ADVANCED DATA SOLUTIONS
DATA RECOVERY EXPERTS
San Diego & WorldWide
 Enterprise-RAID-ARRAY- NAS-SAN-SERVER
 External USB Hard Drive or Internal Disk-SSD
Dropped-Water-Fire-Virus-Deleted Damaged

ADS HIPAA Network Safeguards

ADS HIPAA Account Managment

ADS HIPAA Administration

ADS HIPAA Reallocation & Disposal of Media

ADS HIPAA Risk Analysis

ADS HIPAA Use of Portable Devices

ADS HIPAA EHR

ADS HIPAA Hitech Act







                                                                                 ADS HIPAA Network Safeguards            TOP
                                                                                                      HIPAA Core Policy:
                                                                                   Information Systems and Network Access
 

 Abstract:

This policy establishes the minimum criteria for granting approved access to information systems.

Effective Date:

3/23/2016

Applies to:

Staff.

1. PURPOSE: To establish guidelines for the minimum criteria for granting approved access to information systems involving protected health information (PHI).

2. PHILOSOPHY:   Authorized individuals should be able to access information systems based on minimum necessary privileges.

3. APPLICABILITY:   This policy applies to all ADS staff.

4. ASSOCIATED INFORMATION:

4.1. Definitions:

4.1.1. Appropriate Information Security Officer (ISO): The entity’s ISO who acts in conjunction with the HIPAA Security Office for ADS.

4.1.2. Authentication mechanism: Items including, but not limited to, passwords, tokens, biometrics, and smart cards used for confirming a user’s identity.

4.1.3. Business Associate: A person or entity (other than an employee of ADS) who performs a function or activity involving the use or disclosure of protected health information.
4.1.4. Direct Need-to-Know: Those persons or classes of persons, as appropriate who need access to specific protected health information to carry out their work-related duties.

4.1.5. Electronic Communication Network: This includes things such as the Internet, wireless, or wired network.

4.1.6. Electronic Protected Health Information (ePHI):  Protected health information in electronic form.

4.1.7. HIPAA: Health Insurance Portability and Accountability Act.

4.1.8. Minimum Necessary:  To make reasonable efforts to limit the use or disclosure of, and requests for, PHI to the minimum necessary to accomplish the intended purpose.

4.1.9. Portable Computing Devices (PCDs): Include, but are not limited to, hand held devices (e.g. laptop computers, tablet PCs, notebook computers), Smart phones, portable workstations on wheels and carts, biomedical devices that collect patient information or provide life support and medical treatment, and pagers that store data. Portable computing devices are battery operated (though they may support direct connection to utility power), freestanding devices used for the purposes of data storage, retrieval, analysis, and exchange. Such devices may interact with other networked systems, the internet, desktop personal computers via some form of interconnection and/or synchronization process.
4.1.10. Portable Storage Devices (PSDs): Include, but are not limited to, external hard disk drives, DVDs, CDs, flash drives, USB drives, tapes, and other portable storage devices capable of acting as a transport agent for digital information.

4.1.11. Protected Health Information (PHI): Health information, including demographic information collected from an individual and created or received by a health provider, health plan, employer or health care clearinghouse that relates to the past, present, or future physical or mental health or condition of any individual; the provision of health care to an individual; or the past, present, or future payment for the provision of health care to an individual, and that identifies an individual or there is a reasonable basis to believe the information can be used to identify the individual and that is transmitted or maintained by electronic media or any other form or medium. PHI does not include individually identifiable health information in education records covered and protected by the Family Educational Right and Privacy Act and employment records held by a covered entity in its role as an employer.

4.1.12. Remote Access: Users outside of a covered entity’s network accessing data on the entity’s network.

4.1.13. Sensitive Information: Any information that may only be accessed by authorized personnel. It includes protected health information, financial information, personnel data, trade secrets and any information that is deemed confidential or that would negatively affect ADS if inappropriately handled.

4.1.14. Strong Passwords: Current industry best practices identify this as a minimum of eight  alpha-numeric characters with at least one upper-case and one special character.

4.1.15. User: Any individual who accesses ADS electronic protected health information assets.

4.1.16. User Account: Information used by a user to gain access to ADS ePHI resources. This includes, but is not limited to, user IDs, passwords, personal identification numbers (PIN), tokens, certificates, biometrics, and smart cards.

4.1.17. User ID: An individual ID used to identify a unique individual when logging into a ADS information resource such as a computer network, service, or application.

