2,654
edits
Information Security Awareness and Training: Difference between revisions
Jump to navigation
Jump to search
m
Information Security Awareness and Training (view source)
Revision as of 14:52, October 5, 2020
, October 5, 2020no edit summary
mNo edit summary |
|||
| (11 intermediate revisions by 2 users not shown) | |||
| Line 20: | Line 20: | ||
<td style="padding:0.5em; background-color:#e5e5e5; font-size:90%; line-height:0.95em; border:1px solid #A3B1BF; border-bottom:solid 2px #A3B1BF" | <td style="padding:0.5em; background-color:#e5e5e5; font-size:90%; line-height:0.95em; border:1px solid #A3B1BF; border-bottom:solid 2px #A3B1BF" | ||
width="20">[[Intellectual Property]]</td> | width="20">[[Intellectual Property]]</td> | ||
<td style="border-bottom:2px solid #A3B1BF" width="3"> </td> | |||
<td style="padding:0.5em; background-color:#e5e5e5; font-size:90%; line-height:0.95em; border:1px solid #A3B1BF; border-bottom:solid 2px #A3B1BF" | |||
width="20">[[Faculty]]</td> | |||
</tr> | </tr> | ||
</table> | </table> | ||
<br /> | <br /> | ||
[[Identification Card]] | [[Secure Area Card Access]] | [[Privacy/Confidentiality]] | [[Computer Use/Electronic Information]] | [[Confidential Information]] | [[Protected Health Information | [[Identification Card]] | [[Secure Area Card Access]] | [[Privacy/Confidentiality]] | [[Computer Use/Electronic Information]] | [[Retention and Destruction/Disposal of Private and Confidential Information]] | [[Use and Disclosure of Protected Health Information]] | [[Notice of Privacy Practices]] | [[Access to Designated Record Set]] | [[Accounting of PHI Disclosures]] | [[Patient/Consumer Complaints]] | [[Vendors]] | [[Fax Transmissions]] | [[Psychotherapy Notes]] | [[Facility Security]] | [[Conditions of Treatment Form]] | [[Informed Consent for UNMC Media]] | [[Transporting Protected Health Information]] | [[Honest Broker]] | [[Social Security Number]] | [[Third Party Registry]] | [[Information Security Awareness and Training]] | [[Patient Privacy Investigations and Levels of Violation]] | ||
<br /><br /> | <br /><br /> | ||
Policy No.: '''6301'''<br /> | Policy No.: '''6301'''<br /> | ||
Effective Date: ''' | Effective Date: '''07/14/16'''<br /> | ||
Revised Date: <br /> | Revised Date: <br /> | ||
Revised Date: <br /> | Revised Date: <br /> | ||
<br /> | <br /> | ||
<big>'''Security Awareness and Training Policy'''</big><br /><br /> | <big>'''Information Security Awareness and Training Policy'''</big><br /><br /> | ||
==Purpose of Policy== | ==Purpose of Policy== | ||
UNMC takes protecting personal or confidential information including, but not limited to, electronic protected health information, education records, and cardholder data that the organization creates, uses, discloses, transmits or stores (collectively, “protected information”) extremely seriously. To help ensure the privacy, security and integrity of protected information, we provide training to the workforce (as defined below). Our goal is to | UNMC takes protecting personal or confidential information including, but not limited to, electronic protected health information, education records, and cardholder data that the organization creates, uses, discloses, transmits or stores (collectively, “protected information”) extremely seriously. To help ensure the privacy, security and integrity of protected information, we provide training to the workforce (as defined below). Our goal is to reach a level of security awareness that reduces the risk of improper access to, or use or disclosure of, protected information. | ||
==Policy== | ==Policy== | ||
UNMC will ensure that its workforce is trained in and understands the organization’s security policies and procedures with respect to protected information in accordance with all applicable laws and mandated standards including, but not limited to, the Health Insurance Portability and Accountability Act of 1996 and the Health Information Technology for Economic and Clinical Health Act and the regulations promulgated thereunder governing the privacy and security of individually identifiable health information (collectively, “HIPAA”), the Family Educational Rights and Privacy Act (“FERPA”), and the Payment Card Industry Data Security Standard (“PCI DSS”). UNMC will strive to achieve a level of security awareness both to prevent improper access to or use or disclosure of protected information and to ensure detection and reporting of any improper access, use or disclosure that may occur. | UNMC will ensure that its workforce is trained in and understands the organization’s security policies and procedures with respect to protected information in accordance with all applicable laws and mandated standards including, but not limited to, the Health Insurance Portability and Accountability Act of 1996 and the Health Information Technology for Economic and Clinical Health Act and the regulations promulgated thereunder governing the privacy and security of individually identifiable health information (collectively, “HIPAA”), the Family Educational Rights and Privacy Act (“FERPA”), and the Payment Card Industry Data Security Standard (“PCI DSS”). UNMC will strive to achieve a level of security awareness both to prevent improper access to or use or disclosure of protected information and to ensure detection and reporting of any improper access, use or disclosure that may occur. | ||
