Employees are required to complete security awareness training within 30 days of being hired and at least once a year thereafter.

The company’s information security policies and procedures are formally documented and reviewed at least once a year.

The company has implemented policies and procedures to safeguard electronic Protected Health Information (ePHI) against unauthorized alteration or destruction.

The company maintains written agreements with vendors and third parties, which include applicable confidentiality and privacy commitments.

The company’s information security policies and procedures are formally documented and reviewed at least once a year.

For service providers, the company performs reviews at least quarterly to confirm personnel comply with security policies and operational procedures.

The company has a formal systems development life cycle (SDLC) methodology that governs the development, acquisition, implementation, maintenance, and changes (including emergency changes) of information systems and related technology requirements.

System documentation shall be subject to revision and change control procedures that maintain an audit trail documenting time-sequenced development and modifications.

The company’s information security policies and procedures are formally documented and reviewed at least once a year.

Operational system checks shall be used, as appropriate, to enforce permitted sequencing of steps and events.

The organization securely disposes of data in accordance with the documented data management process, ensuring that disposal methods are appropriate for the sensitivity of the data.

The company reviews data center access at least once a year.

The company has implemented procedures to guard against, detect, and report malicious software.

The company requires passwords for in-scope system components to be configured in accordance with its policy.

The company restricts remote access to production systems to authorized employees using an approved encrypted connection.

System access shall be restricted to authorized individuals.

Authority checks shall restrict system use, electronic signing, access to operations or system input/output devices, record alteration, and performance of the operation at hand to authorized individuals.

The company limits privileged access to the firewall to authorized users who have a valid business need.

The company has established and implements, as needed, policies and procedures for responding to emergencies or other events (such as fire, vandalism, system failure, or natural disaster) that may damage systems containing electronic Protected Health Information (ePHI).

The company has a formal systems development life cycle (SDLC) methodology that governs the development, acquisition, implementation, maintenance, and changes (including emergency changes) of information systems and related technology requirements.

System documentation shall be subject to revision and change control procedures that maintain an audit trail documenting time-sequenced development and modifications.

The company restricts production change migrations to authorized personnel only.

The company maintains written agreements with vendors and third parties, which include applicable confidentiality and privacy commitments.

The company has established and implements, as needed, policies and procedures for responding to emergencies or other events (such as fire, vandalism, system failure, or natural disaster) that may damage systems containing electronic Protected Health Information (ePHI).

The company has a vendor management program in place that includes: 1. Critical third-party vendor inventory 2. Vendor security and privacy requirements 3. Review of critical third-party vendors at least annually

The company has established and implements, as needed, policies and procedures for responding to emergencies or other events (such as fire, vandalism, system failure, or natural disaster) that may damage systems containing electronic Protected Health Information (ePHI).

The company uses environmental monitoring devices configured to automatically alert management in the event of environmental incidents.

The company’s databases are replicated in real time to a secondary data center, with alerts set up to notify administrators of any replication failures.

For service providers, the company performs reviews at least quarterly to confirm personnel comply with security policies and operational procedures.

The organization securely disposes of data in accordance with the documented data management process, ensuring that disposal methods are appropriate for the sensitivity of the data.

The company has implemented policies and procedures to safeguard electronic Protected Health Information (ePHI) against unauthorized alteration or destruction.

The organization establishes and maintains a documented data management process that addresses, at a minimum: 1. Data sensitivity 2. Data owner 3. Data handling 4. Data retention limits 5. Data disposal requirements The organization aligns these elements with enterprise sensitivity and retention standards and reviews and updates the documentation annually or upon significant changes that could impact this control.

Persons who use closed systems to create, modify, maintain, or transmit electronic records shall validate those systems for accuracy, reliability, consistent intended performance, and the ability to detect invalid or altered records.

The company retains customer transaction data for the duration of the customer account. Historical transaction data is not purged until the account is deleted.

The company’s system evaluates data inputs for compliance with input requirements and generates on-screen alerts when issues with transaction inputs or processing are detected.

Operational system checks shall be used, as appropriate, to enforce permitted sequencing of steps and events.

To establish efficient governance for PII processing.

The organization identifies and documents the specific purposes for which personally identifiable information is processed.

