Security Guidelines

User Access Modification, Deactivation & Removal

Applies to	Description	Action
Involuntary terminated user	Involuntary termination of employment.	Immediate selective wipe of device, reset passwords to all accounts, lock device and coordinate return.
Voluntary terminated user	Account inactivation and removal.	Deactivate within 2 business days or transfer authentication to prevent unauthorized access.
All users	Account suspension for extended leave of absence	Deactivate for absence over 90 days.
All users	Unsuccessful logins attempts	5 failed attempts. Lock 15 minutes.
All users	User accounts that have not had logins	Deactivate for over 90 days.
All users	Notification and modification of User role changes	Managers to notify within 14 days, access changes made within 2 business days.
All users	Disabled accounts	Remove after 180 days unless authorized for retention.

Location / Device	Description	Screen Saver	Session Lock
Laptop Devices	Portable devices such as laptops and tablet computers located in non-secure areas.	5 mins	10 mins
Secure Areas	Computers located in areas that are physically secured from access by unauthorized persons.	15 mins	30 mins

Applies to	Action
Minimum Password Length	8 Characters
Maximum Password Length	15 Characters
Password Complexity	Case change and one number or special character
Password Expiration	90 Days
Disallow Password Reuse	Last 5 or never reuse
Lock for Failed Login Attempts	5 Failed – 15 Minute Lock or Help Desk reset
Deactivation for Login Inactivity	Disable account after 90 days.

Laptop or Desktop	Action
Minimum Password Length	8 Characters
Password Complexity	Case change and one number or special character
Password Expiration	180 days
Disallow Password Reuse	Last 24 or never reuse
Lock for Inactivity	30 Minutes
Lock for Failed Login Attempts	10 Failed – 10 Minute Lock
Encryption	Required for devices that travel outside of home or office
Automatic Updates	Required
Antivirus	Required

Smartphone or Tablet	Action
Minimum PIN Length	4 characters
Lock for Inactivity	5 mins
Encryption	Required
Lock for Failed Login Attempts	10 Failed – Wipe Device

Act as the designated point of contact for HIPAA Security related matters.
Develop, update and implement policies and procedures as required by the HIPAA Security rule and other state and federal regulations.
Ensure that reasonable safeguards and security measures exist, as well as proper staff training, so that electronic Protected Health Information is maintained and is not improperly used or disclosed.
Oversee a security management program to identify, monitor, and mitigate threats and risks to all Information Systems.
Conduct periodic risk analysis of information systems and security controls.
Implement appropriate security controls.
Ensure Workforce Members receive regular security awareness training.
Evaluate acquisitions of Information Systems products and services for compliance with appropriate security controls.
Conduct regular audits of Information System events.
Conduct regular audits of Information Systems containing Sensitive information.
Maintain an inventory of all Information System components.
Establish and maintain availability, integrity, and confidentiality classifications for all Information Systems.
Develop and manage the Emergency and Contingency plans and procedures.
Ensure backup, recovery, and retention capabilities meet business requirements.
Manage security incident response procedures and investigations.