Employees are required to complete security awareness training within 30 days of being hired and at least once a year thereafter.

The organization conducts regular reviews to ensure compliance with its information security policy, topic-specific policies, rules, and standards.

The company mandates that contractor agreements either include a code of conduct or refer to the company’s own code of conduct.

The board of directors meets at least once a year and keeps formal minutes of its meetings. It includes members who are independent of the company.

The company has implemented hardware, software, and procedural mechanisms to log and review activity within information systems that store or process electronic Protected Health Information (ePHI).

The board of directors has a formal charter that defines its oversight responsibilities related to internal controls.

The company’s information security policies and procedures are formally documented and reviewed at least once a year.

The company conducts background screenings for all new hires.

Managers are required to conduct performance evaluations for their direct reports at least once a year.

Employees are required to acknowledge the code of conduct upon hiring. Any violations may result in disciplinary action as outlined in the company’s disciplinary policy.

Senior management briefs the board of directors, or an appropriate subcommittee, at least once a year on the company’s cybersecurity and privacy risk posture. The board offers guidance and feedback to management as necessary.

The board possesses the necessary expertise to oversee management’s design, implementation, and operation of information security controls, and consults external security experts when needed.

The company notifies authorized internal users of system changes.

Provide a complete overview of your system for inclusion in Section III of the audit report.

The company’s information security policies and procedures are formally documented and reviewed at least once a year.

The company has implemented policies and procedures to safeguard electronic Protected Health Information (ePHI) against unauthorized alteration or destruction.

The company informs customers of critical system changes that could impact their processing.

Employees are required to acknowledge the code of conduct upon hiring. Any violations may result in disciplinary action as outlined in the company’s disciplinary policy.

The company maintains written agreements with vendors and third parties, which include applicable confidentiality and privacy commitments.

The company uses an infrastructure monitoring tool to track systems, infrastructure, and performance, generating alerts when predefined thresholds are reached.

The organization conducts regular reviews to ensure compliance with its information security policy, topic-specific policies, rules, and standards.

The company defines its objectives to support the identification and assessment of risks associated with achieving them.

The company performs the risk assessment process at least annually and whenever significant changes occur in the environment, such as acquisitions, mergers, or relocations.

The company has implemented hardware, software, and procedural mechanisms to log and review activity within information systems that store or process electronic Protected Health Information (ePHI).

The company maintains a documented risk management program that provides guidance on identifying potential threats, assessing the significance of associated risks, and implementing mitigation strategies.

The company performs risk assessments at least annually. This process includes identifying threats and changes (environmental, regulatory, and technological) that may affect service commitments, formally assessing the related risks, and considering how potential fraud could impact the achievement of objectives.

The company requires changes to software and infrastructure components to be authorized, documented, tested, reviewed, and approved before being implemented in the production environment.

The company conducts periodic technical and nontechnical evaluations, initially based on the HIPAA Security Rule, and subsequently in response to environmental or operational changes affecting the security of electronic Protected Health Information (ePHI), to determine whether its security policies and procedures continue to meet the requirements of the HIPAA Security Rule (Subpart C).

For service providers, the company performs reviews at least quarterly to confirm personnel comply with security policies and operational procedures.

When a nonconformity is identified, the organization: 1. Responds to the issue by: a) Taking action to control and correct it b) Addressing any resulting consequences 2. Assesses the need for action to prevent recurrence or occurrence elsewhere by: a) Reviewing the nonconformity b) Identifying its root causes c) Determining whether similar issues exist or could potentially arise 3. Implements necessary corrective actions 4. Evaluates the effectiveness of those actions 5. Updates the information security management system as needed Corrective actions are proportionate to the impact of the nonconformities. Documented information is retained to demonstrate: 1. The nature of the nonconformities and the actions taken 2. The results of any corrective actions

The company has implemented hardware, software, and procedural mechanisms to log and review activity within information systems that store or process electronic Protected Health Information (ePHI).

Senior management briefs the board of directors, or an appropriate subcommittee, at least once a year on the company’s cybersecurity and privacy risk posture. The board offers guidance and feedback to management as necessary.

The company conducts periodic technical and nontechnical evaluations, initially based on the HIPAA Security Rule, and subsequently in response to environmental or operational changes affecting the security of electronic Protected Health Information (ePHI), to determine whether its security policies and procedures continue to meet the requirements of the HIPAA Security Rule (Subpart C).

