Workstation Security (For HIPAA) Policy
1.0 Purpose
The purpose of this policy is to establish security standards and provide guidance for workstationthe securityuse forof <Company Name>all workstations inaccessing orderorganizational resources. The objectives are to ensure the securityconfidentiality, integrity, and availability of information onprocessed or accessed by workstations, including sensitive data such as Protected Health Information (PHI). This policy also aims to ensure compliance with relevant regulatory requirements, such as the workstation andsecurity informationstandards themandated workstation may have access to. Additionally, the policy provides guidance to ensure the requirements ofby the HIPAA Security Rule “Workstation Security” Standard (164.310(c)), arewhere met.applicable.
2.0 Scope
This policy applies to all <Company Name> employees, contractors, workforce members, vendorsvendors, and agents withof athe <Companyorganization Name>-utilizing any workstation (whether organization-owned or personal-workstationpersonally-owned) connectedthat connects to the <Companyorganization's Name>network network.or is used to access, process, or store organizational information.
3.0 Policy Statements
AppropriateAll measuresindividuals subject to this policy must be taken when using workstationsadhere to ensure the confidentiality,following integrityworkstation security requirements:
3.1 General Security Awareness and availability of sensitive information, including protected health information (PHI) and that access to sensitive information is restricted to authorized users. Responsibility
*
Users3.1must Workforce members using workstations shallalways consider the sensitivity of the information, including protected health information (PHI)being thataccessed mayor displayed on their workstation, particularly PHI or other confidential data, and take active steps to prevent unauthorized viewing or access.
* Workstations are provided for authorized organizational business purposes only. Personal use should be accessedminimal and comply with the Acceptable Use Policy.
3.2 Access Control and Physical Security
* Workstations must be physically positioned and secured to minimize the possibilityrisk of unauthorized access.
3.2or <Companyviewing Name>of willsensitive implementinformation. Consider the use of privacy screen filters or other physical andbarriers technicalwhere safeguardsappropriate.
* for all workstations that access electronic protected health information to restrict access to authorized users.
3.3 Appropriate measures include:
Restricting physicalPhysical access to workstations must be restricted to only authorized personnel.
Securingonly.
* workstationsWorkstations must be secured (e.g., screen locklocked or logout)logged priorout) towhenever leavingthe areauser toleaves preventthe unauthorizedimmediate access.
Enablingeven afor brief periods.
* A password-protected screen saver with a short inactivity timeout period to ensure that workstations that were left unsecured willmust be protected.enabled. The passwordPasswords must comply with <Companythe Name>organization's Password Policy.
*
Complying with all applicable password policies and procedures. See <Company Name> Password Policy.
Ensuring workstations are used for authorized business purposes only.
Never installing unauthorized software on workstations.
Storing all sensitive information, including protected health information (PHI) on network servers
Keeping food and drink away from workstations in order to avoid accidental spills.
Securing laptops that containcontaining sensitive information bymust be physically secured when unattended, using methods such as cable locks or lockingstoring laptops upthem in locked drawers or cabinets.
Complying3.3 Technical Safeguards and Configuration
* All workstations must comply with the organization's Baseline Workstation Configuration Standard.
* Only organization-approved software may be installed on workstations. Installation of unauthorized software is strictly prohibited.
* Sensitive information, including PHI, should primarily be stored on designated, secure network servers, not local workstation drives, unless explicitly permitted and adequately protected (e.g., through encryption).
* Workstations must comply with the Portable Workstation Encryption PolicyPolicy, ensuring sensitive data stored locally is encrypted.
* Workstations must utilize appropriate power protection, such as a surge protector or an uninterruptible power supply (UPS/battery backup).
* If wireless network access is used, it must adhere to the security requirements outlined in the Wireless Communication Policy.
Complying3.4 withUser the Baseline Workstation Configuration StandardPractices
Installing* privacyKeep screenfood filtersand orliquids usingaway otherfrom physical barriersworkstations to alleviateprevent exposingaccidental data.damage.
*
Ensuringleaving workstationsfor areextended leftperiods on(e.g., butend loggedof offday), inusers ordershould to facilitate after-hours updates.
Exitexit running applications and close open documents where practical, and ensure the workstation is left powered on but logged off to facilitate necessary after-hours maintenance and updates by IT personnel.
Ensuring4.0 that all workstations use a surge protector (not just a power strip) or a UPS (battery backup).Compliance
If4.1 wirelessCompliance network access is used, ensure access is secure by following the Wireless Communication policyMeasurement
The
designatedComplianceIT Measurement
The(e.g., Precision Computer teamteam) will verify compliance towith this policy through various methods,methods. includingThese may include, but are not limited to, periodic physical inspections (walk-thrus,thrus), videoreview monitoring,of businesssystem toollogs reports,and configuration settings, security audits (internal and external audits,external), and feedbackanalysis of reports from security tools. Feedback will be provided to the policy owner.owner and relevant management.
4.2 Exceptions
Any exception to thethis policy mustrequires beformal, approveddocumented byjustification and advance approval from the designated IT authority (e.g., Precision Computer team in advance. team).
An4.3 employeeEnforcement
Failure by any individual subject to have violated this policy to adhere to its requirements may beresult subject toin disciplinary action, up to and including termination of employment.employment or contract, consistent with organizational procedures. Access privileges may also be modified or revoked.
Users should familiarize themselves with the following related organizational documents:
* Acceptable Use Policy
* Password Policy
*
Portable Workstation Encryption Policy
*
Wireless Communication policy
*
Baseline Workstation Configuration Standard
* Data Classification Policy (Implied reference via "sensitive information")
HIPPA 164.210
http://www.hipaasurvivalguide.com/hipaa-regulations/164-310.php
About HIPPA
http://abouthipaa.com/about-hipaa/hipaa-hitech-resources/hipaa-security-final-rule/164-308a1i-administrative-safeguards-standard-security-management-process-5-3-2-2/
None.