Overview

Purpose  

To create, maintain, and protect User ID’s, passwords, and authentication procedures.

Scope and Applicability

This policy applies to Information Systems containing or accessing ePHI or other Sensitive information.  

Policy Statement

Information Systems containing ePHI or other Sensitive information shall employ procedures and security controls that only permit Access to authorized Users once their identification has been verified and authenticated.

Procedures

General 

1. Procedures and technical controls shall be implemented to verify that a person or entity seeking access to Information Systems is the one claimed.
2. If any Veuu Employee believes that their user identification and/or password have been compromised, they must report the incident immediately to the Director of Cybersecurity and Compliance.
3. Veuu Employees may not ask for or use another person’s identification and/or password information.
4. The reuse of User identifiers after a Veuu Employees’ Access to Information Systems has been terminated is prohibited.
5. Access to Information Systems may be tracked and monitored.

User Identification

1. Information Systems shall uniquely identify and authenticate Users for Access to ePHI and other Sensitive information.  
2. An exception may be granted for shared workstations providing that:
   1. Access to applications containing ePHI require a unique User ID and Password.
   2. User ID’s and Passwords may only be shared as directed by supervisors.
   3. Shared account passwords shall be changed periodically and at any other time warranted by security concerns.
3. Unique identifiers shall be assigned to Veuu Employees to distinguish Users and track their activity.
4. Veuu Employees are responsible for ensuring that their assigned user identification is appropriately protected and only used for legitimate Access to networks, systems, or applications. Veuu Employees may not share information pertaining to their user IDs, Passwords, personal identification numbers, etc. 
5. Veuu Employees must ensure that their User ID and Password are not documented, written, or otherwise exposed in an insecure manner.

Passwords

1. Procedures for creating, changing, and safeguarding strong Passwords shall be implemented.
2. Passwords must be used for authentication to all Information Systems containing Sensitive information.
3. Passwords must be unique and not used for any other personal or non-work related purpose.
4. Passwords may not contain the User ID, person’s name, or any personal or identifying information.
5. Passwords must be hard to guess. 
6. Passwords must meet the length, complexity, life, and reuse requirements defined in the Information Security Guidelines document.
7. The Information Technology Department shall establish a process to reset Passwords upon request of a User.  The process shall verify their identity and must be changed by the Veuu Employee upon next login.
8. Passwords may not be e-mailed other than temporary passwords created by the Information Technology personnel.

Enforcement & Exception Handling

Failure to comply with this policy, associated procedures and guidelines may result in disciplinary actions up to and including termination of employment or termination of contracts. Legal actions also may be taken for violations of applicable regulations and laws.

Request for exceptions to this policy must be submitted in writing. Prior to official approval of any exception, this policy must continue to be observed.

Definitions

ePHI – Protected Health Information that is stored in electronic format.

Information System – Any combination of information technology and people’s activities that support operational, management and decision making processes. A system normally includes hardware, software, information, data, applications, communications, and people.

Access – The ability or means necessary to read, write, modify, or communicate data/information or otherwise use Information Systems.

AI.io Incorporated Employee – Employees and other persons whose conduct, in the performance of their work, is under the direct control of the organization, whether or not they are paid by the organization. This includes full and part time employees, contractors, affiliates, associates, students, volunteers, and staff from third party entities who provide services.

Users – Are the individuals, groups, or organizations authorized to access information assets.

Distribution

This policy should be distributed to applicable Veuu Employees. Recipients of this policy must acknowledge their receipt and understanding of this policy by referring any questions or problems with the policy within ten days of the issue date to the Director of Cybersecurity and Compliance. If no questions or problems are stated, it will be assumed that the policy has been read and understood.

Applicable Regulations