5. POLICY:

5.1. Requests for access to ADS's ePHI shall be granted only to individuals with a direct need to know.

5.2. Approval will be based upon minimum necessary privileges and the direct need to know for a specific job function.

 5.3. In situations where work is performed by any non-ADS employee on a system containing ePHI, it is the responsibility of the appropriate manager to seek pre-approval for access and to monitor the individual's activities on the system. Non-ADS employees must have an approved Business Associate Agreement (if there is a possibility of accessing PHI) prior to request for approval to access information resources of a covered entity.

 5.4. Transmission of PHI or other sensitive information over an electronic communication network shall be encrypted.

 5.5. Network personnel shall not open ports through any firewall without pre-approval from appropriate management or information security office. Approved requests shall be documented.

 5.6. Use of portable devices to store ePHI must be pre-approved by the appropriate information security office and must be properly secured with proper physical and software controls in accord with the HIPAA Security Core Policy, "Use of Portable Devices."

 5.7. All requests for phone lines shall be approved by the ADS Communications Department or HSF Telecommunications.

 5.8. Any external access to a ADS network containing ePHI (i.e., dial-in modems) or internal access to outside networks (i.e., DSL lines) that bypasses the ADS and ADSHS firewalls shall be approved by the appropriate information security office.

 5.9. Access for non-ADS personnel must be uniquely identifiable and submitted in writing to the appropriate information security office prior to receiving access. The written request for access shall describe the reason and duration of the need (to include an anticipated termination date). This written request must describe the nature of access, reference the Business Associate Agreement (BAA) if needed, contain sufficient information to identify potential risk, and meet the minimum necessary requirement. If granted, the access must be documented, noting the date when granted.

 5.10. Requests for access to ePHI sytems utilized for Institutional Review Board-approved research shall be reviewed against the above established criteria on a case by case basis.

 5.11. All networks containing ePHI shall utilize measures to prevent unauthorized devices from connecting to the network.

 5.12. User's responsiblities:

5.12.1. Shall follow the ADS and their department's system security procedures, i.e., security patches, anti-malware protection, anti-spam protection. Exceptions shall be approved by the appropriate information security office.

 5.12.2. Shall not implement systems that function as a bridge between ADS network containing ePHI/sensitive information and an external network, i.e., split tunneling.

 5.12.3. Shall log off applications containing ePHI/sensitive information when not in use. Also shall lock the computer screen or log off windows when not in use.

 5.12.4. Shall not share their access codes or passwords with other individuals.

 5.12.5. Shall not perform unauthorized scanning on a ADS network. Scanning activities must be pre-approved by the appropriate information security office. Examples include but are not limited to Nmap scans, Nessus assessments, port scans, phone sweeps, probing tools, and other similar scanning activities.

 5.12.6. Shall not attempt unauthorized or inappropriate access to any ADS system including those containing ePHI or other sensitive information.

 5.12.7. Shall apply the same security policies and procedures as is required in the workplace when accessing ADS resources containing ePHI regardless of the location (i.e., applying necessary access lists, software or network firewalls, access controls, etc., when at home or other off-site location).

 5.13. System Administrator responsibilities:

5.13.1. Shall report unapproved portable devices to the appropriate manager.

 5.13.2. Shall implement and maintain the latest security patches on the systems under their management.

 5.13.3. Shall implement and maintain anti-malware software on the systems under their management.

 5.13.4. Shall apply automatic logoff/lockout features for inactive user sessions (i.e., 15 minutes logoff in high volume/traffic areas as per industry best practices or local policy).

 5.13.5. Shall use separate, unique user accounts to ensure individual accountability.

 5.13.6. Shall establish user accounts and accounts with higher privilege, i.e., system administrator, supervisor, root, superuser, in a manner that ensures individual accountability.

 5.13.7. Shall not establish group user accounts.

 5.13.8. Shall grant minimum necessary and direct need-to-know access rights as applicable to the person's documented job function. The appropriate i,formation security office shall approve additional access rights.

 5.13.9. Shall establish emergency access procedures for the systems they manage.

 5.13.10. Shall keep and monitor logs in order to detect and document attempts to compromise accounts, password brute force, and other types of abuse.

5.14. Manager responsibilities:

5.14.1. Shall ensure users follow policies for use of portable devices in accord with the HIPAA Security Core Policy, "Use of Portable Devices".

 5.14.2. Shall routinely monitor to ensure users are aware of and in compliance with the security policies including those addressing portable devices and home workstations.

