Overview

Purpose

To establish procedures ensuring only authorized AI.io Incorporated Workforce Members have access to electronic Protected Health Information (ePHI) and the system components in which such data resides, for example, through the access to a workstation, transaction, program, process, or other mechanism.

Scope and Applicability

This policy applies to Workforce Members.

Policy Statement

Policies and procedures must be implemented to ensure that all AI.io Incorporated Workforce Members with access to ePHI are granted only the minimum access necessary to perform duties that require access to a workstation, transaction, program, or process.

Procedures

General

1. AI.io Incorporated Managers, in conjunction with the Director of Cybersecurity and Compliance, are responsible for establishing, documenting, reviewing, and modifying a user’s right of access to a workstation, transaction, program, or process.
2. The Director of Cybersecurity and Compliance will create and maintain access control lists that ensure access to ePHI is limited and appropriate.
3. All access to ePHI will be reviewed and documented on an annual basis by the supervisor and the Director of Cybersecurity and Compliance.
4. Supervisors of terminated AI.io Incorporated Workforce Members must notify the Director of Cybersecurity and Compliance within 24-hours for a voluntary resignation and immediately upon an involuntary separation.

Definitions

ePHI – Protected Health Information that is stored in electronic format.

Information System – Means any combination of information technology and people’s activities that support operational, management and decision making processes. A system normally includes hardware, software, information, data, applications, communications, and people.

Workforce Member – Means employees and other persons whose conduct, in the performance of their work, is under the direct control of the organization, whether or not they are paid by the organization. This includes full and part time employees, contractors, affiliates, associates, students, volunteers, and staff from third party entities who provide services.

Distribution

This policy should be distributed to applicable Workforce Members. Recipients of this policy must acknowledge their receipt and understanding of this policy by referring any questions or problems with the policy within ten days of the issue date to the Director of Cybersecurity and Compliance. If no questions or problems are stated, it will be assumed that the policy has been read and understood.

Applicable Regulations