CURRENT A2236 INFORMATION SECURITY (PDF).PDF

MARICOPA COUNTY INTERNAL POLICY
Policy Title: Policy Number: A2236
INFORMATION TECHNOLOGY SECURITY Current Adoption
12-10-2014
Date:
Board Agenda
Approved by: Number: C-49-15-026-6-00
BOARD OF SUPERVISORS Original Adoption
12-10-2014
Date:
I. PURPOSE
To protect the security of Confidential Information from Breach, unauthorized
alteration or access.
II. APPLICATION
This Policy applies to County Covered Components as defined in Policy A2233.
III. DEFINITIONS
A. Appointing Authority: An elected official, the single administrative or
executive head of a Department/Special District, or the designated
representative authorized to act in this capacity.
B. Business Associate Agreement: A formal, contractual agreement between
two entities doing business involving PHI.
C. Breach: Impermissible acquisition, access, use or disclosure of PHI that
compromises the security or privacy of the PHI. A breach is presumed unless
the Covered Component or Business Associate (defined in Policy A2241), as
applicable, demonstrates that there is a low probability that the PHI has been
compromised based on a risk assessment of the factors set forth in
45 C.F.R. § 164.402(2).
D. Chief Information Security Officer (or Information Security Officer): The
individual appointed by the Chief Information Officer to serve as the Security
Officer as required by HIPAA regulations (see 45 C.F.R. §164.308(a) (2)).
E. Confidential Information (CI): Confidential and sensitive data that are
protected by federal and/or state legislation (e.g., credit card numbers, social
security numbers, PHI (defined below), username and password
combinations, etc.).

Policy Title: Policy Number: A2236
INFORMATION TECHNOLOGY SECURITY Current Adoption
Date: 12-10-2014
F. Confidential System: Any information System, application, function and/or
dataset that contains, creates, accesses, transmits or receives CI. All PHI-
containing Systems are considered Confidential Systems.
G. Covered Component: A Department or division of a Department that is (1) a
health plan or (2) a health care provider who electronically transmits any
Protected Health Information (PHI).
H. System: Any electronic computing or communications device or the
applications running thereon which can create, access, transmit or receive
data. Systems are typically connected to digital networks.
I. Protected Health Information (PHI): Individually Identifiable Health
Information (IIHI) is any information, whether oral or recorded in any form or
medium, that is created or received by a health care provider, health plan,
public health authority, employer, life insurer, school or university, or health
care clearinghouse, which identifies an individual or with respect to which
there is a reasonable basis to believe the information can be used to identify
the individual, and that: 1) relates to the past, present, or future physical or
mental health or condition of an individual; 2) the provision of health care to
an individual; or 3) the past, present, or future payment for the provision of
health care to an individual. Protected Health Information refers to IIHI that is
transmitted by electronic media, maintained in electronic media or transmitted
or maintained in any other form or medium. However, PHI excludes education
records covered by the Family Educational Rights and Privacy Act, records
described in 20 U.S.C. §1232g(a)(4)(B)(iv), as well as employment records
held by a covered entity in its role as employer.
J. System Administrator: The technical custodian of a Confidential System.
This individual provides the technology and processes to implement the
decisions of the System Owner. In some circumstances, e.g., small systems,
the System Administrator and the System Owner may be the same person.
System Administrators are responsible for the technical operation,
maintenance and monitoring of the Confidential System. These duties include
implementation of technical, physical and administrative safeguards.
K. Security Incident: A security incident is the act of violating an explicit or
implied security policy or control. These include but are not limited to:
1. The attempted or successful unauthorized access, use, disclosure,
modification or destruction of Confidential Information or interference with
a Confidential System or its data
2. Unwanted disruption or denial of service to a Confidential System
3. Changes to Confidential System hardware, firmware, or software
characteristics without the owner's knowledge, instruction, or consent.
Page 2 of 6

