Overview

General

1. Thorough and complete evaluations of Information Systems must be conducted, including network components, servers, workstations, cloud systems, and other components that access, create, receive, maintain and/or transmit ePHI.
2. Information Systems must possess adequate technical safeguards to protect the information that it contains.
3. The Director of Cybersecurity and Compliance shall approve the implemented integrity controls and take reasonable and appropriate steps to evaluate and improve their effectiveness. 
4. External security news, alerts, and advisories shall be monitored and appropriate actions taken to protect the confidentiality, availability, and integrity of ePHI and other sensitive information.
5. Any form of malicious activity or attack shall be reported immediately and escalated as established in Incident Response procedures.
6. Default passwords for all network components, operating systems, and applications shall be changed using authorized authentication guidelines.

Technical Safeguards

1. Technical controls shall be implemented to protect and corroborate that ePHI or other Sensitive information, has not been used, altered or destroyed in an unauthorized manner.
2. Firewalls shall be deployed, configured, and monitored to block unauthorized network traffic.
3. Network components that provide pathways to Information Systems must be configured to appropriately protect network traffic.
4. Intrusion detection and prevention tools and techniques shall be implemented and monitored.
5. Network performance monitoring tools and techniques shall be implemented and monitored.
6. Event logs shall be configured adequately to assess and evaluate system errors and malevolent activity.

Integrity Controls

1. Standards shall be established for change control, testing, documentation, and approval for the deployment and upgrading of Information Systems.
2. Information Systems containing ePHI or other sensitive information must be tested prior to being placed in service.
3. Software updates and patches shall be deployed based on established change control standards.
4. Operating systems must be secured by closing of unnecessary ports and services and applying security patches.  Operating systems that no longer receive vendor security updates must be upgraded or retired.
5. Applications that contain ePHI must possess the following:
   1. Access controls such as user ID, PINs, password, or token access.
   2. Logging and audit trail capabilities that log changes and deletion of the data.
   3. Automatic screen savers and session locking based on user inactivity.
   4. Software shall be scanned for malware before installation on Information Systems.
   5. Software developed internally must conform to applicable secure coding standards.

Authorization and Transmission

1. Information Systems shall be configured to enforce authorized logical Access and to control the flow of information within the system and interconnected systems.
2. Transmissions of ePHI outside of the system boundary including external and public systems and networks must either encrypt the information or encrypt the connection between the sending and receiving entity.
3. All transmissions of ePHI outside of the system boundary including external and public systems and networks, must ensure that information is not improperly modified without detection while in transit.
4. Integrity, error checking, and data recovery features shall be utilized as available and appropriate.

Acquisition of Products and Services

1. All products that utilize Information System resources must be reviewed by the Director of Cybersecurity and Compliance prior to acquisition to evaluate compliance with applicable regulations and internal standards.
2. Vendors and Business Associates that may Access ePHI must be reviewed by the Director of Cybersecurity and Compliance prior to the granting of Access to evaluate potential risks to the Information System and to implement appropriate safeguards.

Protection from Malicious Software

1. Anti-malware protection, including anti-virus, anti-spam, and firewalls, shall be implemented for all applicable Information System devices.
2. Anti-malware definitions must be updated regularly.
3. Systems found to be infected with malware shall be removed from the network until such time as the infection has been eradicated and does not present a further risk to the Information System. 
4. Anti-Malware software shall be configured with automatic real-time scanning of email attachments and downloaded files.
5. All confirmed or suspected malware occurrences must be reported through established incident handling procedures. 
6. The Director of Cybersecurity and Compliance shall take steps to ensure that periodic audits of servers, workstations, laptops, and other computing devices are conducted to verify compliance with established anti-malware standards.

Procedures

General

1. An inventory of Veuu Information Systems that store, process, transmit, or receive ePHI and other Sensitive information will be developed and maintained.
2. Information Systems that contain or impact ePHI or other Sensitive information will be classified based on their confidentiality, integrity, and availability requirements.

Security Officer

1. The Director of Cybersecurity and Compliance is designated as the Veuu Security Officer.
2. The Security Officer is responsible for the development and implementation of security policies and procedures shall be identified.
3. The Security Officer is responsible for overseeing the security management process including:
   1. Risk assessments and analysis;
   2. Security plans;
   3. Monitoring of security controls.
4. The Security Officer should provide regular updates to executive leadership.
5. The specific duties and responsibilities of the Security Officer are defined in the Security Guidelines document.

