Task 1

Heart Healthy Information Security Policy:
A.
1.
The policy for information security has two different sections – first is managing passwords and second is new user policy. They are discussed in detail as below:
New Users:
When a new user enters the organization, depending upon the roles and responsibilities assigned to the person, he will be given corresponding access rights. With the help of these access rights the person would be able to access the required files and data necessary for his tasks. When these access rights are assigned the user should sign a document, which will list his roles and responsibilities. This document will be co-signed by his supervisor as an agreement. If a user requires elevation in privileges, he will need to get permission from the respecting manager. When new people join organization they will be taken through an orientation program which will give information on security policies, work culture, work place, information security practices etc. Besides orientation program the users will also be trained on topics like remote device protection, password management, content management, file downloads, access levels and its importance and acceptable use of internet and email. These trainings will be mandated for all the new users and after completion of training this will be documented and stored. As per HIPAA guidelines unless all these mandatory trainings are completed they are not given access to the company data and records (HIPAA Security Guidance, 2006). Besides this no user would be allowed to bring external hardware and storage devices like CD, USB storage media, external hard disks etc. in case there is a genuine need for this the user will need to get permission from the manager and IT administration and even then device will be scanned before it enters and leaves the organization.
2.
Password