System documentation shall be subject to revision and change control procedures that maintain an audit trail documenting time-sequenced development and modifications.

Operational system checks shall be used, as appropriate, to enforce permitted sequencing of steps and events.

The organization conducts regular reviews to ensure compliance with its information security policy, topic-specific policies, rules, and standards.

The company has implemented hardware, software, and procedural mechanisms to log and review activity within information systems that store or process electronic Protected Health Information (ePHI).

The company maintains a documented risk management program that provides guidance on identifying potential threats, assessing the significance of associated risks, and implementing mitigation strategies.

The company has a formal systems development life cycle (SDLC) methodology that governs the development, acquisition, implementation, maintenance, and changes (including emergency changes) of information systems and related technology requirements.

The company’s information security policies and procedures are formally documented and reviewed at least once a year.

The company uses firewalls configured to block unauthorized access.

The company has processes for granting, modifying, and revoking physical access to data centers based on authorization from control owners.

The company uses secure transmission protocols to encrypt confidential and sensitive data when it is transmitted over public networks.

The company uses an intrusion detection system to continuously monitor its network and detect potential security breaches early.

System access shall be restricted to authorized individuals.

The company validates deletion requests, and once confirmed, flags and deletes the requested information in accordance with applicable laws and regulations.

The company requires passwords for in-scope system components to be configured in accordance with its policy.

Authority checks shall restrict system use, electronic signing, access to operations or system input/output devices, record alteration, and performance of the operation at hand to authorized individuals.

The company limits privileged access to the firewall to authorized users who have a valid business need.

The company encrypts datastores containing sensitive customer data at rest.

The company’s network is segmented to block unauthorized access to customer data.

The company installs critical security patches within one month of their release, as determined by the risk ranking process defined in VPM-4.

The organization securely disposes of data in accordance with the documented data management process, ensuring that disposal methods are appropriate for the sensitivity of the data.

The company purges or removes customer data containing confidential information from the application environment in accordance with best practices when customers discontinue the service.

The company requires visitors to sign in, wear a visitor badge, and be escorted by an authorized employee when accessing the data center or other secure areas.

The company performs access reviews at least quarterly for in-scope system components to ensure access is appropriately restricted. Required changes are tracked to completion.

The company restricts remote access to production systems to authorized employees using an approved encrypted connection.

The company ensures electronic media containing confidential information is purged or destroyed following best practices, with certificates of destruction issued for each device.

The company reviews data center access at least once a year.

The company’s access control policy outlines requirements for the following access control functions: 1. Adding new users 2. Modifying users 3. Removing user access

The company has implemented procedures to guard against, detect, and report malicious software.

The company uses an intrusion detection system to continuously monitor its network and detect potential security breaches early.

The company uses an infrastructure monitoring tool to track systems, infrastructure, and performance, generating alerts when predefined thresholds are reached.

The company tests its incident response plan at least once a year.

The company has documented security and privacy incident response policies and procedures, which are communicated to authorized users.

The company’s formal policies define requirements for the following IT and engineering functions: 1. Vulnerability management 2. System monitoring

The company maintains a process for identifying security vulnerabilities that includes: 1. Using reputable external sources to obtain current vulnerability information 2. Assigning risk rankings to identified vulnerabilities, clearly highlighting all high-risk and critical issues Risk rankings follow industry best practices and consider factors such as CVSS base scores, vendor classifications, and the affected system types. The risk assessment strategy ensures that all high-risk vulnerabilities are identified and that critical vulnerabilities, including those impacting public-facing systems, security infrastructure, or systems processing cardholder data, are addressed promptly.

The company’s security and privacy incidents are logged, tracked, resolved, and communicated to affected or relevant parties by management in accordance with its security incident response policy and procedures.

The company has a documented Business Continuity and Disaster Recovery (BC/DR) plan, which is tested at least once a year.

The company has established and implements, as needed, policies and procedures for responding to emergencies or other events (such as fire, vandalism, system failure, or natural disaster) that may damage systems containing electronic Protected Health Information (ePHI).

The company has implemented hardware, software, and procedural mechanisms to log and review activity within information systems that store or process electronic Protected Health Information (ePHI).

Host-based vulnerability scans are conducted at least quarterly on all externally facing systems, with critical and high-risk vulnerabilities tracked through to remediation.

