Heart-Healthy Insurance Information Security Policy – Recommended Policy Changes.

About Changes
The following policy changes reflect compliance with HIPAA (Health Insurance Portability and Accounting Act). Specifically the HIPAA Security Rule which “establishes national standards to protect individuals’ electronic personal health information that is created, received, used, or maintained by a covered entity” (HHS, n.d.). Password complexity is supported by the National Institute of Standards and Technology (NIST) specifically NIST Special Publication 800-171.
New users
The current new user section of the policy states:
“New users are assigned access based on the content of an access request. The submitter must sign the request and indicate which systems the new user will need access to and what level of access will be needed. A manager’s approval is required to grant administrator level access.”
Recommended Revision:
“New users are assigned access based the roles of the group the user is placed in which is determined by the employment position of the new user. The submitter must sign the request and indicate which access group the new user will be added to. A manager’s approval is required to grant administrator level access. In addition, the new user will have to sign an Acceptable Use Policy which will detail the limitations and expectation of utilizing company information systems, prior to being allowed access to any information system.”
Reason for Change:
Change 1: The original policy made user permissions custom to each user, this would require too much effort for IT to manage each user, and increases the risk of a user gaining more access then they need. Group roles will allow IT to manage default rule sets that can be applied to users with ease. For instance, there would be a “Intern” group and an “Administration” group which would differ greatly in the amount of access allowed.
Change 2: Adding the inclusion of an Acceptable Use Policy will provide evidence on file that the new user understand the restrictions and expectations of using the company’s information systems. The policy can include restrictions based on HIPPA and other health care laws, as they pertain to accessing Private Health Information. If a new user violates the AUP then the company has on file the signed form the user filled out which can be used in assistance with HR to properly punish an offense.
Password Requirements
The current password requirements section of the policy states:
“Passwords must be at least eight characters long and contain a combination of upper- and lowercase letters. Shared passwords are not permitted on any system that contains patient information. When resetting a password, users cannot reuse any of the previous six passwords that were used. Users entering an incorrect password more than three times will be locked out for at least 15 minutes before the password can be reset.”
Recommended Revision:
“Passwords must be at least eight characters long and contain a combination of upper- and lowercase letters, must include at least one numeric value (0 through 9). The password cannot contain three or more consecutive characters of your account name or full name. Shared passwords are not permitted on any system that contains patient information. When resetting a password, users cannot reuse any of the previous six passwords that were used. Users entering an incorrect password more than three times will be locked out for at least 15 minutes before the password can be reset.”
Reason for Change:
Change 1: Including a numeric value to the password will increase the complexity and thus the difficulty for a malicious actor to crack the password.
Change 2: Restricting the use of any significant portion of an account or full name will make password guessing much harder for a malicious actor.

References
HHS. (n.d.). The Security Rule. Retrieved from HSS.gov: http://www.hhs.gov/ocr/privacy/hipaa/administrative/securityrule/