Overview
Document reference: PL-A-100-1004
Capitalized terms not defined in this Statement of Work will have the meanings set forth in the MSA.
Scope of Work
Under this Statement of Work for Virtual Chief Information Security Officer (“vCISO”), PatientLock, LLC (“PatientLock”) agrees to provide ______________________________, (the “Customer”) with certain described services (“Service”).
Service - vCISO Scope of Work shall include:
Security Strategic Planning
HIPAA/NIST Security Governance and Compliance Program
HIPAA/NIST Security Policy Assessment and Remediation
Security Incident Response Program
Security Risk Status Reporting
Security Corrective Action Planning
Ad-hoc hours (if necessary)
Service Work Order Schedule
The duration of this Service Order is 36-months, beginning on the Effective Date. Within seven (7) business days of execution of this Service Order, PatientLock will initiate a kick-off-call with the Customer. For services requiring implementation services, PatientLock expects implementation process to be completed within thirty (30) days following kick-off-call. This assumes timely response and cooperation from Customer’s internal resources.
Service Definitions: vCISO Security Strategic Planning
PatientLock will work with the Customer’s key stakeholders in developing a high level Three-year Strategic Security Plan. The plan will be based on known identified threats and vulnerabilities to the organization as well as planning for future emerging threats.
The three-year strategy will address business objectives while carefully prioritizing IT Security threats to the organization.
The strategy will outline a Three-year Security Plan with supporting tactical initiatives phased over quarters, one-year, two-year, and three-year planning. If no recent risk analysis or suitable security audits are available, PatientLock, as part of the initial planning, may choose to assess the current "security maturity" of the organization using methods as agreed with the Customer as a baseline metric going forward. The security maturity will be a "key driver" in developing people, process, and technology related milestones. Strategic and tactical initiatives will be recommended and implemented driving the overall security maturity rating and enterprise towards a more "Mature and Lower Risk" environment.
Deliverables
Current Security Maturity Assessment, as needed, outlining key information systems and related security processes/systems for the protection of ePHI.
High-level, three-year strategic plan with tactical initiatives and estimated budget requirements, resource requirements, prioritization, and initiative start dates.
vCISO – Security Governance and Compliance Program
PatientLock will assist the Customer in establishing the organization’s security and compliance program. One of the program’s basic goals will be to create a Security and Compliance Committee responsible for overseeing the objectives of the program. The integration of the Information Security Program under the guidance of the Customer’s leadership will enhance the security and compliance efforts and increase the effectiveness of security regulations and other compliance programs, better positioning the Customer to respond to changes in the risk landscape, technology, and industry regulations, while effectively managing security and privacy risks to the organization.
PatientLock will assist Customer in the formation of a committee, develop a charter, and will provide advisory services. PatientLock resources will advise and assist the committee and may attend committee meetings but shall not have a seat on the committee, nor a vote on committee actions.
To further this effort, the purpose of the Information Security and Compliance is to:
Establish a routine checkpoint that allows for discussions related to information security initiatives.
Develop, coordinate, and sustain the organization's information security programs.
Review Information security regulatory considerations applicable to the organization and document ownership of regulatory requirements.
Review and advise on security issues as they relate to protecting sensitive data such as PII, PHI, etc.
Provide the status of current information security investigations.
Coordinate and respond to information security risk issues.
Develop and update information security policies and procedures.
The goal of the Information Security and Compliance Committee is to establish, implement, and maintain systemwide best practices for visibility of information security principles that are aligned with industry regulations. To further this effort, the committee will:
Review information, security threats and risk assessments annually.
Coordinate and communicate information security risk issues to ensure they receive systemwide attention, in addition to adequate and timely responses throughout the Customer’s organization.
Work to ensure that the information security program is an active and sustained program, reflected in day-to-day roles, responsibilities, and business processes.
Determine, review, and update information security controls key performance indicators, and security metrics.
Develop, update, and verify third party vendor privacy and information security requirements.
PatientLock will work with the Customer in identifying key personnel to serve on the Information Security and Compliance Committee.
Deliverables
Creation of an Information Security and Compliance Committee with a charter, key stakeholders, and a strategic roadmap.
vCISO – HIPAA/NIST Security Policy Assessment and Remediation
PatientLock will conduct a high-level assessment of the Customer’s inventory of security policies and procedures. PatientLock will utilize a gap analysis tool in evaluating all HIPAA/NIST policies and procedures and will provide, as a deliverable, a copy of the tool and documentation outlining those policies, both those that meet the Code of Federal Regulations (CFR) and those that are missing or not up to code. In addition, PatientLock will provide “White Label” templates of the most used security policies, thereby enabling Customer to facilitate rapid remediation.
PatientLock will provide executive advisement to the Customer in preparation and remediation of any policy and procedure needed.
