Project Grant P0647284

RYAN WHITE TITLE III HIV CAPACITY DEVELOPMENT AND PLANNING GRANTS - PROJECT ABSTRACT PROJECT TITLE: FY 2022 RWHAP PART C CAPACITY DEVELOPMENT PROGRAM APPLICANT NAME: CARES COMMUNITY HEALTH DBA ONE COMMUNITY HEALTH (H76HA00703) ADDRESS: 1500 21ST STREET, SACRAMENTO, CA 95811 CONTACT NUMBERS: MICHELLE MONROE, CEO PHONE: (916) 914-6240 FAX: (916) 914-6266 EMAIL ADDRESS: MMONROE@ONECOMMUNITYHEALTH.COM WEBSITE: WWW.ONECOMMUNITYHEALTH.COM SELECTED CATEGORY AND ACTIVITY: CARES COMMUNITY HEALTH DBA ONE COMMUNITY HEALTH (OCH) HAS CHOSEN INFRASTRUCTURE DEVELOPMENT - EMERGENCY PREPAREDNESS FOR THIS SUPPLEMENTAL FUNDING OPPORTUNITY. IN RESPONSE TO ORGANIZATIONAL DEVELOPMENT, THIS OPPORTUNITY WILL INCREASE THE CAPACITY OF ONE COMMUNITY HEALTH TO SUPPORT IMPROVED DATA SAFETY AND THE EFFICIENCY OF ONGOING PATIENT HEALTH CARE FOR PEOPLE LIVING WITH HIV (PLWH). THE U.S. DEPARTMENT OF HEALTH & HUMAN SERVICES HEALTHCARE EMERGENCY PREPAREDNESS INFORMATION GATEWAY STATES THAT "RECENT CYBERATTACKS ON HEALTHCARE FACILITIES HAVE HAD SIGNIFICANT EFFECTS ON EVERY ASPECT OF PATIENT CARE AND ORGANIZATIONAL CONTINUITY." TO ENSURE OCH IS PREPARED IN THE EVENT A CYBERATTACK, THE ORGANIZATION MUST DEVELOP A ROBUST CYBERSECURITY PLAN AND IMPLEMENT CYBERSECURITY BEST PRACTICES. WITH THE RYAN WHITE PART C CAPACITY DEVELOPMENT FUNDS, OCH WILL DEVELOP A CYBERSECURITY EMERGENCY PREPAREDNESS PLAN AND TRAIN STAFF ON THESE NEW SECURITY MEASURES TO ENSURE AN ORGANIZATION-WIDE COLLABORATIVE APPROACH TO INCREASED SECURITY EFFORTS. LEVERAGING ATTACKS RANGING FROM EMAIL (PHISHING, SPEAR PHISHING, WHALING, AND BUSINESS EMAIL COMPROMISE) TO SOCIAL ENGINEERING, EMERGENCY PREPAREDNESS IS KEY AS OCH UNDERSTANDS THAT IT IS NOT A MATTER OF IF, BUT WHEN, OCH WILL BE COMPROMISED. SUMMARY OF PROPOSED ACTIVITY AND INTENDED IMPACT: OCH PROPOSES TO HIRE A CONSULTING CHIEF INFORMATION OFFICER FOR THE DURATION OF THE RYAN WHITE PART C CAPACITY DEVELOPMENT PROGRAM YEAR TO CONDUCT THE FOLLOWING ACTIVITIES, INCLUDING BUT NOT LIMITED TO: - IMPLEMENT MANAGED DETECTION A ND RESPONSE FOR ALL WORKSTATION AND SERVER ENDPOINTS, NETWORK, AND LOGS. O OBJECTIVE: EARLY DETECTION AND RESPONSE TO THREATS. - IMPLEMENT MANAGED VULNERABILITY SERVICE. O OBJECTIVE: EARLY DETECTION AND PREVENTATIVE RESPONSE TO OUTSIDE THREATS. - PROVIDE SECURITY AWARENESS TRAINING TO OCH STAFF. O OBJECTIVE: ENSURE STAFF ARE ADEQUATELY AWARE ON HOW TO RECOGNIZE CYBER THREATS. - IMPLEMENT SECURITY PROGRAM MATURITY ASSESSMENT. O OBJECTIVE: DEVELOP A SECURITY FRAMEWORK PLAYBOOK FOR OCH. - IMPLEMENT SECURITY INCIDENT RESPONSE PLANNING. O OBJECTIVE: DEVELOP A SECURITY INCIDENT RESPONSE POLICY AND PROCEDURES. THE INTENDED IMPACTS OF THESE ACTIVITIES ARE TO CREATE A SECURE ENVIRONMENT WHEREIN PATIENTS' ELECTRONIC PROTECTED HEALTH INFORMATION IS PROTECTED, MITIGATING RISK TO ENSURE WE CAN MEET A STANDARD OF CARE THAT WILL BEST SERVE OCH'S PATIENTS IN THIS NEW CYBER ENVIRONMENT. GRANT PROGRAM FUNDS REQUESTED: $150,000 FUNDING PREFERENCE: OCH IS REQUESTING A FUNDING PREFERENCE FOR THIS PART C APPLICATION BECAUSE THE AGENCY MEETS ALL CRITERIA NECESSARY FOR THIS FUNDING PREFERENCE. THE FUNDING PREFERENCE IS OUTLINED IN ATTACHMENT 7.