The company uses a log management tool to detect events that could potentially affect its ability to meet security objectives.

System documentation shall be subject to revision and change control procedures that maintain an audit trail documenting time-sequenced development and modifications.

The company restricts production change migrations to authorized personnel only.

The company has a formal systems development life cycle (SDLC) methodology that governs the development, acquisition, implementation, maintenance, and changes (including emergency changes) of information systems and related technology requirements.

The company requires changes to software and infrastructure components to be authorized, documented, tested, reviewed, and approved before being implemented in the production environment.

The company has a vendor management program in place that includes: 1. Critical third-party vendor inventory 2. Vendor security and privacy requirements 3. Review of critical third-party vendors at least annually

The company has a documented Business Continuity and Disaster Recovery (BC/DR) plan, which is tested at least once a year.

The company has established and implements, as needed, policies and procedures for responding to emergencies or other events (such as fire, vandalism, system failure, or natural disaster) that may damage systems containing electronic Protected Health Information (ePHI).

The company maintains a documented risk management program that provides guidance on identifying potential threats, assessing the significance of associated risks, and implementing mitigation strategies.

The company performs risk assessments at least annually. This process includes identifying threats and changes (environmental, regulatory, and technological) that may affect service commitments, formally assessing the related risks, and considering how potential fraud could impact the achievement of objectives.

The company maintains written agreements with vendors and third parties, which include applicable confidentiality and privacy commitments.

For service providers, the company performs reviews at least quarterly to confirm personnel comply with security policies and operational procedures.

The company performs periodic backups of production data, storing the backups in a separate location from the production environment.

The company uses an infrastructure monitoring tool to track systems, infrastructure, and performance, generating alerts when predefined thresholds are reached.

The company tests its incident response plan at least once a year.

The company employs a multi-location strategy for production environments to enable operations to resume at alternate data centers if a facility becomes unavailable.

The company’s databases are replicated in real time to a secondary data center, with alerts set up to notify administrators of any replication failures.

The company has a documented Business Continuity and Disaster Recovery (BC/DR) plan, which is tested at least once a year.

The company has established and implements, as needed, policies and procedures for responding to emergencies or other events (such as fire, vandalism, system failure, or natural disaster) that may damage systems containing electronic Protected Health Information (ePHI).

The company uses environmental monitoring devices configured to automatically alert management in the event of environmental incidents.

The company validates deletion requests, and once confirmed, flags and deletes the requested information in accordance with applicable laws and regulations.

The company encrypts datastores containing sensitive customer data at rest.

The company has a data classification policy to ensure confidential data is properly secured and accessible only to authorized personnel.

The organization securely disposes of data in accordance with the documented data management process, ensuring that disposal methods are appropriate for the sensitivity of the data.

The company purges or removes customer data containing confidential information from the application environment in accordance with best practices when customers discontinue the service.

The company ensures electronic media containing confidential information is purged or destroyed following best practices, with certificates of destruction issued for each device.

The company performs periodic backups of production data, storing the backups in a separate location from the production environment.

The organization establishes and maintains a documented data management process that addresses, at a minimum: 1. Data sensitivity 2. Data owner 3. Data handling 4. Data retention limits 5. Data disposal requirements The organization aligns these elements with enterprise sensitivity and retention standards and reviews and updates the documentation annually or upon significant changes that could impact this control.

Operational system checks shall be used, as appropriate, to enforce permitted sequencing of steps and events.

The organization conducts regular reviews to ensure compliance with its information security policy, topic-specific policies, rules, and standards.

Provide a complete overview of your system for inclusion in Section III of the audit report.

The company has implemented policies and procedures to safeguard electronic Protected Health Information (ePHI) against unauthorized alteration or destruction.

The company’s system evaluates data inputs for compliance with input requirements and generates on-screen alerts when issues with transaction inputs or processing are detected.

Persons who use closed systems to create, modify, maintain, or transmit electronic records shall validate those systems for accuracy, reliability, consistent intended performance, and the ability to detect invalid or altered records.

The company retains customer transaction data for the duration of the customer account. Historical transaction data is not purged until the account is deleted.

To establish efficient governance for PII processing.

