Overview
Document reference: PL-C-100-1006
Capitalized terms not defined in this Attachment will have the meanings set forth in the MSA.
Scope of Work
Under this Scope of Work for a HIPAA/HITECH Security Risk Assessment, PatientLock agrees to provide ____________________________ (“Customer”) with certain described services (“Service”). PatientLock intends to use subcontractors in connection with the Service under this Statement of Work.
The Security Risk Assessment is in support of the HIPAA Security Rule, subparts 45 CFR 164.306 – 45 CFR 164.316 (the “Rule”) and Meaningful Use Security Core Measure.
PatientLock uses a phased approach to achieve the objectives of a comprehensive HIPAA/HITECH compliance assessment. The Security Risk Assessment will be conducted in accordance with NIST (National Institute of Standards and Technology) SP 800-30 Rev. 1.0.
HIPAA Security Risk Assessment will include the following areas of HIPAA Security:
Administrative Safeguards (45 CFR § 164.308) Security management process, assigned security responsibility, workforce security, information access management, security awareness training, security incident procedures, contingency plan, evaluation, business associate contracts, and other contracts.
Physical Safeguards (45 CFR § 164.310) Facility access control, workstation use, workstation security, device and media control.
Technical Safeguards (45 CFR § 164.312) Access control, audit control, integrity controls, person or entity authentication, transmission security.
Organizational Requirements (45 CFR § 164.314) Business associate documents or other arrangements, business associate contracts, business associate contracts with subcontractors.
Policies and Procedures and Documentation Requirements (45 CFR § 164.316) Implementation, retention, availability and review of documentation.
Notification in the Case of Breach of Unsecured Protected Health Information (PHI) (45 CFR § 164.400-414) Notification to individuals, media, HHS Secretary, by a Business Associate, law enforcement delay, administrative requirements and burden of proof.
This Scope follows the nine steps of the Security Risk Assessment as defined in NIST (National Institute of Standards and Technology) SP 800-30 Rev 1.0.:
Step 1: Scope of Assessment
Identify the scope of the engagement.
Entities and locations to be examined.
Applications, Infrastructure, Network and Data Center.
Documents to be reviewed.
Stakeholders to be interviewed.
Step 2: Data Collection*
Review documentation provided – policy, procedures, checklists, standards (IT Risk Management, IT Security Charter, Roadmap, Projects, IT Operations, IT Risk Management).
Conduct interviews with stakeholders (or designee) – HIPAA Security & Privacy Officer, CIO, CTO, CMIO, CCO, CRO, HR, training, etc. to assess the knowledge of HIPAA compliance.
Assess compliance with policy, procedures, checklists, standards and HIPAA Regulations.
Personnel interviews - office managers, compliance contacts, IT personnel.
Inspection of medical centers and IT Closets to assess physical security.
* At Customer’s request, assessments, interviews and inspections can be completed on-site for an additional fee.
Step 3: Identify and Document Threats and Vulnerabilities
Review meeting minutes and summaries from assessments, interviews, inspections and document reviews.
Identify, review and discuss gaps in controls.
Document the gaps in controls and review with Customer for correctness.
Step 4: Assess Current Security Measures
Document current security technologies (anti-virus, malware, Firewall, IDS, IPS, DLP, SIEM, Security Monitoring, email gateway).
IT Security Department roles and responsibilities.
IT Security Processes – Firewall/IPS/IDS Management, change management, user-access provisioning, privilege access management, DR/BCP, security monitoring and resolution, Incident Response.
IT Security Controls in place.
Step 5: Determine Likelihood of Threat Occurrence
Review the gaps/exceptions identified during document review, inspections, interviews and assign likelihood rating.
Step 6: Determine the Potential Impact of Threat Occurrence
Review the gaps/exceptions identified during document review, inspections, interviews and assign impact rating based on harm to the application, infrastructure and organization patient care, safety and confidentiality of patient data.
Step 7: Determine the Level of Risk
The risk analysis process should assign a risk rating, taking into account the likelihood/impact of the risk and the residual risk after factoring in the controls in place.
