In this lesson,
we're going to perform an external assessment.
Now, the exact checklist and procedures
that you're going to use to perform an external assessment
are going to vary,
depending on your organization's own governance, risk,
and compliance practices.
But, for the video, we will be using a sample checklist
from the Government of San Bernardino County in California
as a demonstration of the kind of questions asked
during an external assessment or audit
for an organization that must comply with HIPAA Regulations.
To prepare for a HIPAA external assessment,
you should go through the checklist
provided by your assessors
and ensure that you can answer each question
as "Yes" or "No,"
and then provide a link to a file
as evidence that you meet that requirement.
Okay, here is the "HIPAA Audit Checklist."
For example, the first line, under the General Information,
states that you must complete the enclosed
"HIPAA Privacy and Security Performance Audit Survey."
Now, if you have completed it, you just simply mark "Yes,"
and then you'll add the link,
the file of your organization's share drive
or external file sharing portal like Dropbox, Google Drive,
OneDrive,
or wherever else that you have been asked to provide,
your evidence files, for this assessment.
Now, let's take a quick look at the other types of things
that you may be asked to provide
during your HIPAA Assessment.
Now, if we scroll down to the HIPAA Security,
we see we have the General Governance - HIPAA security.
We must be able to identify
any applicable industry guidance such as studies, practices,
regulations, or other reference material
used to develop any of the policies and procedures
requested below.
No need to provide this documentation, simply identify.
So again, it's going to be a "Yes" or "No" question,
and then we're going to indicate
where that particular file or document is.
But, per this statement,
we don't need to provide any documentation.
We scroll down,
we see under General Governance - HIPAA Security;
Security Officer contact information.
We have name, email, phone number, address,
and admin contact info.
And now, we see under Administrative Safeguards,
do we have an entity-level risk assessment?
Do we have risk assessments for systems
that house electronic, protected health information?
Do we have a risk management policy, organizational chart,
et cetera?
So, we're going to scroll down and go to the next section.
We already looked at the category
of Administrative Safeguards.
Now, the Physical Safeguards.
Do we have physical security policies and procedures,
data destruction and media reuse procedures,
a list of roles based access, job level,
and level of protected health information access
needed for function,
a log of employees
based on their protected health information access type?
And then, if we look at the other category
of Technical Safeguards,
do we have encryption policies and procedures?
Do we have management's internal control/internal audit
policies and procedures related to monitoring IT safeguards?
Also, do we have system generated user access
listing up all individuals
with access to the system housing the PHI?
Now, let's scroll down again to the Privacy section.
Now we see a category
for General Governance and HIPAA Policy.
The first question says,
"Identify any applicable industry guidance against studies,
practices, regulations, or other reference materials
used to develop any of the policies and procedures
requested below."
Again, on this particular section,
no need to provide documentation; simply identify.
So, do we have compliance, privacy,
officer contact information, email, phone number,
address, et cetera?
I'll just scroll down here, just to see other documentation.
In the last section we have here,
it's the HITECH Organization Process-Based Capabilities.
And now, the acronym HITECH
stands for Health Information Technology
for Economic and Clinical Health.
Now, the HITECH Act was created
to motivate the implementation of electronic health records
and supporting technologies for the United States.
That's just a general background about HITECH.
So again, it's just going to ask;
"Do we have breach notification processes,
entity level risk assessment documentation,
and capabilities?"
And of course, if yes, say "Yes."
If no, say "No," and then provide the file location
for that particular information.
So, as you can see,
these external assessments can be pretty broad
and they are seeking to get a quick overview
of your organization's current risk posture
through a truly independent, third-party assessor.
These assessments and audits will not do anything
to fix your security issues,
but instead, they are used as a validation function
to prove that your organization
is meeting a certain level of compliance
to attempt to minimize its attack surface,
and that is prepared to defend itself
against known cybersecurity threats and risk.