Policy & Procedures

1. Reasonable and appropriate policies and procedures shall be implemented to comply with standards, implementation specifications, or other requirements of applicable regulations.
2. The Director of Cybersecurity and Compliance should perform tests of the internal controls of policies and procedures for adequacy and completeness.
3. A process shall be established for the review, approval, and distribution of policies and procedures.

Risk Assessment

1. An accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity, and availability of electronic protected health information shall be conducted.
2. Risk assessments should be conducted for Veuu Information Systems that may have an impact on the confidentiality, integrity, and availability of ePHI or other Sensitive information.
3. Risk assessments should be conducted under the supervision of the Director of Cybersecurity and Compliance.
4. Risk assessments should be conducted at least annually and after any significant changes to Veuu Information Systems.
5. The assessment should identify potential threats and vulnerabilities.
6. The assessment should evaluate the effectiveness of existing security controls and safeguards. 
7. Threats should be evaluated based on likelihood that a vulnerability could be exploited.
8. The impact on confidentiality, integrity, or availability of ePHI and Information Systems that could result if a threat source successfully exploited a vulnerability should be evaluated.
9. Risks shall be determined based on the likelihood that threats will attempt to exploit vulnerabilities, the potential impact, and the effectiveness of security controls.
10. The assessment shall identify and prioritize corrective actions needed to mitigate risks.

Risk Management

1. Security measures sufficient to reduce risks and vulnerabilities to a reasonable and appropriate level shall be implemented.
2. Identified risks shall be prioritized based on the potential impact to ePHI and other Sensitive information, and resources shall be allocated accordingly.
3. Security methods to minimize or eliminate risks shall be identified based on their nature, feasibility, and effectiveness.
4. A cost-benefit analysis shall be considered in determining the extent of implementation of identified security methods.
5. Selected security methods shall be implemented under the direction of the Director of Cybersecurity and Compliance. 
6. Implemented security methods shall be evaluated and revised as necessary by the Director of Cybersecurity and Compliance.

Security Planning

1. The Director of Cybersecurity and Compliance shall develop and implement an effective risk management program to regularly monitor and evaluate threats and risks to Veuu information systems.
2. A formal security plan shall be developed and maintained to track identified security risks and document remediation efforts. 
3. Security related activity shall be planned and communicated as appropriate to minimize the impact on the organization.
4. The Director of Cybersecurity and Compliance shall meet regularly with the Development team to incorporate security measures into development efforts.

Evaluation

1. A periodic technical and nontechnical evaluation, based upon the standards implemented, and in response to environmental or operational changes affecting the security of ePHI, shall be conducted.
2. The Director of Cybersecurity and Compliance should evaluate, on an ongoing basis, the effectiveness of security policies and procedures.
3. The Director of Cybersecurity and Compliance should immediately evaluate the impact of the following events and take appropriate actions to address security threats: 
   1. Changes in the HIPAA Security or Privacy regulations;
   2. New federal, state, or local laws and regulations affecting PHI;
   3. Changes in technology, environmental, or business processes that may affect the security of Veuu information systems;
   4. A serious security violation, breach, or other security incident.

Documentation

1. Required documentation must be retained for at least 6 years from the date of its creation or the date when it last was in effect, whichever is later.
2. A written, or electronic, record must be maintained of the policies and procedures and actions, activities, or assessments required to be documented, for compliance with regulations.
3. Documentation must be made available to those persons responsible for implementing the procedures to which the documentation pertains.
4. Documentation must be reviewed periodically, and update as needed, in response to environmental or operational changes affecting the security of the ePHI.

Review and Revision

1. The Security Management program shall be reviewed, and revised if needed, on an annual basis.

Enforcement & Exception Handling

Failure to comply with this policy, associated procedures and guidelines may result in disciplinary actions up to and including termination of employment or termination of contracts. Legal actions also may be taken for violations of applicable regulations and laws.

Request for exceptions to this policy must be submitted in writing. Prior to official approval of any exception, this policy must continue to be observed.

The Director of Cybersecurity and Compliance will be responsible for performing tests of the internal controls of this policy for adequacy and completeness.

Definitions

ePHI – Protected Health Information that is stored in electronic format.

Information System – Means any combination of information technology and people’s activities that support operational, management and decision making processes.  A system normally includes hardware, software, information, data, applications, communications, and people.

Access – The ability or means necessary to read, write, modify, or communicate data/information or otherwise use Information Systems.

Applicable Regulations