==Required Training== | ==Required Training== | ||
Workforce will be required to take security training, usually in the form of on-line video training and/or onsite workshops. Each member of the workforce will be required to take security training within thirty (30) days of commencing his/her position at UNMC and on an annual basis thereafter. Completion of required training will be tracked by Compliance and the Information Security Officer. | Workforce will be required to take security training, usually in the form of on-line video training and/or onsite workshops. Each member of the workforce will be required to take security training within thirty (30) days of commencing his/her position at UNMC and on an annual basis thereafter. Completion of required training will be tracked by Compliance and the Information Security Officer. | ||
| Line 52: | Line 49: | ||
*Unscheduled awareness assessments periodically to assure compliance with the training. | *Unscheduled awareness assessments periodically to assure compliance with the training. | ||
*Feedback surveys to improve the security awareness and training program. | *Feedback surveys to improve the security awareness and training program. | ||
A record of training completion and results of assessments will be maintained for each member of the workforce. | A record of training completion and results of assessments will be maintained for each member of the workforce within the campus training tracking database. | ||
==Compliance== | ==Compliance== | ||
| Line 59: | Line 56: | ||
UNMC will retain a copy of this policy and any revisions thereto, all training materials, and all training records in accordance with UNMC Policy 6056, [https://wiki.unmc.edu/index.php/Retention_and_Destruction/Disposal_of_Private_and_Confidential_Information Retention and Destruction/Disposal of Private and Confidential Information]. | UNMC will retain a copy of this policy and any revisions thereto, all training materials, and all training records in accordance with UNMC Policy 6056, [https://wiki.unmc.edu/index.php/Retention_and_Destruction/Disposal_of_Private_and_Confidential_Information Retention and Destruction/Disposal of Private and Confidential Information]. | ||
==Definitions== | |||
'''Affiliated Covered Entity (ACE)''' means legally separate covered entities that designate themselves as a single covered entity for the purpose of HIPAA Compliance. Current Nebraska Medical ACE members are: The Nebraska Medical Center, UNMC Physicians, UNMC, University Dental Associates, Bellevue Medical Center, and Nebraska Pediatric Practice, Inc. ACE membership may change from time to time. The Notice of Privacy Practices lists current ACE members. | |||
'''Protected Health Information (PHI)''' is individually identifiable health information. Individually identifiable health information is a subset of health information including demographic information, collected from an individual, whether oral or recorded in any medium that: | |||
*is created or received by ACE and | |||
*relates to the past, present, or future physical or mental health or condition of an individual; the provision of healthcare to an individual; or the past, present, or future payment for the provision of healthcare to an individual. | |||
'''Workforce''' refers to faculty, full and part-time employees (management and staff), volunteers, trainees, students, and any other persons whose conduct, in the performance of work for UNMC, is under the direct control of UNMC, whether or not they are paid by UNMC. | |||
==Additional Information== | ==Additional Information== | ||
*Contact [ | *Contact [https://support.security.unmc.edu Office of Information Security] or 402.559.2545. | ||
*UNMC Policy No. 6045, [ | *UNMC Policy No. 6045, [https://wiki.unmc.edu/index.php/Privacy/Confidentiality Privacy/Confidentiality] | ||
*UNMC Policy 1098, [https://wiki.unmc.edu/index.php/Corrective/Disciplinary_Action Corrective and Disciplinary Action Policy] | *UNMC Policy 1098, [https://wiki.unmc.edu/index.php/Corrective/Disciplinary_Action Corrective and Disciplinary Action Policy] | ||
*UNMC Policy No. 6051, [ | *UNMC Policy No. 6051, [https://wiki.unmc.edu/index.php/Computer_Use/Electronic_Information Computer Use/Electronic Information] | ||
*UNMC Policy 6056, [https://wiki.unmc.edu/index.php/Retention_and_Destruction/Disposal_of_Private_and_Confidential_Information Retention and Destruction/Disposal of Private and Confidential Information] | *UNMC Policy 6056, [https://wiki.unmc.edu/index.php/Retention_and_Destruction/Disposal_of_Private_and_Confidential_Information Retention and Destruction/Disposal of Private and Confidential Information] | ||
*[http://www.sos.ne.gov/records-management/schedule_170.html UNMC Record Retention Schedule] | *[http://www.sos.ne.gov/records-management/schedule_170.html UNMC Record Retention Schedule] | ||
This page maintained by [mailto:dpanowic@unmc.edu dkp]. | This page maintained by [mailto:dpanowic@unmc.edu dkp]. | ||