 5.14.3. Shall establish procedures in written or electronic form to cpmply with this policy and if action, activity, or assessment is required by this policy to be documented, maintain a written or electronic record of the action, activity, or assessment.

 5.14.4. Shall ensure Business Associates are aware of and in compliance with all of the HIPAA and HITECH security requirements.

5.15. Business Associates' responsiblities:

5.15.1. All Business Associates shall be required to sign an approved Business Associate Agreement.

 5.15.2. Business Associates must comply with ADS policies and standards applicable to the nature of their work with ADS.

5.16. Remote access:

5.16.1. Requests for remote access must be reviewed and approved. Security control used to safeguard sensitive information will be evaluated. Remote access accounts should be periodically reviewed. Examples of minimum security controls include unique user ID, strong password, two-factor authentication, session timeout, and secure connection.

 5.16.2. Remote users when accessing ePHI systems shall use a ADS-approved Virtual Private Network (VPN) solution.

5.17. Violations

5.17.1. Violations of these policies may result in disciplinary action, up to an including dismissal and civil and criminal penalties.

 5.17.2. Business Associates must comply with ADS policies applicable to the nature of their work with ADS. Business Associates who do not follow applicable requirements could be subject to breach of contract penalties, possible legal prosecution, civil and criminal penalties, and other legal remedies/ramifications as are available to ADS.

 5.18. CONTACTS: For questions regarding the requirements, implementation, and enforcement of this policy, contact one of the following:

5.18.1. Your HIPAA Security Officer hippa@adv-data.com or call 619-452-1234.
6. REFERENCES: None

 7. SCOPE: This policy applies to all ADS Staff.

                                                                                      ADS HIPAA Account Managment       TOP
                                                                                        HIPAA Core Policy:
                                                                                      Information Systems Account Management
 

Abstract:

This policy sets forth guidelines for establishing minimum criteria for user account management.

Effective Date:

3/23/2016

Applies to:

Staff

 

1. PURPOSE: To establish minimum criteria for user account management.

2. PHILOSOPHY: Data available through ADS information systems, shall be maintain confidentiality, integrity, availability, and accountability.

3. APPLICABILITY: This applies to all ADS staff.

4. ASSOCIATED INFORMATION:

4.1. Definitions:

4.1.1. Account Administrator: Individuals who are charged with adding, disabling, and modifying access granted to users and other types of accounts such as service accounts.

4.1.2. Authentication mechanism: Items such as, but not limited to, passwords, tokens, biometrics, and smart cards.

4.1.3. Minimum Necessary: To make reasonable efforts to limit the use or disclosure of, and requests for, PHI to the minimum necessary to accomplish the intended purpose.

4.1.4. Separation: The cessation of an individual’s authority to occupy any role and perform any responsibilities on behalf of ADS. This may occur through the resignation of personnel, the dismissal of personnel or the termination of contractual agreements.

4.1.5. Strong passwords: Current industry best practices identify this as a minimum of eight alphnumeric characters with at least one upper case and one special character.

4.1.6. User account: An established relationship between a user and a computer network, service, or application. User accounts are assigned a user ID and are uniquely identifiable and traceable to one user or entity. 

4.1.7. User ID: An individual ID used to identify a unique individual when logging into an information resource such as a computer, network, service, or application. synonymous with sign-on code.

4.2. Background Information: Access is determined by position, role, and/or responsibility. If an employee’s position, role, and/or responsibility change, system access shall be reevaluated as to its applicability. If the user believes that his/her account has been compromised, the user must contact their information systems help desk to report the occurrence and change his/her account information.

5. POLICY:

5.1. Unique User Identification 

5.1.1. All users must have a standard unique identifier (user ID) assigned for accessing ADS information resources.

5.1.2. Whenever possible, ADS information resources shall prohibit concurrent or simultaneous access by the same user ID except in cases where business use has been deemed necessary and appropriate and authorized by management. 

5.1.3. Generic user IDs shall only be allowed where the functions accessible or activities carried out by the ID do not need to be traced or autdited.

5.1.4 Service accounts used for communications between systems and to operate services within a server environment shall be unique and shall be held confidential by the system administrators. ADSIT and ADSHS HSIS shall establish auditable procedures to securely maintain and access service accounts by systems administrators.

5.2. A user’s account shall be promptly deactivated upon notification of separation of his relationship with ADS.

5.3. Users shall be given the minimal necessary access privileges to perform their duties. If a user’s position, role, and/or responsibility changes the user’s account privileges shall be reevaluated and modified (if necessary) by their manager to match the minimum necessary for the current position’s responsibilities.

