Information Security Awareness and Training

Human Resources

Safety/Security

Research Compliance

Compliance

Privacy/Information Security

Business Operations

Intellectual Property

Faculty

Identification Card | Secure Area Card Access | Privacy/Confidentiality | Computer Use/Electronic Information | Retention and Destruction/Disposal of Private and Confidential Information | Use and Disclosure of Protected Health Information | Notice of Privacy Practices | Access to Designated Record Set | Accounting of PHI Disclosures | Patient/Consumer Complaints | Vendors | Fax Transmissions | Psychotherapy Notes | Facility Security | Conditions of Treatment Form | Informed Consent for UNMC Media | Transporting Protected Health Information | Honest Broker | Social Security Number | Third Party Registry | Information Security Awareness and Training | Patient Privacy Investigations and Levels of Violation | Use and Disclosure of PHI for Training Health Care Professionals | Disclosures of PHI as Permitted or Required by Law | Disclosure of PHI for Law Enforcement Purposes

Policy No.: 6301
Effective Date: 07/14/16
Revised Date: draft 09/22/22
Revised Date:

Information Security Awareness and Training Policy

Basis for Policy

Nebraska Medicine/UNMC implements reasonable and appropriate access controls in alignment with National Institute of Standards and Technology (NIST) standards and guidance to maintain the minimum necessary access. NIST Special Publication 800-53 and the HIPAA Security Rule outline considerations for the access control family of security controls.

Policy

Nebraska Medicine/UNMC implements reasonable and appropriate security awareness and training in alignment with National Institute of Standards and Technology (NIST) standards and guidance.NIST Special Publication 800-53 and the HIPAA Security Rule, the Family Educational Rights and Privacy Act (FERPA), and Payment Card Industry Data Security Standards (PCI/DSS) outline considerations for the security awareness and training family of security controls. Nebraska Medicine/UNMC will strive to reach a level of security awareness both to prevent improper access to or use or disclosure of Protected Information and to ensure detection and reporting of any improper access, use or disclosure that may occur.

Procedure

General

Workforce will be required to take security training, usually in the form of on-line video training or onsite workshops. Each member of the Workforce will be required to take security training within thirty (30) days of commencing their position at Nebraska Medicine/UNMC and on an annual basis thereafter.

Security Awareness Training Provided By Information Security

• Basic security awareness training to all Workforce (including managers, senior executives, and Board members) as part of initial training during the onboarding process and annually thereafter.
• Including security awareness training on recognizing and reporting potential indicators of insider threat.
• Including training on recognizing and reporting phishing.

Content

Content of training will be role-based and relevant to the type of Protected Information created, accessed, used or disclosed. For Workforce with access to electronic Protected Health Information (PHI) as defined under HIPAA such training will include, but not be limited to, user education concerning virus protection and malicious software; user education in the importance of monitoring login success/failure, and how to report discrepancies; and user education in password management. The content of training will be periodically reviewed and updated to reflect changes to information security threats, techniques, requirements, and responsibilities which includes information about, but is not limited to, the following:

• Personal device access to the network,
• Removal of sensitive information,
• Acceptable use of USB devices,
• Protection from malicious software,
• User authorized access,
• Password management and requirements,
• WiFi usage,
• Use of social media, and
• Security incident reporting.

In addition to training, the security awareness and training program will include the following:

• Scheduled awareness surveys
• Unscheduled awareness assessments periodically to assure compliance with the training
• Feedback surveys to improve the security awareness and training program

Security Training Records

A record of training completion and results of assessments will be maintained for each member of the Workforce. For employees, the record will be maintained in the personnel files by Human Resources, as part of the permanent record. Records for faculty, volunteers, students, trainees and others will be maintained by the responsible administrative department.

Security Reminders

• Information Security or Information Technology shall provide Workforce members with periodic security reminders and updates.
• Information Security will provide role-based security training to personnel with assigned security roles and responsibilities, including but not limited to procedures for guarding against, detecting and reporting malicious software; monitoring log-in attempts and reporting discrepancies; and creating, changing and safeguarding passwords.
• Security updates and reminders shall be communicated through various methods, including but not limited to: emails, newsletters, electronic banners and posters.

Compliance

Failure to comply with this policy by employees will be subject to UNMC Policy 1098, Corrective and Disciplinary Action Policy. Legal action may be taken for violations of any applicable law.

Record Retention

UNMC will retain a copy of this policy and any revisions thereto, all training materials and all training records in accordance with UNMC Policy 6056, Retention and Destruction/Disposal of Private and Confidential Information and the UNMC Record Retention Schedule.

Definitions

Information Security

The ability to control access and protect information from unauthorized alteration, destruction, loss or accidental or intentional disclosure to unauthorized persons.

Protected Health Information (PHI)

Individually identifiable health information including demographic information, collected from an Individual, whether oral or recorded in any medium, that:

• is created or received by UNMC/ACE; and
• relates to the past, present or future physical or mental health or condition of an Individual; the provision of health care to an Individual; or the past, present or future payment for the provision of health care to an Individual and identifies the Individual or with respect to which there is a reasonable basis to believe the information can be used to identify the Individual.

PHI includes genetic information, which includes information about the following items (and excludes information about an Individual’s sex or age):

• an Individual’s genetic tests;
• the genetic tests of an Individual’s family members; or
• the manifestation of a disease or disorder in such Individual’s family members (i.e., family medical history); or
• any request for, or receipt of, genetic services (e.g., genetic test, genetic counseling, genetic education), or participation in clinical research which includes genetic services by the Individual or any family member of the Individual.

PHI excludes:

• individually identifiable health information of a person who has been deceased for more than fifty (50) years.
• education records covered by the Family Educational Rights and Privacy Act (FERPA); and
• employment records held by UNMC in its role as employer.

Workforce

Employees, medical staff, volunteers, trainees and other persons whose conduct, in the performance of work for Nebraska Medicine/UNMC, is under the direct control of Nebraska Medicine/UNMC, whether or not they are paid by Nebraska Medicine/UNMC.

Additional Information

• Contact Office of Information Security or 402-559-2545.
• UNMC Policy No. 6045, Privacy/Confidentiality
• UNMC Policy 1098, Corrective and Disciplinary Action Policy
• UNMC Policy No. 6051, Computer Use/Electronic Information
• UNMC Policy 6056, Retention and Destruction/Disposal of Private and Confidential Information
• UNMC Record Retention Schedule
• NIST Special Publication 800-53
• HIPAA Security Rule

This page maintained by mh.