Privacy and Security Policies

15.1 Privacy and Security Policy Administration

• Key Terms and Definitions
• Policy Designation Form
• Statement of Understanding
  

15.2 Privacy and Security Board
15.3 Management Oversight
15.4 Privacy Officer/Security Officer
15.5 Sanctions for Violations
15.6 Reporting Potential Problems in Privacy and Security

• Incident Reporting Form

15.7 Incident Response

• Incident Reporting Form
• Incident Reporting Plan to Level 2 Incidents
• Incident Response Team

15-8 Privacy, Security Training

• Privacy and Security Training Requirements

15-9 Minimum Necessary Access

• Sensitive Information Inventory Tool

15-10 Acceptable Use

• The embedded asset has been deleted:
  Asset Type: Document_C
  Asset Id: 1251623181398
  PAGENAME: CDPHE-Main/Document_C/CBONDefault

15-11 No Private Computer Usage
15-12 Password Management

• Password Reset Form
• Password Reset Log
• Strong Password Guidelines

15-13 Password Protected Screensavers

• Instructions for Installing Password-Protected Screensavers

15-14 Verification Procedures
15-15 Transmitting Sensitive Information

15-16 Login Monitoring
15-17 Access control

• Secure External User ID Form , with  Supplemental Sheet
• Secure Internal User ID Form with  Supplemental Sheet

15-18 Workstation Security

• Workstation Security Guidelines  
• Wireless Security Guidelines
• Wireless and Modem Use Guidelines
• Laptop and Remote Access Computer Acceptable Use Guidelines
  • Strong Password Guidelines   
  • Key Terms and Definitions

15-19 Secure Facilities

• Facilities Security Plan

15-20 Faxing

• Key Terms and Definitions

15-21 Device and Media Control

• Electronic Recycling Resources

15-22 Computer Monitors, Printer and Copier Locations
15.23 Recycling Materials with Identifiable Information
15.24 Securing Work Materials with Identifying Information
15-25 Encryption
15-26 Authorizations
15-27 Data privacy and security
15-28 Permitted uses/disclosures
15-29 Research
15-30 HIPAA status
15-31 Business associate status
15-32 Marketing/fundraising
15-33 Designating sensitive Information
15-34 Risk Assessments
15-35 Risk Management
15-36 Business Continuity
15-37 Grant Vendor Management
15-38 Change Control
15-39 Audit and Evaluation
15-40 Documentation
15.41 Confidentiality of laboratory and radiation services division records
15.42 Incident response mitigation
15.43 Privacy impact assessments
15.44 Investigation of research misconduct
15.45 Remote access of medical records