A controller shall provide consumers with an appropriately accessible, clear, and meaningful privacy notice that includes: 1. The categories of personal data processed by the controller 2. The purpose for processing personal data 3. The methods by which consumers may exercise their rights, including how a consumer may appeal a controller’s decision 4. The categories of personal data, if any, that the controller shares with third parties 5. The categories of third parties, if any, with which the controller shares personal data, and 6. An active electronic mail address or other online mechanism that consumers may use to contact the controller

The purposes for which personal data is collected shall be specified no later than at the time of collection. Subsequent use of the data shall be limited to fulfilling those purposes or to purposes that are compatible and specified whenever a change of purpose occurs.

The organization identifies and documents the specific purposes for which personally identifiable information is processed.

To make data subjects active participants in the decision-making process regarding the processing of their PII, except as otherwise limited by legislation and regulations, through the exercise of meaningful, informed and freely given consent.

The organization establishes a mechanism that enables individuals to modify or withdraw their consent for the processing of their personally identifiable information.

The organization obtains and records consent from personally identifiable information principals in accordance with documented processes.

The organization establishes and documents a process that enables it to demonstrate whether, when, and how consent for the processing of personally identifiable information (PII) was obtained from PII principals.

The company shall, at or before the point of collection, inform the consumer if sensitive personal information will be collected. The company shall disclose the categories of sensitive personal information collected, the purposes for which the categories are collected or used, and whether the information is sold or shared.

To minimize the PII which is processed to what is strictly necessary for the legitimate interest pursued by the PII controller and to limit the disclosure of PII to a minimum number of internal and external parties.

A controller shall limit the collection of personal data to what is necessary for the intended purpose. Personal data shall be obtained only through lawful and fair means and, where appropriate, with the knowledge or consent of the data subject.

A controller or processor shall restrict the creation, use, processing, storage, maintenance, dissemination, or disclosure of personal information to what is directly necessary for a defined business objective. Personal information shall be retained only for as long as required to achieve that objective and shall be securely deleted once it is no longer needed.

The organization obtains and records consent from personally identifiable information principals in accordance with documented processes.

The organization establishes and documents a process that enables it to demonstrate whether, when, and how consent for the processing of personally identifiable information (PII) was obtained from PII principals.

The company validates deletion requests, and once confirmed, flags and deletes the requested information in accordance with applicable laws and regulations.

To retain PII no longer than necessary to fulfill the stated purpose(s) or to abide by applicable laws.

Personal data shall not be disclosed, made available, or otherwise used for purposes other than those specified, except: a) With the consent of the data subject, or b) By the authority of law

The organization securely disposes of data in accordance with the documented data management process, ensuring that disposal methods are appropriate for the sensitivity of the data.

To limit the use and disclosure of PII for specific, explicit and legitimate purposes and to fulfill the stated purpose(s) or to abide by applicable laws.

The organization identifies and documents applicable legal, regulatory, and business obligations owed to individuals regarding the processing of their personally identifiable information and establishes measures to fulfill those obligations.

The purposes for which personal data is collected shall be specified no later than at the time of collection. Subsequent use of the data shall be limited to fulfilling those purposes or to purposes that are compatible and specified whenever a change of purpose occurs.

The company retains customer transaction data for the duration of the customer account. Historical transaction data is not purged until the account is deleted.

The organization establishes and documents policies and procedures for receiving, handling, and responding to legitimate requests from individuals regarding the processing of their personally identifiable information.

The organization identifies and documents applicable legal, regulatory, and business obligations owed to individuals regarding the processing of their personally identifiable information and establishes measures to fulfill those obligations.

To give data subjects the ability to access and review their PII and to challenge its accuracy and completeness.

The company’s access control policy outlines requirements for the following access control functions: 1. Adding new users 2. Modifying users 3. Removing user access

The organization provides customers with mechanisms or support necessary to enable them to meet obligations owed to individuals regarding the processing of personally identifiable information.

The company has a vendor management program in place that includes: 1. Critical third-party vendor inventory 2. Vendor security and privacy requirements 3. Review of critical third-party vendors at least annually

The company has documented security and privacy incident response policies and procedures, which are communicated to authorized users.

A data controller shall be accountable for implementing and complying with the measures that give effect to the principles set forth in this framework.

To make data subjects active participants in the decision-making process regarding the processing of their PII, except as otherwise limited by legislation and regulations, through the exercise of meaningful, informed and freely given consent.

The organization establishes and documents policies and procedures for receiving, handling, and responding to legitimate requests from individuals regarding the processing of their personally identifiable information.

