A document obtained by Computerworld from a reliable source indicates that Piedmont was presented with a list of 42 items that HHS officials wanted information on within 10 days. Specifically, Piedmont was asked to provide policies and procedures for:
- Establishing and terminating users’ access to systems housing electronic patient health information (ePHI).
- Emergency access to electronic information systems.
- Inactive computer sessions (periods of inactivity).
- Recording and examining activity in information systems that contain or use ePHI.
- Risk assessments and analyses of relevant information systems that house or process ePHI data.
- Employee violations (sanctions).
- Electronically transmitting ePHI.
- Preventing, detecting, containing and correcting security violations (incident reports).
- Regularly reviewing records of information system activity, such as audit logs, access reports and security incident tracking reports.
- Creating, documenting and reviewing exception reports or logs. Please provide a list of examples of security violation logging and monitoring.
- Monitoring systems and the network, including a listing of all network perimeter devices, i.e. firewalls and routers.
- Physical access to electronic information systems and the facility in which they are housed.
- Establishing security access controls; (what types of security access controls are currently implemented or installed in hospitals’ databases that house ePHI data?).
- Remote access activity i.e. network infrastructure, platform, access servers, authentication, and encryption software.
- Internet usage.
- Wireless security (transmission and usage).
- Firewalls, routers and switches.
- Maintenance and repairs of hardware, walls, doors, and locks in sensitive areas.
- Terminating an electronic session and encrypting and decrypting ePHI.
- Transmitting ePHI.
- Password and server configurations.
- Anti-virus software.
- Network remote access.
- Computer patch management.
HHS also had a slew of other requests:
- Please provide a list of all information systems that house ePHI data, as well as network diagrams, including all hardware and software that are used to collect, store, process or transmit ePHI.
- Please provide a list of terminated employees.
- Please provide a list of all new hires.
- Please provide a list of encryption mechanisms use for ePHI.
- Please provide a list of authentication methods used to identify users authorized to access ePHI.
- Please provide a list of outsourced individuals and contractors with access to ePHI data, if applicable. Please include a copy of the contract for these individuals.
- Please provide a list of transmission methods used to transmit ePHI over an electronic communications network.
- Please provide organizational charts that include names and titles for the management information system and information system security departments.
- Please provide entity wide security program plans (e.g System Security Plan).
- Please provide a list of all users with access to ePHI data. Please identify each user’s access rights and privileges.
- Please provide a list of systems administrators, backup operators and users.
- Please include a list of antivirus servers, installed, including their versions.
- Please provide a list of software used to manage and control access to the Internet.
- Please provide the antivirus software used for desktop and other devices, including their versions.
- Please provide a list of users with remote access capabilities.
- Please provide a list of database security requirements and settings.
- Please provide a list of all Primary Domain Controllers (PDC) and servers (including Unix, Apple, Linux and Windows). Please identify whether these servers are used for processing, maintaining, updating, and sorting ePHI.
- Please provide a list of authentication approaches used to verify a person has been authorized for specific access privileges to information and information systems.
Source: HIPAA audit: The 42 questions HHS might ask
Jeff of the HIPAA Blog talks more about the questions here and that the questions are pertinent to all firms with information security requirements.