Overview

Purpose

To establish procedures to identify and respond to suspected or known security incidents; mitigate, to the extent practicable, harmful effects of security incidents that are known to AI.io Incorporated; and document security incidents and their outcomes.

Scope and Applicability

This policy applies to AI.io Incorporated Workforce Members.

Policy Statement

Policies and procedures must be implemented to ensure that all security incidents involving ePHI are investigated, documented, and reported appropriately.

Procedures

General

1. Any suspected or known security incidents involving ePHI must be reported to the Director of Cybersecurity and Compliance.
2. The Director of Cybersecurity and Compliance will create an incident report and perform an investigation within 24 hours of the reported incident.
3. Security incidents determined to involve ePHI must be documented, tracked, and reported as defined by AI.io Incorporated’s business associates, and as required by federal law.

Definitions

ePHI – Protected Health Information that is stored in electronic format.
Information System – Means any combination of information technology and people’s activities that support operational, management and decision making processes. A system normally includes hardware, software, information, data, applications, communications, and people.

Users – Are the individuals, groups, or organizations authorized to access information assets.

AI.io Incorporated Workforce Member – Means employees and other persons whose conduct, in the performance of their work, is under the direct control of the organization, whether or not they are paid by the organization. This includes full and part time employees, contractors, affiliates, associates, students, volunteers, and staff from third party entities who provide services.

Distribution

Applicable Regulations