policy, associated procedures and guidelines may result in disciplinary actions up to and including termination of employment or termination of contracts. Legal actions also may be taken for violations of applicable regulations and laws.

Request for exceptions to this policy must be submitted in writing. Prior to approval from the Director of Cybersecurity and Compliance of any exception, this policy must continue to be observed.

Definitions

ePHI – Protected Health Information that is stored in electronic format.
Information System – Means any combination of information technology and people’s activities that support operational, management and decision making processes. A system normally includes hardware, software, information, data, applications, communications, and people.

Users – Are the individuals, groups, or organizations authorized to access information assets.

AI.io Incorporated Workforce Member – Means employees and other persons whose conduct, in the performance of work, are under the direct control of AI.io Incorporated, whether or not they are paid by AI.io Incorporated. This includes full and part time employees, contractors, affiliates, associates, students, and volunteers.

Distribution

This policy should be distributed to applicable AI.io Incorporated Workforce Members. Recipients of this policy must acknowledge their receipt and understanding of this policy by referring any questions or problems with the policy within ten days of the issue date to the Director of Cybersecurity and Corporate Compliance. If no questions or problems are stated, it will be assumed that the policy has been read and understood.

Applicable Regulations