To limit the use and disclosure of PII for specific, explicit and legitimate purposes and to fulfill the stated purpose(s) or to abide by applicable laws.

The company provides requested information, after verification, in a timely manner either in a portable electronic format or by mail, in compliance with applicable law.

To give data subjects the ability to access and review their PII and to challenge its accuracy and completeness.

The company informs customers of critical system changes that could impact their processing.

The company maintains written agreements with vendors and third parties, which include applicable confidentiality and privacy commitments.

The company retains customer transaction data for the duration of the customer account. Historical transaction data is not purged until the account is deleted.

To ensure, through contractual or other means, that third party recipients provide at least equivalent levels of PII protection.

Secure, computer-generated, time-stamped audit trails shall independently capture the date and time of operator entries and actions that create, modify, or delete electronic records, and shall preserve prior information so changes do not obscure earlier entries. Audit trail documentation shall be retained for at least the same period as the associated electronic records and shall be available for FDA review and copying.

The organization establishes and maintains a documented data management process that addresses, at a minimum: 1. Data sensitivity 2. Data owner 3. Data handling 4. Data retention limits 5. Data disposal requirements The organization aligns these elements with enterprise sensitivity and retention standards and reviews and updates the documentation annually or upon significant changes that could impact this control.

The company has implemented policies and procedures to safeguard electronic Protected Health Information (ePHI) against unauthorized alteration or destruction.

A controller or processor shall restrict the creation, use, processing, storage, maintenance, dissemination, or disclosure of personal information to what is directly necessary for a defined business objective. Personal information shall be retained only for as long as required to achieve that objective and shall be securely deleted once it is no longer needed.

When a nonconformity is identified, the organization: 1. Responds to the issue by: a) Taking action to control and correct it b) Addressing any resulting consequences 2. Assesses the need for action to prevent recurrence or occurrence elsewhere by: a) Reviewing the nonconformity b) Identifying its root causes c) Determining whether similar issues exist or could potentially arise 3. Implements necessary corrective actions 4. Evaluates the effectiveness of those actions 5. Updates the information security management system as needed Corrective actions are proportionate to the impact of the nonconformities. Documented information is retained to demonstrate: 1. The nature of the nonconformities and the actions taken 2. The results of any corrective actions

A data controller shall be accountable for implementing and complying with the measures that give effect to the principles set forth in this framework.

The organization establishes and documents policies and procedures for receiving, handling, and responding to legitimate requests from individuals regarding the processing of their personally identifiable information.

The company conducts background screenings for all new hires.

Responsibilities for the design, development, implementation, operation, maintenance, and monitoring of information security controls are formally defined in job descriptions and/or the Information Security Roles and Responsibilities policy.

Employees are required to complete security awareness training within 30 days of being hired and at least once a year thereafter.

Host-based vulnerability scans are conducted at least quarterly on all externally facing systems, with critical and high-risk vulnerabilities tracked through to remediation.

The company’s information security policies and procedures are formally documented and reviewed at least once a year.

The company has documented security and privacy incident response policies and procedures, which are communicated to authorized users.

The company maintains written agreements with vendors and third parties, which include applicable confidentiality and privacy commitments.

The company defines its objectives to support the identification and assessment of risks associated with achieving them.

The company maintains a documented risk management program that provides guidance on identifying potential threats, assessing the significance of associated risks, and implementing mitigation strategies.

The company has a documented Business Continuity and Disaster Recovery (BC/DR) plan, which is tested at least once a year.

The company performs risk assessments at least annually. This process includes identifying threats and changes (environmental, regulatory, and technological) that may affect service commitments, formally assessing the related risks, and considering how potential fraud could impact the achievement of objectives.

The company’s access control policy outlines requirements for the following access control functions: 1. Adding new users 2. Modifying users 3. Removing user access

The company requires changes to software and infrastructure components to be authorized, documented, tested, reviewed, and approved before being implemented in the production environment.

The company’s data backup policy defines the requirements for backing up and recovering customer data.

The company ensures that access to in-scope system components is based on job role and function or requires a documented access request and manager approval before access is granted.

The company requires passwords for in-scope system components to be configured in accordance with its policy.

The company performs access reviews at least quarterly for in-scope system components to ensure access is appropriately restricted. Required changes are tracked to completion.

The company uses termination checklists to ensure access for terminated employees is revoked within defined SLAs.

