Overview

Purpose

To establish procedures ensuring that security requirements are incorporated as a part of the personnel hiring, transfer, disciplinary, termination, and supervision procedures.

Scope and Applicability

This policy applies to AI.io Incorporated Workforce Members.

Policy Statement

Policies and procedures must be implemented to ensure that all members of AI.io Incorporated have appropriate access to ePHI and to prevent those Workforce Members who do not have access from obtaining access to ePHI.

Procedures

General 

1. Any AI.io Incorporated Workforce Member who retains, accesses, or discloses ePHI data for unauthorized usage will be subject to disciplinary actions.
2. Alleged, apparent, or potential violations of policies and procedures must be reported as soon as possible, and no more than twenty-four (24) hours after violation becomes known to a supervisor or the Director of Cybersecurity and Compliance.
3. Upon receiving a report of a possible violation, a confidential investigation of the alleged violation must be conducted.

Workforce screening

1. Background checks will be conducted on potential AI.io Incorporated Workforce Members during the hiring process:
   1. Background checks will verify references, academic qualifications, work experience, criminal history, and any state or federal healthcare sanctions;
   2. The type and number of background checks will depend on specific job function and level of access to ePHI as outlined in the job description;
   3. Only authorized personnel may conduct screening procedures and will protect the confidentiality of background verification checks.
2. AI.io Incorporated Workforce Members may be granted access to Information Systems only after meeting necessary background verification check requirements.
3. A separate background verification process will be conducted for existing Workforce Members who may be assigned a new job function that requires ePHI access.

Confidentiality and Security

1. All AI.io Incorporated Workforce Members shall be required to sign agreements upon hire or reassignment from previous position to:
   1. Protect the confidentiality of ePHI and other Sensitive information;
   2. To use Information Systems in an authorized manner;
   3. To read, understand, and adhere to policies and procedures.

Job Categorization

1. Procedures shall be implemented to determine that the access of a workforce member to ePHI is appropriate.  
2. Specific job duties and responsibilities, including authorized levels of ePHI access necessary and associated risk levels, should be defined.
3. Authorization to access ePHI and other Sensitive information should be granted based on defined job duties.

Authorization and Supervision

1. Procedures shall be implemented for the authorization and/or supervision of Workforce Members who work with ePHI or in locations where it might be accessed.
2. All requests for granting, modification, or termination of access to ePHI and other Sensitive information must be submitted in writing and approved by an authorized manager and the Director of Cybersecurity and Compliance.
3. Appropriate corrective actions shall be taken for Workforce Members who have access to ePHI beyond the minimum necessary for the job function or duties. 

Job Changes

1. Changes in access levels for AI.io Incorporated Workforce Members granted access to ePHI and other Sensitive information shall be authorized and documented.
2. The Workforce Member’s access to ePHI within their current role must be terminated as of the date of transfer.
3. The Workforce Member’s new manager or supervisor shall be responsible for requesting access to ePHI commensurate with the Workforce Member’s new role and responsibilities including:
   1. Date and time of modification;
   2. Identification of Workforce Members whose access is being modified;
   3. Description of modified access rights;
   4. Reason for modification of access rights.

Termination Procedures 

1. Procedures shall be implemented for terminating access to ePHI and other Sensitive information when the employment of a Workforce Member ends or when access is no longer appropriate to the Workforce Member’s role or responsibility. 
2. Timely notification must be provided to the Director of Cybersecurity and Compliance and other affected departments when a AI.io Incorporated Workforce Member’s access to ePHI or other Sensitive information has been terminated. 
3. Procedures shall be established to ensure that when a AI.io Incorporated Workforce Member or User’s employment is terminated:
   1. All of the Workforce Member’s accounts with access to ePHI are disabled;
   2. Access to other Information Systems are disabled;
   3. Codes or passwords for systems, equipment access passwords, administrator passwords, and other common access control information shall be changed, as appropriate;
   4. Any equipment or property such as ID badges, personal computers, physical keys etc. provided to the Workforce Member is returned to the organization.
4. A record of the termination of access shall be maintained including:
   1. The date and time notice was issued;
   2. The expected date of separation;
   3. A detailed record of the steps taken to terminate access.
5. Access to ePHI shall not be extended to any AI.io Incorporated Workforce Member beyond the date of termination unless one of the following conditions have been met:
   1. A Business Associates Arrangement is entered into with the AI.io Incorporated Workforce Member;
   2. The AI.io Incorporated Workforce Member will be accessing ePHI as part of a specifically authorized arrangement with valid HIPAA consent documentation.

Disciplinary Actions

1. Appropriate sanctions shall be applied against AI.io Incorporated Workforce Members who fail to comply with the security policies and procedures of the covered entity or business associate.  
2. Procedures for appropriate sanctions shall be established for circumstances where it has been determined that HIPAA or organizational policies and/or procedures have been violated.
   1. Sanctions can include, but are not limited to:
      1. Termination of employment;
      2. Civil penalties as provided under HIPAA or other applicable federal, state, or local laws;
      3. Criminal penalties as provided under HIPAA or other applicable federal, state, or local laws.

Third Parties

1. Business associates may be permitted to create, receive, maintain, or transmit ePHI on our behalf only if we have obtained satisfactory assurances that the business associate will appropriately safeguard the information.
2. Third parties shall be required to sign appropriate agreements to protect the confidentiality, availability, and integrity of ePHI and other Sensitive information prior to being granted access to Information Systems.
3. Business associate contracts and other arrangements must conform to the applicable standards and specifications of the HIPAA Security Rule.
4. Procedures shall be established to remove or modify access in a timely manner for third party personnel who have been terminated or no longer require access to ePHI or other Sensitive Information.

Enforcement & Exception Handling

Failure to comply with this policy, associated procedures and guidelines may result in disciplinary actions up to and including termination of employment or termination of contracts. Legal actions also may be taken for violations of applicable regulations and laws.

Request for exceptions to this policy must be submitted in writing. Prior to official approval of any exception, this policy must continue to be observed.

Definitions

ePHI – Protected Health Information that is stored in electronic format.

Information System – Means any combination of information technology and people’s activities that support operational, management and decision making processes. A system normally includes hardware, software, information, data, applications, communications, and people.

AI.io Incorporated Workforce Member – Means employees and other persons whose conduct, in the performance of their work, is under the direct control of AI.io Incorporated, whether or not they are paid by AI.io Incorporated. This includes full and part time employees, contractors, affiliates, associates, students, volunteers, and staff from third party entities who provide services.

Distribution

This policy should be distributed to applicable AI.io Incorporated Workforce Members. Recipients of this policy must acknowledge their receipt and understanding of this policy by referring any questions or problems with the policy within ten days of the issue date to the Director of Cybersecurity and Compliance. If no questions or problems are stated, it will be assumed that the policy has been read and understood.

Applicable Regulations