Differences

This shows you the differences between two versions of the page.

Link to this comparison view

Both sides previous revision Previous revision
Next revision
Previous revision
physical_security [2015/12/31 15:54]
jillian_nadette_de_leon
physical_security [2016/07/02 17:29]
jillian_nadette_de_leon
Line 1: Line 1:
-1. Only persons identified should have access to a certain computer. There should be permission to access a certain computer. There should be permission to access system from the original user. \\ +##PHYSICAL SECURITY
-1a. Role-based access control shall be implemented.\\ +
-1b. No form is being filled-out when requesting for access of the server.\\ +
-2. Some hospitals are implementing a 1 user is to 1 account policy.\\  +
-2a. Limited access to station should be implemented.\\ +
-3. Only specific application intended for use should be stored in the computer.\\ +
-4. The computer to be used must be fixed in one place and not portable.\\ +
-5. Only selected offices can use USB. Some hospitals disable use of USB.\\ +
-6. Server should be located in a dedicated room. \\ +
-6a. Office of IT people should be separate from the server room.\\ +
-6b. A dedicated facility shall be put in place for data center.\\ +
-6c. A dedicated infrastructure in the hospital which has restricted and limited access to be used for the purpose of housing the servers or data centers shall be put up. At the minimum, a data cabinet shall be installed in lieu of a server room. Clinics may use cloud computing while hospitals may use servers and put up server rooms.\\ +
-7. Any electronic device should be confined and cannot be taken outside the hospital premises and should only be dedicated for hospital use. Exceptions shall include disaster, vaccination,​ among others.\\ +
-7a. Phone for official use is allocated for communication with healthcare providers relating to patient'​s treatment.\\ +
-7b. Bringing of smart phones, laptops, tablets and other electronic gadget should be prohibited inside the medical records area.\\ +
-7c. Capturing of patient data using camera, etc. should not be permitted.\\ +
-7d. Systems not dedicated to handle patient information e.g. mobile phones should not be allowed to be used. +
-8. Budget allocation for the IT infrastructure of the hospitals contained in the annual financial plan.\\ +
-8a. A budget for the setting up of physical infrastructure for the IT equipment for PhilHealth use shall be allocated as part of the capitation fund being provided by PhilHealth.\\ +
-9. CCTV, audit trails are put in place to monitor access of IT investments.\\ +
-10. Only one person is in charge of handling the servers.\\ +
-10a. There must be identified personnel who can access the IT room, e.g. Q.A. for investigations,​ HICC for monitoring.\\ +
-11. Workstation for data collection and processing should be located in a separate area.\\ +
-12. Conduct pre-deployment site assessment.\\ +
-13. In the event that the machine is lost or stolen, deactivate account until retrieved or reported. However, it is best to reset credentials.\\ +
-14. State provisions regarding setting up of infrastructure where physical servers or data center of hospital information system shall be located. Applicability of the existing administrative order containing provisions on IHOMP shall be considered. Implementation of an off-site back-up shall be done if the aforementioned administrative order shall be affected by this proposed set of rule. Information that is backed up shall be encrypted.\\+
  
 +**1. Inventory of Information Technology Physical Devices.**\\
 +The IT personnel shall maintain and update an inventory of all information technology physical devices being used in the facility. The inventory shall include but not be limited to, on premise server equipment, firewall and security devices, client workstations,​ network devices, mobile devices, biometric and authentication devices, as well as other present and future information technology devices that may be relevant for the purposes of PHIE. \\
  
 +**2. Access to Physical Infrastructure**\\ Access to the IT physical infrastructure of the health facility shall be limited to authorized personnel, which will be defined by the participating health care provider. Any special access to the physical infrastructure shall be documented thoroughly. Any unauthorized access to the IT physical infrastructure shall also be documented and escalated to the appropriate decision makers for further investigation and action. \\
  
 +**2.1. Server Access.** The health facility may choose to have either an on premise server, a cloud server environment,​ or a combination of the two. Cloud technology is discussed separately under the cloud services section of this document. Should the health facility choose an on premise server, it shall provide a designated area for the housing of servers or data centers. It shall be a separate room from the data collection and processing as well as from the office of the IT personnel. The server room shall be marked as "​Restricted"​ and shall only be accessible to authorized personnel. The server room shall comply with the physical security ISO 27001 standards.\\
  
 +**2.2. Computer Access.** Pre-deployment site assessment shall be conducted prior to installation of computer workstations in the health facility. Computers shall be accessible to authorized personnel only and role-based system access shall be implemented. Each user shall have on account only. Multiple accounts per user are not allowed. A person requesting for access to a computer shall fill-out a request form. \\
  