The company’s formal policies define requirements for the following IT and engineering functions: 1. Vulnerability management 2. System monitoring

The company tests its incident response plan at least once a year.

The company performs periodic backups of production data, storing the backups in a separate location from the production environment.

The company provides requested information, after verification, in a timely manner either in a portable electronic format or by mail, in compliance with applicable law.

The company enforces appropriate sanctions against workforce members who fail to comply with its security policies and procedures.

The company identifies and responds to suspected or known security incidents, mitigates harmful effects to the extent practicable, and documents the incidents along with their outcomes.

The company has established and implements, as needed, policies and procedures for responding to emergencies or other events (such as fire, vandalism, system failure, or natural disaster) that may damage systems containing electronic Protected Health Information (ePHI).

The company has implemented procedures for the periodic testing and revision of contingency plans.

The company conducts periodic technical and nontechnical evaluations, initially based on the HIPAA Security Rule, and subsequently in response to environmental or operational changes affecting the security of electronic Protected Health Information (ePHI), to determine whether its security policies and procedures continue to meet the requirements of the HIPAA Security Rule (Subpart C).

The company has established procedures, to be implemented when needed, that allow facility access during emergencies in order to support data restoration as outlined in the disaster recovery and emergency mode operations plans.

The company has implemented hardware, software, and procedural mechanisms to log and review activity within information systems that store or process electronic Protected Health Information (ePHI).

The company issues written notice to the customer upon any changes to sub-processors and provides an opportunity for the customer to raise objections in accordance with contractual requirements.

The company enters into a written agreement with each processor of personally identifiable information (PII), defining the processor’s responsibilities and required compliance with applicable data protection standards.

The organization conducts regular reviews to ensure compliance with its information security policy, topic-specific policies, rules, and standards.

For public-facing web applications, the company addresses new threats and vulnerabilities on an ongoing basis and protects these applications against known attacks by implementing one of the following methods: 1. Conducting manual or automated application vulnerability assessments that: a) Occur at least annually and after any changes b) Are performed by organizations specializing in application security c) Include all vulnerabilities d) Ensure that all identified vulnerabilities are corrected e) Include re-evaluation of the application following remediation 2. Deploying an automated technical solution, such as a web application firewall, that: a) Is positioned in front of public-facing web applications to detect and prevent attacks b) Is actively running and kept up to date c) Generates audit logs d) Is configured to either block detected web-based attacks or generate alerts that are promptly investigated

The company ensures that audit trails are enabled and active on all system components to record relevant security events.

The company ensures that access to system components is linked to individual users to maintain accountability and traceability.

For service providers, the company performs reviews at least quarterly to confirm personnel comply with security policies and operational procedures.

The organization shall limit system access exclusively to authorized users, processes operating on behalf of authorized users, and approved devices, including interconnected systems.

The organization shall identify system users, processes operating on behalf of users, and devices.

The company’s access control policy outlines requirements for the following access control functions: 1. Adding new users 2. Modifying users 3. Removing user access

The company requires changes to software and infrastructure components to be authorized, documented, tested, reviewed, and approved before being implemented in the production environment.

The company maintains a formal inventory of assets within the production environment.

The company has a data classification policy to ensure confidential data is properly secured and accessible only to authorized personnel.

The company has processes for granting, modifying, and revoking physical access to data centers based on authorization from control owners.

The company reviews data center access at least once a year.

The company requires visitors to sign in, wear a visitor badge, and be escorted by an authorized employee when accessing the data center or other secure areas.

The company ensures electronic media containing confidential information is purged or destroyed following best practices, with certificates of destruction issued for each device.

The company purges or removes customer data containing confidential information from the application environment in accordance with best practices when customers discontinue the service.

The company encrypts portable and removable media devices when in use.

The company uses a mobile device management (MDM) system to centrally manage mobile devices that support the service.

The company performs periodic backups of production data, storing the backups in a separate location from the production environment.

The company employs a multi-location strategy for production environments to enable operations to resume at alternate data centers if a facility becomes unavailable.

The company conducts maintenance inspections of environmental security measures at its data centers at least once a year.

The company has established procedures, to be implemented when needed, that allow facility access during emergencies in order to support data restoration as outlined in the disaster recovery and emergency mode operations plans.

The company has established policies and procedures to document all repairs and modifications to the physical components of its facilities that relate to security, including items such as hardware, walls, doors, and locks.