To make data subjects active participants in the decision-making process regarding the processing of their PII, except as otherwise limited by legislation and regulations, through the exercise of meaningful, informed and freely given consent.

The organization establishes and documents a process that enables it to demonstrate whether, when, and how consent for the processing of personally identifiable information (PII) was obtained from PII principals.

The organization obtains and records consent from personally identifiable information principals in accordance with documented processes.

The organization establishes a mechanism that enables individuals to modify or withdraw their consent for the processing of their personally identifiable information.

To minimize the PII which is processed to what is strictly necessary for the legitimate interest pursued by the PII controller and to limit the disclosure of PII to a minimum number of internal and external parties.

The organization establishes and documents a process that enables it to demonstrate whether, when, and how consent for the processing of personally identifiable information (PII) was obtained from PII principals.

The organization obtains and records consent from personally identifiable information principals in accordance with documented processes.

The organization identifies and documents applicable legal, regulatory, and business obligations owed to individuals regarding the processing of their personally identifiable information and establishes measures to fulfill those obligations.

The organization securely disposes of data in accordance with the documented data management process, ensuring that disposal methods are appropriate for the sensitivity of the data.

To limit the use and disclosure of PII for specific, explicit and legitimate purposes and to fulfill the stated purpose(s) or to abide by applicable laws.

Personal data shall not be disclosed, made available, or otherwise used for purposes other than those specified, except: a) With the consent of the data subject, or b) By the authority of law

To retain PII no longer than necessary to fulfill the stated purpose(s) or to abide by applicable laws.

The company retains customer transaction data for the duration of the customer account. Historical transaction data is not purged until the account is deleted.

The organization provides customers with mechanisms or support necessary to enable them to meet obligations owed to individuals regarding the processing of personally identifiable information.

The organization identifies and documents applicable legal, regulatory, and business obligations owed to individuals regarding the processing of their personally identifiable information and establishes measures to fulfill those obligations.

The organization establishes and documents policies and procedures for receiving, handling, and responding to legitimate requests from individuals regarding the processing of their personally identifiable information.

To give data subjects the ability to access and review their PII and to challenge its accuracy and completeness.

To make data subjects active participants in the decision-making process regarding the processing of their PII, except as otherwise limited by legislation and regulations, through the exercise of meaningful, informed and freely given consent.

The company maintains written agreements with vendors and third parties, which include applicable confidentiality and privacy commitments.

To limit the use and disclosure of PII for specific, explicit and legitimate purposes and to fulfill the stated purpose(s) or to abide by applicable laws.

The company has a vendor management program in place that includes: 1. Critical third-party vendor inventory 2. Vendor security and privacy requirements 3. Review of critical third-party vendors at least annually

Secure, computer-generated, time-stamped audit trails shall independently capture the date and time of operator entries and actions that create, modify, or delete electronic records, and shall preserve prior information so changes do not obscure earlier entries. Audit trail documentation shall be retained for at least the same period as the associated electronic records and shall be available for FDA review and copying.

The organization establishes and documents policies and procedures for receiving, handling, and responding to legitimate requests from individuals regarding the processing of their personally identifiable information.

To ensure, through contractual or other means, that third party recipients provide at least equivalent levels of PII protection.

To give data subjects the ability to access and review their PII and to challenge its accuracy and completeness.

The company retains customer transaction data for the duration of the customer account. Historical transaction data is not purged until the account is deleted.

A data controller shall be accountable for implementing and complying with the measures that give effect to the principles set forth in this framework.

The company provides requested information, after verification, in a timely manner either in a portable electronic format or by mail, in compliance with applicable law.

The company has implemented policies and procedures to safeguard electronic Protected Health Information (ePHI) against unauthorized alteration or destruction.

The organization establishes and maintains a documented data management process that addresses, at a minimum: 1. Data sensitivity 2. Data owner 3. Data handling 4. Data retention limits 5. Data disposal requirements The organization aligns these elements with enterprise sensitivity and retention standards and reviews and updates the documentation annually or upon significant changes that could impact this control.

The organization establishes and documents policies and procedures for receiving, handling, and responding to legitimate requests from individuals regarding the processing of their personally identifiable information.

A data controller shall be accountable for implementing and complying with the measures that give effect to the principles set forth in this framework.