5.4. All systems and applications are required to use at least a user identifier (typically a user ID) and an authentication mechanism, i.e. password, token, biometrics, smart card.

5.5. Minimally each department or clinical area shall have a designated written authorization process for granting access to ADS information resources. This process shall include a procedure for validating a user’s identity and notifying the user’s supervisor. Such a process shall include how the person granting access is identified. This person shall be a specifically identified individual who grants others access to resources.

5.5.1. All account requests shall at least include the last four digits of a user’s social security number or an equivalent, such as employee number or logon ID.

5.5.2. All users requesting an account shall be required to provide their name as it appears on their personnel records (if applicable), department, title, phone number, and their supervisor’s name and email address.

5.6. A process to document initial account requests shall be in place for each system.

5.7. Personnel shall notify the appropriate information systems help desk of any account violations.

5.8. Newly implemented systems and current systems with the capability shall comply with the following policies. Existing systems without the capability shall use their maximum available security features and work to comply with the following policies as systems are upgraded.

5.8.1. All systems shall enforce strong password selection.

5.8.2. All systems shall have audit trail capabilities that provide documented evidence of user access.

5.8.3. Passwords shall not be viewable to users or system administrators.

5.8.4. Passwords shall be stored encrypted on the system.

5.8.5. Default passwords and PINs shall be changed.

5.8.6. Guest accounts shall be disabled.

5.8.7. The system shall prompt a user to choose a new password upon initial access to the system or after his account has been reset.

5.9. Users’ Responsibilities:

5.9.1. Users shall protect account information and prevent use of their IDs, passwords, PINs, and tokens by others.

5.9.2. Users shall access information appropriately – with individually-assigned accounts and in compliance with ADS standards and policies.

5.9.3. Users shall not re-use expired passwords for at least 4 password-expiration cycles.

5.9.4. Users shall choose a new password upon initial access to the system and each time the password is reset by the administrator – to the extent that password change capabilities are supported by the system.

5.9.5. Users shall choose strong passwords – to the extent that strong password capabilities are supported by the system.

5.9.6. Users have a responsibility to close or log off applications or lock the workstation immediately after use.

5.9.7. Users shall provide account administrators with their manager’s contact information (name, e-mail and phone number) when directly requesting access to information resources.

5.9.8. Vendors and contractors shall not be granted access to without approval of the ADS sponsoring department. Access requests shall be submitted by the vendor’s/contractor’s assigned ADS management contact.

5.9.9. Users shall contact the appropriate system administrator for password resets and user account issues.

5.9.10 Users shall not verbally reveal their password to the helpdesk or any other person asking for the password. If the helpdesk needs the password, it will be a reset.

5.10. Account Administrators’ Responsibilities:

5.10.1. Account administrators shall notify the user’s manager when the user submits a direct request for access.

5.10.2. Account administrators shall add, modify, and disable user accounts upon notification from the appropriate manager.

5.10.3. Account administrators shall periodically analyze system logs to determine accounts that may have been compromised.

5.10.4. Account administrators shall not accept access requests from vendors or contractors. Access requests for vendors and contractors shall be submitted by ADS management with oversight for the vendors’/contractors’ activities.

5.10.5. Account administrators shall ensure that systems are configured to comply with this policy.

5.11. Managers’ Responsibilities:

5.11.1. Managers shall ensure and justify appropriate access for those under their supervision – including employees, vendors, contractors, and other third parties.

5.11.2. Managers shall provide account administrators with a projected separation date or contract termination date when requesting user accounts for temporary employees, vendors, contractors, and other third parties.

5.11.3. Managers shall ensure that access rights are the minimum necessary and commensurate with current job responsibilities for all individuals under their supervision.

5.11.4. Managers shall review, approve, and submit requests for the user accounts of those individuals under their supervision.

5.11.5. Managers shall ensure that individuals under their supervision are trained to access and use ADS information resources.

5.11.6. Managers shall enforce standards, policies, and procedures associated with the use of ADS information resources.

5.11.7. Managers shall notify relevant account administrators upon an employee’s termination or transfer and upon a vendor’s, a contractor’s, or another third-party’s completion of service.

5.12. ADS employees who do not follow the above policies may be subject to disciplinary action up to and including dismissal.