Probability and impact values are primarily determined qualitatively. High impact risk determination includes semi-quantitative methods derived from current industry trends (Source - US CERT, Ponemon Institute, OCR Breach Statistics).
Step 8: Finalize Documentation
HIPAA Security Risk Assessment Report.
Corrective Action Plan containing Risk Ratings, Remediation Roadmap and specifics of the engagement.
Executive Summary Report.
Step 9: Periodic Review and Updates to the Risk Assessment
The risk analysis process should be ongoing. In order for an entity to update and document its security measures “as needed,” which the Rule requires, it should conduct continuous risk analysis to identify when updates are needed.
Prepare a strategy to monitor the Remediation Plan and to conduct periodic risk assessments.
Deliverables
PatientLock will provide the following deliverables as part of this engagement:
HIPAA Security Risk Assessment Report.
Corrective Action Plan containing Risk Ratings, Remediation Roadmap and specifics of the engagement.
Executive Summary Report.
Acceptance of Deliverables
The Customer will review and accept each deliverable. If a deliverable is rejected, Customer must indicate all reasons for its rejection. Rejected products that need work will be edited and resubmitted for approval. Unless expressly communicated to PatientLock, all deliverables will be considered accepted within 7-business days of confirmed receipt by a representative of the Customer.
Assumptions
This Statement of Work has been prepared under the following assumptions:
Customer
Shall furnish, in a timely manner, all resources including personnel, systems, information, and software necessary to commence Service implementation.
Shall designate an appropriately qualified and trained Technical Lead or point of contact throughout the engagement.
Retains authority and responsibility for decisions made regarding Service engagement.
Shall be responsible for project management and coordination of Customer resources necessary to complete the Service engagement.
Shall be responsible for coordinating, following, and communicating in a timely manner, all internal processes (Change Management, SDLC, etc.).
Shall be responsible for the quality of data and any remediation planning that may be recommended as a result of the Service engagement.
Shall be accountable for all non-oral output, including documentation, plans, recommendations, diagrams, etc.
PatientLock
Shall provide resources who are trained on the products, technologies, and Services applicable to this Statement of Work.
General Provisions
Staffing
PatientLock has assembled a team of cyber security professionals and project managers to oversee the fulfillment of this Service.
Project Start Date
Project start date is typically within 30-Days of the Effective Date.
Project Duration
Approximately 8-weeks.
Project Fees
Project fees are based on PatientLock’s understanding of the scope at the time of preparing this Statement of Work. Any change in scope or in pricing must be approved by the Customer in advance of performing the work. Travel is not included, and should it be required, it must be approved in advance by the Customer. PatientLock will bill the Customer for travel as incurred.
PatientLock requires a security deposit of 50% for engagement to commence. The remaining balance will be invoiced upon PatientLock’s delivery of the final report. Payment terms are net fifteen (15) days. A finance charge of 1.5-percent per month will be assessed on any unpaid balance after deduction of current payments, credits, and allowances made within 30 days of the billing date. PatientLock reserves the right to stop work on any account that is more than thirty (30) days past due. For rush projects (i.e. projects needing to start within two weeks or less), the total engagement fee is due upon execution of the accompanying Service Order (“Effective Date”) and prior to commencement of work.
The Customer is responsible for payment of any federal, state or local taxes that may be required to be withheld pursuant to any applicable law or regulations. Such tax payments may not be withheld from fees due to PatientLock but should be made by the Customer directly to the authority in addition to payment amounts invoiced by PatientLock. PatientLock is responsible for its own tax payments to federal, state, and local authorities.
The Customer agrees that the Fees for the Services shall commence on execution of the Service Order (“Effective Date”).
Any fees for One-Time Services (e.g., project based or installation charges) shall be invoiced to the Customer at the time the Service Order is executed for such a one-time service.
Terms
The Service provided under this Statement of Work and the Service Order is governed by the executed Master Service Agreement (the “Agreement”) between PatientLock and the Customer.
Arrange signatures
Contact PatientLock to prepare the agreements for your organization or discuss requested changes.
Request a signing copy