The file's text, extracted by GovTribe without its formatting.
Attachment J.7 attachment j.7– hipaa Security Compliance plan
HIPAA Security Compliance Plan
(Modified from HIPAA Security Rule Appendix A to Subpart C to Part 164 --Security Standards: Matrix)
Complete the chart below using this example
| Standards |
| Sections |
| Implementation Specifications |
(R)= Required, (A)= Addressable
| Project /Activity |
| Scheduled Completion |
| Security Awareness and Training |
| 164.308(a)(5) |
| Security Reminders |
| (A) |
| Perform gap analysis, develop awareness program |
| 3Q CY 2005 |
| Protection from Malicious Software |
| (A) |
ADMINISTRATIVE SAFEGUARDS (see § 164.308)
| Standards |
| Sections |
| Implementation Specifications |
(R)= Required, (A)= Addressable
| Project /Activity |
| Scheduled Completion |
| Security Management Process |
| 164.308(a)(1) |
| Risk Analysis |
| (R) |
| Information System Activity Review |
| (R) |
| Assigned Security Responsibility |
| 164.308(a)(2) |
(R)
| Workforce Security |
| 164.308(a)(3) |
| Authorization and/or Supervision |
| (A) |
| Workforce Clearance Procedure |
| (A) |
| Termination Procedures |
| (A) |
| Information Access Management |
| 164.308(a)(4) |
| Isolating Health Care Clearinghouse Function |
| (R) |
| Access Establishment and Modification |
| (A) |
| Security Awareness and Training |
| 164.308(a)(5) |
| Security Reminders |
| (A) |
| Protection from Malicious Software |
| (A) |
| Security Incident Procedures |
| 164.308(a)(6) |
| Response and Reporting |
| (R) |
| Contingency Plan |
| 164.308(a)(7) |
| Data Backup Plan |
| (R) |
| Disaster Recovery Plan |
| (R) |
| Emergency Mode Operation Plan |
| (A) |
| Testing and Revision Procedure |
| (A) |
| Application and Data Criticality Analysis |
| (A) |
(R)
| Business Associate |
| 164.308(b)(1) |
| Written Contract or Other Arrangement |
| (R) |
Contracts and other Arrangements
PHYSICAL SAFEGUARDS (see § 164.310)
| Standards |
| Sections |
| Implementation Specifications |
(R)= Required, (A)= Addressable
| Project /Activity |
| Scheduled Completion |
| Facility Access Controls |
| 164.310(a)(1) |
| Contingency Operations |
| (A) |
| Facility Security Plan |
| (A) |
| Access Control and Validation Procedures |
| (A) |
| Workstation Use |
| 164.310(b) |
(R)
| Workstation Security |
| 164.310(c) |
(R)
| Device and Media Controls |
| 164.310(d)(1) |
| Disposal |
| (R) |
| Data Backup and Storage |
| (A) |
| Standards |
| Sections |
| Implementation Specifications |
(R)= Required, (A)= Addressable
| Project /Activity |
| Scheduled Completion |
| Access Control |
| 164.312(a)(1) |
| Unique User Identification |
| (R) |
| Emergency Access Procedures |
| (R) |
| Encryption and Decryption |
| (A) |
| Audit Controls |
| 164.312(b) |
(R)
| Integrity |
| 164.312(c)(1) |
| Mechanism to Authenticate Electronic Protected Health Information |
| (A) |
| Person or Entity Authentication |
| 164.312(d) |
(R)
| Transmission Security |
| 164.312(e)(1) |
| Integrity Controls |
| (A) |
TECHNICAL SAFEGUARDS (see 164.312)
� 45 CFR parts 160, 162 and 164 Health Insurance Reform: Security Standards; Final Rule
TrOOP Facilitation SOW