5.13. Vendors or contractors who do not follow the above policies may be subject to breach of contract penalties.

5.14. CONTACTS: For questions regarding the requirements, implementation, and enforcement of this policy, contact one of the following:

5.14.1. Your HIPAA Security Officer hippa@adv-data.com or call 619-452-1234.

6. ENFORCEMENT: Any user found to have violated this policy maybe subject to disciplinary action, up to and including termination of employment or assignment, depending on the severity of the infraction. In addition, ADS may report the matter to civil and criminal authorities as may be required by law.

7. REFERENCES: None

8. SCOPE: This standard applies to all ADS staff.

9. ATTACHMENTS: None

​

                                                                                  ADS HIPAA Administration       TOP
                                                                                                     HIPAA Core Policy:
                                                                                                    HIPAA Administration
 

 Abstract:

This policy ensures that ADS staff, implement certain human resources requirements to protect against the wrongful use or disclosure of protected health information (PHI) in compliance with the Health Insurance Portability and Accountability Act ("HIPAA").

Effective Date:

6/7/2016

Responsible Party:

Applies to:

Staff

​1. PURPOSE: To ensure that ADS staff, implement certain administrative requirements to protect against the wrongful use or disclosure of protected health information (PHI) in compliance with the Health Insurance Portability and Accountability Act (“HIPAA”).

2. PHILOSOPHY: ADS values and promotes business practices among its staff members, to provide privacy and security of PHI.

3. APPLICABILITY: This policy applies to all ADS staff.

4. DEFINITIONS: ADS adopts the definitions set forth in the HIPAA regulations 164.308 Administrtrative Safeguards.

5. POLICIES:

5.1. Identifying HIPAA Covered Entities

5.1.1. When a new unit, department, is established, Legal Counsel will assess and deterine whther or not the new entitie will be designates as a HIPAA covered entity, according to the definition and other guiding documentation provided by the Federal HIPAA regulations.

5.1.2. Upon review of a HIPAA Privacy Core Policy, Legal Counsel and the Privacy Officer will reassess each ADS HIPAA covered entity identified in the "applicability" section of the policy to ensure that each continues to qualify as a HIPAA covered entity.

5.2. Personnel Designations 

5.2.1. ADS shall designate a HIPAA Privacy Officer who is responsible for maintaining the policies and procedures regarding health information privacy. The Privacy Officer will work with the ADS HIPAA Covered Entities’ Entity Privacy Coordinators to communicate and implement these policies and procedures.

5.2.2. ADS shall designate a HIPAA Security Officer who is responsible for maintaining the policies and procedures regarding health information security. The Security Officer will work with the ADS HIPAA Covered Entities’ Entity Security Coordinators to communicate and implement these policies and procedures.

5.3. Workforce Training

5.3.1. ADS shall train all staff members on its HIPAA-related policies and procedures. 

5.3.2. This training is required for all workforce members of ADS. It should be completed within the first 30 days (for VIVA, 60 days) of employment or assignment.

5.3.3. Successful completion of this training will be documented.

5.4. Disciplinary Actions

5.4.1. ADS, through its Human Resources Departments, shall apply disciplinary actions against members of the workforce who fail to comply with ADS’s HIPAA policies and procedures or applicable laws regarding PHI.

5.4.2. The Human Resources Department will consider all relevant factors in determining the nature and severity of the disciplinary action: the type of violation, the intent of the workforce member at the time of the violation, and the number and frequency of any prior violations. Cumulative disciplinary actions may be imposed on an individual who commits more than one violation.

6. REFERENCES: None

7. SCOPE: This standard applies to all ADS Covered Entities.

8. ATTACHMENT: None

                                                                                 ADS HIPAA Reallocation & Disposal of Media  TOP
                                                                                                    HIPAA Core Policy:
                                                                                                   Media Reallocation and Disposal
 

 Abstract:

This policy establishes guidelines for the secure reallocation and disposal of media that contain sensitive data.

Effective Date:

3/21/2016

 

Applies To:

ADS Staff.

1. PURPOSE: To establish policy for the secure reallocation and disposal of media that contain sensitive data.

2. PHILOSOPHY: Information in all forms and throughout its life cycle should be protected from unauthorized access, modification, destruction, or disclosure, whether accidental or intentional. Improper handling and disclosure of information poses a significant risk to ADS.

