PROTECTION FROM MALICIOUS SOFTWARE POLICY # 16 ADMINISTRATIVE MANUAL APPROVED BY: ADOPTED: SUPERCEDES POLICY: REVISED: REVIEWED: DATE: REVIEW: PAGE: HIPAA Security Rule Language: “Implement…..Procedures for guarding against, detecting, and reporting malicious software…..” Policy Summary: Sindecuse Health Center (SHC) must regularly train and remind its workforce members about its process for guarding against, detecting, and reporting malicious software that poses a risk to its information systems. Purpose: This policy reflects SHC’s commitment to provide regular training and awareness to its employees about its process for guarding against, detecting, and reporting malicious software that poses a risk to its information systems. Policy: 1. SHC must be able to effectively detect and prevent malicious software, particularly viruses, worms and malicious code. 2. SHC must develop, implement, and regularly review a formal, documented process for guarding against, detecting, and reporting malicious software that poses a risk to its information systems and data. All SHC workforce members must be regularly trained and reminded about this process. 3. At a minimum, SHC’s malicious software prevention, detection and reporting process must include: Installation and regular updating of anti-virus software on all SHC information systems. Examination of data on electronic media and data received over networks to ensure that it does not contain malicious software. The examination of all electronic mail attachments and data downloads for malicious software before use on SHC information systems. Procedures for members of the workforce to report suspected or Page 1 of 4 Copyright 2003 Phoenix Health Systems, Inc. Limited rights granted to licensee for internal use only. All other rights reserved. PROTECTION FROM MALICIOUS SOFTWARE known malicious software. An appropriate disaster recovery plan for recovering from malicious software attacks. Procedures to verify that all information relating to malicious software is accurate and informative. Procedures to ensure that SHC workforce members do not modify web browser security settings without appropriate authorization. Procedures to ensure that unauthorized software is not installed on SHC information systems. 4. At a minimum, SHC protection from malicious software training and awareness must cover topics including, but not limited to: How to identify malicious software. How to report malicious software. How to effectively use anti-virus software. How to avoid downloading or receiving malicious software. How to identify malicious software hoaxes. 5. Unless appropriately authorized, SHC workforce members must not bypass or disable anti-virus software. Scope/Applicability: This policy is applicable to all departments that use or disclose electronic protected health information for any purposes. This policy’s scope includes all electronic protected health information, as described in Definitions below. Regulatory Category: Administrative Safeguards Regulatory Type: ADDRESSABLE Implementation Specification for Security Awareness and Training Standard Regulatory Reference: 45 CFR 164.308(a)(5)(ii)(B) Definitions: Electronic protected health information means individually identifiable health information that is: Transmitted by electronic media Maintained in electronic media Electronic media means: Page 2 of 4 Copyright 2003 Phoenix Health Systems, Inc. Limited rights granted to licensee for internal use only. All other rights reserved. PROTECTION FROM MALICIOUS SOFTWARE (1) Electronic storage media including memory devices in computers (hard drives) and any removable/transportable digital memory medium, such as magnetic tape or disk, optical disk, or digital memory card; or (2) Transmission media used to exchange information already in electronic storage media. Transmission media include, for example, the internet (wide-open), extranet (using internet technology to link a business with information accessible only to collaborating parties), leased lines, dial-up lines, private networks, and the physical movement of removable/transportable electronic storage media. Certain transmissions, including of paper, via facsimile, and of voice, via telephone, are not considered to be transmissions via electronic media, because the information being exchanged did not exist in electronic form before the transmission. Information system means an interconnected set of information resources under the same direct management control that shares common functionality. A system normally includes hardware, software, information, data, applications, communications, and people. Workforce member means employees, volunteers, and other persons whose conduct, in the performance of work for a covered entity, is under the direct control of such entity, whether or not they are paid by the covered entity. This includes full and part time employees, affiliates, associates, students, volunteers, and staff from third party entities who provide service to the covered entity. Risk means the likelihood that a specific threat will exploit a certain vulnerability, and the resulting impact of that event. Virus means a piece of code, typically disguised, that causes an unexpected and often undesirable event. Viruses are frequently designed to automatically spread to other computers. They can be transmitted by numerous methods: as e-mail attachments, as downloads, and on floppy disks or CDs. Worm means a piece of code, usually disguised, that spreads itself by attacking and copying itself to other machines. Some worms carry destructive payloads that delete files or distribute files; others alter Web pages or launch denial of service attacks. Malicious software means software, for example, a virus, designed to damage or disrupt an information system. Malicious code means an executable application (e.g. Java applet or Active X control) designed to damage or disrupt an information system. Anti-virus software means software that detects or prevents malicious Page 3 of 4 Copyright 2003 Phoenix Health Systems, Inc. Limited rights granted to licensee for internal use only. All other rights reserved. PROTECTION FROM MALICIOUS SOFTWARE software. Responsible Department: Information Systems; WMU OIT Policy Authority/ Enforcement: SHC’s Security Official is responsible for monitoring and enforcement of this policy, in accordance with Procedure # (TBD). Related Policies: Security Awareness and Training Security Reminders Protection from Malicious Software Log-in Monitoring Password Management Renewal/Review: This policy is to be reviewed annually to determine if the policy complies with current HIPAA Security regulations. In the event that significant related regulatory changes occur, the policy will be reviewed and updated as needed. Procedures: TBD Page 4 of 4 Copyright 2003 Phoenix Health Systems, Inc. Limited rights granted to licensee for internal use only. All other rights reserved.