Deliverables
Full set of HIPAA/NIST compliant policies and procedures:
HIPAA Security Policies to support the HIPAA Security Rule
45 CFR § 164.306 – Security Standards: General Rules
45 CFR § 164.308 – Administrative Safeguards
45 CFR § 164.310 – Physical Safeguards
45 CFR § 164.312 – Technical Safeguards
45 CFR § 164.314 – Organizational Requirements
45 CFR § 164.316 – Policies and Procedures and Documentation
NIST CSF Security Policies to adhere to the framework.
Procedures for HIPAA/NIST Policies.
Incident Response and Security Program Development (6-8 weeks)
PatientLock will provide guidance to establish people, process, and technology for compliance with the CFR § 164.308(a)(6) HIPAA Security Rule to assist the development of a process to promptly detect and respond to security incidents that may create a threat or risk to the ePHI that is maintained in the Customer’s information systems.
PatientLock will assist the development of a process to promptly detect and respond to Security Incidents that may create a threat or risk to the ePHI that is maintained in the Customer’s information systems. PatientLock uses NIST 800-61r2 framework for developing the Customer’s Computer Security Incident Response (CSIR) program.
Deliverables
Formation of a Security Incident Response Team (CSIRT)
Procedure and Run-Book to support Customer’s CSIRT program
Policy Development
Staffing, resource and budget recommendations
vCISO – Security Risk Status Reporting
vCISO will assist to identify, track, and report on the Top-10 identified security risks to the Customer. vCISO will provide a scheduled, executive report to stakeholders detailing the previous reporting period’s Risk Level as it relates to Top-10 risks. Reporting to include advisement and trending for each identified risk.
Deliverables
PatientLock will provide an executive-level report on agreed upon internals to Customer key stakeholders highlighting the previous reporting period’s Risk Level as it relates to each of the Top-10 identified security risks within the organization.
vCISO – Security Corrective Action Planning
PatientLock will compile and organize key findings, prioritized risks and identified risk themes from the Customer’s most recent Baseline Security Review, Risk Analysis, Policy Assessment, Physical Review, and/or other security audits into a cohesive set of comprehensive and prioritized remediation (corrective action) plans tailored to Customer need.
Deliverables
Bi-weekly Corrective Action Planning meetings and ongoing management of high-level remediation plans.
vCISO – Ad Hoc Hours
Ad hoc hours are provided for use for projects or tasks identified by Customer outside the current scope of projects and tasks listed in the proposal. Additional projects or tasks identified as out of scope will be discussed and agreed upon by Customer and PatientLock.
Acceptance of Deliverables
If requested documents and/or interviews are not delivered/scheduled by agreed-upon milestone dates, delivery of draft and final deliverables will be delayed accordingly. If there are pending deliverables not provided by Customer by the final evidence delivery date, PatientLock will process available evidence and prepare all reports and findings without such evidence being available. Information provided after the final evidence delivery date will not be included in PatientLock’s reports. If delay in providing evidence causes significant rework to PatientLock deliverables, then a change order may be required.
Customer will review and accept each deliverable. If a deliverable is rejected, Customer must indicate all reasons for its rejection. Rejected products that need work will be edited and resubmitted for approval. Unless expressly communicated to PatientLock, all deliverables will be considered accepted within seven (7) business days of confirmed receipt by a representative of Customer.
Customer Responsibilities
The Customer shall designate a qualified and trained “Technical Lead” who will oversee Customer engagement for the implementation of Service. The Technical Lead will oversee the project, track status, facilitate the delivery of the Services and progress of the project, and communicate to Customer stakeholders. The Technical Lead, or other appointed person, shall serve as the Customer’s agent to manage the Agreement and authorize such matters as change orders or similar issues as they arise related to the Services.
Assumptions
This Statement of Work has been prepared under the following assumptions:
Customer
The Customer shall furnish, in a timely manner, all resources including personnel, systems, information, and software necessary to commence Service implementation.
The Customer shall designate an appropriately qualified and trained Technical Lead throughout engagement.
The Customer retains authority and responsibility for decisions made regarding Service implementation.
The Customer will be responsible for project management and coordination of Customer resources necessary to complete the Service implementation.
The Customer is responsible for coordinating, following, and communicating in a timely manner all internal processes (Change Management, SDLC, etc.).
The Customer is responsible for the quality of data and any remediation efforts that may be necessary to complete the Service implementation.
The Customer is accountable for all non-oral output, including documentation, plans, recommendations, diagrams, etc.
The Customer is responsible for any direct or physical remediation.
PatientLock
Shall provide resources from Service Provider who are trained on the products, technologies, and services applicable to this Scope-of-Work.
Will be responsible that all communications, notifications, and alerts will be provided by the Service Provider to Customer.
General Provisions
Staffing
PatientLock has assembled a team of cyber security professionals and project managers, including the Service Provider, to oversee the fulfillment of this Service Order.
Project Start Date
Project Start Date is typically within 30-Days of the Effective Date.
Project Duration
36-months (standard).
Project Fees
See accompanying Service Order.
Arrange signatures
Contact PatientLock to prepare the agreements for your organization or discuss requested changes.
Request a signing copy