Group 1 Team Assignment CSEC 630- 9026 Jeff Daniels

Written by: Kevin Alton, Nadia Iqbal, and Alex Polevoy

July 2015

Table of Contents
Introduction.…………………………………………………………………..………….3

Section I: iTrust Threats & Vulnerabilities and Countermeasures.……………..…………..3

Section II:
Recommended Changes to Security Management Policies………...……………..7

Section III:
Adaption of Requirements to Reduce Security Risk……….……………....…......11

Conclusion. …………………………………….…………………………………….…21

References ……………………………………………………………...………………23

Introduction
There are multiple benefits of electronic health records (EHR), which include improved care, quicker access to patient files, and increased physician oversight of care. However, with the benefit of convenience of using EHRs, comes the responsibility of protecting electronic protected health information (ePHI) and safeguarding sensitive patient data. The Health Insurance Portability and Accountability Act (HIPAA) focuses on protecting ePHI with guidelines to ensure organizations have implemented “reasonable and appropriate” security measures to adhere to HIPAA rules and maintain patient confidentiality.
HIPAA requires covered entities to conduct risk assessments to verify compliance and attempt to uncover areas where ePHI is at risk of compromise. This analysis of the iTrust database, as related to the new requirements that iTrust wishes to implement, will discuss the threats and vulnerabilities and the potential impact on the iTrust web application and database.
Section I: iTrust Threats & Vulnerabilities and Countermeasures
A detailed analysis of the iTrust database detected several high-risk vulnerabilities that