3.APPLICABILITY: This-policy-applies-to-ADS-staff-members.
 4. ASSOCIATED INFORMATION:

4.1. Definitions:

4.1.1. Protected Health Information (PHI): Health information, including demographic information, collected from an individual and created or received by a health provider, health plan, employer or health care clearinghouse that relates to the past, present, or future physical or mental health or condition of any individual; the provision of health care to an individual; or the past, present, or future payment for the provision of health care to an individual, that identifies an individual or there is a reasonable basis to believe the information can be used to identify the individual, and that is transmitted or maintained by electronic media or any other form or medium. PHI does not include individually identifiable health information in education records covered and protected by the Family Educational Right and Privacy Act and employment records held by a covered entity in its role as an employer.

4.1.2. Sensitive information or data: Any information that may only be accessed by authorized personnel. It includes PHI, financial information, personnel data, trade secrets, and any information that is deemed confidential or that would negatively affect ADS if inappropriately handled.

4.1.3. Media: Physical objects on which data can be stored such as hard drives, disks, CDs, tapes, paper, and other storage devices.

4.1.4. Reallocate: The assignment of media from one party within ADS to another party within ADS so it can be used for a different purpose.

4.1.5. Disposal: The permanent removal of media as a ADS information asset.

4.1.6. Authorized Personnel: Persons appointed or given authority by ADS Administration to take a given action or serve in a given role.

4.1.7. Secure Disposal Vendor: A third party contracted to sanitize media on the behalf of ADS. The media to be sanitized, shall be placed in the vendor’s specially marked containers. Note: ADS’s various secure disposal vendors have specific guidelines regarding the amount of non-paper products that may be placed in the vendors’ containers.

4.1.8. Clean: To render information on media inaccessible, unless special software or techniques are used. Some examples include formatting and re-imaging media.

4.1.9. Sanitize: To expunge data from media or to render it in such a state that recovery of said data is reasonably impossible. Formatting and re-imaging the media are not acceptable forms of sanitization. The use of overwriting software in accord with provisions in this policy is an acceptable form of sanitization.

4.1.10. Physical Destruction: To render media in such a state that recovery of information from the media is reasonably impossible. This is a form of sanitization. Some examples include pulverizing, mangling, and the use of an appropriate shredder. A secure disposal vendor may also be used.

4.1.11. Damage: To render media in such a state that it cannot be accessed by standard methods. However, data on the media may be accessed using special techniques. For example, bending a disk such that it cannot be read by the drive does not comply with provisions in this policy. Damaging media is not an acceptable form of sanitization.

4.1.13. Secure Location: An area or place with restricted and monitored access.

5. POLICY:

5.1. Sensitive information shall not be removed from its designated ADS area without the approval of ADS Administration.

5.2. Media shall be cleaned or sanitized only by authorized personnel.

5.3. Media containing non-sensitive information shall be cleaned or sanitized prior to being reallocated.

5.4. Media containing sensitive information must be sanitized prior to being reallocated.

5.5. Equipment containing mass storage devices, either removable or non-removable media (including hard disks, flash memory, optical discs, magnetic tape, etc.), with sensitive data shall be reasonably secured at all times to reduce the risk of data and equipment loss.

5.6. Unused equipment containing mass storage devices (including desktop and laptop computers, servers, printers, copiers, fax machines, biomedical equipment, cameras, smartphones (e.g., IPhone, etc.) that is slated for disposal or reallocation shall be sanitized and processed as soon as possible to reduce the risk of data and equipment loss.

5.7. A log shall be kept to verify sanitization or destruction of the media containing sensitive information.

5.8. Sanitization methods include:

5.8.1. Use of overwriting software to expunge all data from the media.

5.8.2. Physically destroying the media.

5.8.3 Use of a degausser to reduce the magnetic flux of the media to virtually zero, thereby expunging all data from the media. The degausser used shall be appropriate for the media being sanitized.

5.9. Media containing sensitive information shall not be placed in the regular trash.

5.10. Secure disposal vendor services shall only be used for the disposal of sensitive information.

5.11. Non-sensitive information shall be placed in regular trash disposal containers.

5.12. ADS employees, vendors, and contractors shall report policy violations to the appropriate Data Security Office.

5.13. ADS employees who do not follow the above policies may be subject to disciplinary action up to and including dismissal.

5.14. Vendors or contractors who do not follow the above policies may be subject to breach of contract penalties.

5.15. CONTACTS: For questions regarding the requirements, implementation, and enforcement of this standard, contact one of the following:

5.15.1. Your HIPAA Security Officer hippa@adv-data.com or call 619-452-1234.

6. REFERENCES: None

7. SCOPE: This standard applies to all ADS staff covered under HIPAA and their systems that maintain PHI.

8. ATTACHMENTS: None.