-+Anti-glare filters on computer monitors shall be installed. This will not only help reduce glare, but also prevent anyone from seeing what is on the screen unless directly in front of the computer.\\ 
 + 
 +**2.3. Computer Loss.** In case of computer loss, the accounts in the computer system shall be reset and deactivated until it is retrieved or reported. The privacy officer shall implement security incident procedures and contingency plans for such events.\\ 
 + 
 +**3. Bringing of devices outside the health facility. ** Facility-registered devices shall not be brought outside the premises of the health facility except under circumstances where the point of patient encounter is outside the health facility, such as but not limited to, vaccinations,​ remote visits, and other community-oriented activities outside the health facility. In such cases where the devices are brought out of the health facility, proper documentation and security check shall be ensured. At the minimum, the following security components should be in place for the device brought ​ out of the facility:​\\ 
 +1. Hard disk encryption.\\ 
 +2. Data encryption.\\ 
 +3. Wireless network encryption.\\ 
 +4. Role-based access control.\\ 
 +5. Anti-virus software for vulnerable operating systems.\\ 
 +6. Password-protected user access that complies with facility password policies.\\ 
 +7. Encrypted portable devices such as but not limited to, USB drives, secure digital (SD) card drives, re-writable CD, and other present and future devices.\\ 
 + 
 +**4. Bring-your-own-device (BYOD).** Mobile and portable devices that are property of the health facility personnel may be allowed by the health facility, provided that the facility implements strict policies for access, processing, storage, transmission and output of information that may have implications over patient privacy and health information security.\\ 
 + 
 +**4.1. Agreement.** A signed usage agreement has to be submitted by the owner of the BYOD prior to using the device for handling health data and information.\\ 
 + 
 +**4.2. Training.** BYOD users shall undergo annual security training.\\ 
 + 
 +**4.3. Configuration.** The health facility IT personnel shall implement a mechanism that would create an audit trail of system activity by the BYOD user, including log-in attempts, security incidents, and attempts to access files containing personally identifiable information. The mechanism shall also have a provision for remote access by the IT personnel, in such events that privacy of health data and information are compromised. \\ 
 + 
 +**4.4. Device Requirements.** The privacy officer shall approve a checklist of requirements for the BYOD to comply before being certified as usable for the access of health information. At the minimum, the device shall have the following:​\\ 
 +1. Hard disk encryption.\\ 
 +2. Data encryption.\\ 
 +3. Wireless network encryption.\\ 
 +4. Role-based access control.\\ 
 +5. Anti-virus software for vulnerable operating systems.\\ 
 +6. Password-protected user access that complies with facility password policies.\\ 
 +7. Encrypted portable devices such as but not limited to, Flash Drives, secure digital (SD) card drives, re-writable CD, and other present and future devices.\\ 
 + 
 +Mobile devices used for job responsibilities are subject to audits even if an employee owns it.\\ 
 + 
 +Capturing of patient data using camera phones and bringing of unauthorized electronic devices such as cellular phones, laptops, tablets, and cameras inside the medical records area is strictly not allowed.\\ 
 + 
 +**5. Business continuity and Disaster recovery.** The health facility shall implement policies for business continuity and disaster recovery.\\ 
 + 
 +**5.1. Physical backup.**A data backup plan has to be implemented to create and maintain exact copies of the system for handling health information. The backup medium must be defined, and the interval of backup stated. The backup must also be tested for data validity and integrity. Physical backups shall be encrypted and stored outside the health facility and additional physical security measures shall be in place for accessing and securing the physical backups. In such case that a disaster occurs, the privacy officer shall have a disaster recovery team that can be organized quickly and have a protocol in place for data recovery. \\ 
 + 
 +**5.2. Business Continuity.** Business continuity has to be ensured even in place of disasters. The privacy officer shall have identified a minimum set of data requirements for maintaining the health facility processes for their services. The health facility shall also have the ability to transition from “emergency-mode” services, to full services. Hence, the policies for encoding data outside the full services mode shall be in place. \\ 
 + 
 +Events that took place in times of disaster recovery and business continuity shall be documented and reviewed, with updates implemented according to best practices and lessons learned during the disaster period.\\
  
 ##See Also ##See Also
   * [[consolidated_workshop_outputs|Consolidated Workshop Outputs]]   * [[consolidated_workshop_outputs|Consolidated Workshop Outputs]]