The company ensures that audit trails are enabled and active on all system components to record relevant security events.

Authority checks shall restrict system use, electronic signing, access to operations or system input/output devices, record alteration, and performance of the operation at hand to authorized individuals.

The company’s access control policy outlines requirements for the following access control functions: 1. Adding new users 2. Modifying users 3. Removing user access

The company limits privileged access to encryption keys to authorized users who have a valid business need.

System access is restricted to authorized users only.

The company limits privileged database access to authorized users with a valid business need.

The company limits privileged access to the operating system to authorized users with a valid business need.

The company requires authentication to the production network to use unique usernames and passwords or authorized SSH keys.

The company uses secure transmission protocols to encrypt confidential and sensitive data when it is transmitted over public networks.

The company uses firewalls configured to block unauthorized access.

The company has established procedures, to be implemented when needed, that allow facility access during emergencies in order to support data restoration as outlined in the disaster recovery and emergency mode operations plans.

The company has implemented hardware, software, and procedural mechanisms to log and review activity within information systems that store or process electronic Protected Health Information (ePHI).

The company has implemented electronic mechanisms to verify that electronic Protected Health Information (ePHI) has not been altered or destroyed without authorization.

The company ensures that audit trails are enabled and active on all system components to record relevant security events.

The company ensures that access to system components is linked to individual users to maintain accountability and traceability.

The organization enforces automatic device lockout on portable end-user devices, where supported, after a predetermined threshold of failed local authentication attempts. Laptops do not allow more than 20 failed attempts, and tablets or smartphones do not allow more than 10 failed attempts. Example implementations include Microsoft InTune Device Lock and Apple Configuration Profile maxFailedAttempts.

The organization shall limit system access exclusively to authorized users, processes operating on behalf of authorized users, and approved devices, including interconnected systems.

The organization shall identify system users, processes operating on behalf of users, and devices.

The company’s information security policies and procedures are formally documented and reviewed at least once a year.

The company maintains written agreements with vendors and third parties, which include applicable confidentiality and privacy commitments.

The company maintains a documented risk management program that provides guidance on identifying potential threats, assessing the significance of associated risks, and implementing mitigation strategies.

The company’s access control policy outlines requirements for the following access control functions: 1. Adding new users 2. Modifying users 3. Removing user access

The company identifies and responds to suspected or known security incidents, mitigates harmful effects to the extent practicable, and documents the incidents along with their outcomes.

The company issues written notice to the customer upon any changes to sub-processors and provides an opportunity for the customer to raise objections in accordance with contractual requirements.

The company enters into a written agreement with each processor of personally identifiable information (PII), defining the processor’s responsibilities and required compliance with applicable data protection standards.

The company’s information security policies and procedures are formally documented and reviewed at least once a year.

The company retains customer transaction data for the duration of the customer account. Historical transaction data is not purged until the account is deleted.

The company retains personally identifiable information (PII) only for the duration necessary to fulfill the purposes for which it was collected, in alignment with applicable data retention policies.

The company enters into a written agreement with each processor of personally identifiable information (PII), defining the processor’s responsibilities and required compliance with applicable data protection standards.

The organization conducts regular reviews to ensure compliance with its information security policy, topic-specific policies, rules, and standards.

The company’s information security policies and procedures are formally documented and reviewed at least once a year.

A business associate provides the company, acting as a covered entity, with any additional information required for individual notifications, either at the time of notification or as soon as the information becomes available.

The company, in its role as a covered entity, requires all business associates to notify it upon the discovery of any breach involving unsecured protected health information. A breach is considered discovered by the business associate on the first day it becomes known or should have been known through the exercise of reasonable diligence. The business associate is regarded as having knowledge of the breach if any individual, other than the one responsible for the breach, who is an employee, officer, or agent of the business associate, is aware of it, as defined under the Federal common law of agency.

Unless a delay is requested for law enforcement purposes, a business associate must provide the breach notification required under the company’s Breach Notification Policy, as specified in IRO-15, without unreasonable delay and no later than 60 calendar days from the date the breach is discovered.

A business associate’s breach notification includes, to the extent possible, the identification of each individual whose unsecured protected health information was, or is reasonably believed to have been, accessed, acquired, used, or disclosed in connection with the breach.

The company establishes documented policies and procedures for responding to data breaches, which include defined notification processes to ensure timely communication to relevant stakeholders.