Policy Title: Policy Number: A2236
INFORMATION TECHNOLOGY SECURITY Current Adoption
Date: 12-10-2014
L. System Owner: The individual or Appointing Authority who has final
responsibility for Confidential Systems. In some complex Confidential
Systems, the functional responsibility for the Confidential System and the
responsibility for one or more applications or database may lie with more than
one individual. The System Owner usually delegates responsibility for the
technical management of a Confidential System to a System Administrator for
implementation of technical, physical and administrative safeguards.
IV. POLICY
A. Risk Analysis
1. Each department will conduct a Risk Analysis to document the potential
risks and vulnerabilities to the confidentiality, integrity and availability of
CI held by the department as well as an estimation of the security
measures sufficient to reduce the risks and vulnerabilities to a reasonable
and appropriate level. Risk Analysis involves determining what requires
protection, what it should be protected from and how to protect it. Each
department will conduct a HIPAA Risk Analysis specific to the potential
risks and vulnerabilities of PHI.
a. This Risk Analysis will take place annually and whenever there are
significant changes to Confidential Systems, business operations, or
locations of operations.
b. Each department will create, execute and maintain a Risk Analysis
procedure.
c. Decisions regarding access to Confidential Systems and responsibility
for Risk Analysis rest with the System Owner and the Appointing
Authority.
B. Risk Management
1. System Identification
a. Confidential Systems, including databases, spreadsheets, and other
data storage applications, will be tracked and documented in a
countywide database.
b. Systems will be identified as having CI and PHI specifically.
Page 3 of 6

Policy Title: Policy Number: A2236
INFORMATION TECHNOLOGY SECURITY Current Adoption
Date: 12-10-2014
c. Records containing CI must be stored securely. For example, CI may
be stored on a server or on a shared network storage device in an
access controlled area.
d. Systems will be prioritized for data backup, disaster recovery and/or
emergency operations plans (See §IV.C.7 of Policy A2237, Security
and Privacy Breaches, Incidents and Emergencies).
C. HIPAA Controls Evaluation
Policies and procedures related to the security of CI will undergo evaluations
for HIPAA compliance regularly and in response to environmental or
operational changes that could affect the security of CI.
D. Non-Compliance Sanctions
1. Employees who fail to comply with County security policies and
department procedures may face discipline up to and including
termination. Appointing Authorities are responsible for determining and
enforcing appropriate discipline for security violations.
a. In addition to internal disciplinary measures, individuals found in
violation of this Policy may be subject to criminal prosecution, civil
liability, or both.
b. Non-employees (Business Associates, contractors, volunteers, interns,
etc.) may be subject to discipline and/or remedial steps, as determined
by the Appointing Authority, to address failures to comply with County
security policies and procedures and/or terms of applicable
agreements (e.g., Business Associate Agreements).
2. Investigation:
a. Reported violators will be referred to Human Resources who will
request an investigation by the Chief Information Security Office. The
Chief Information Security Office is also authorized to investigate
security concerns identified through means other than a reported
violation, including routine and targeted monitoring activities.
b. The Chief Information Security Office and/or the appropriate
Appointing Authority may authorize investigations of violations of
security policies and procedures as appropriate.
E. System Activity Review Procedures
Page 4 of 6

Policy Title: Policy Number: A2236
INFORMATION TECHNOLOGY SECURITY Current Adoption
Date: 12-10-2014
Each department will create procedures to regularly review Confidential
Systems; determine who has access to these systems; determine who
gained access in the period under review and determine who used
temporary, guest, or “break-glass”/emergency access, etc. (See Policy
A2238, Granting and Terminating Access to Protected Confidential
Information)
F. Chief Information Security Officer
The Chief Information Officer will designate a Chief Information Security
Officer who will be responsible for the development and implementation of
the policies and procedures related to security safeguards for CI.
G. Encryption and Decryption
Encryption may be appropriate, or not, depending on the context in which the
information is managed. When appropriate, based on risk assessment
findings, the County will encrypt files, documents, or other folders that
contain CI before transmitting them.
H. Audit Controls
1. Hardware and/or software mechanisms will be used to record and
examine activity in Confidential Systems.
2. Each Appointing Authority will assign an individual to monitor the activity
of their department’s Confidential System and who will look for unusual
access patterns and take appropriate steps according to department
procedures to report this activity.
3. Departments will use their Risk Analysis and appropriate organizational
factors such as current technical infrastructures to determine what data
must be gathered through audit controls and to determine how often the
audit reports should be reviewed.
I. CI Integrity
a. Each system that contains CI will provide a mechanism to authenticate
that CI has not been breached or accessed or altered without
authorization.
J. Person or Entity Authentication
Page 5 of 6

Policy Title: Policy Number: A2236
INFORMATION TECHNOLOGY SECURITY Current Adoption
Date: 12-10-2014
1. Each department will create a procedure to authenticate users of CI that
meets one or more of the following standards (See Policy A2238
Granting Access to Confidential Information):
a. Require something known only to that individual, such as a password
or PIN
b. Require something that individual possesses, such as a smart card, a
token or a key
c. Require something unique to the individual such as a biometric
identifier including fingerprints, voice patterns, facial patterns or iris
patterns
K. Transmission Security
1. CI will only be electronically transmitted if it is properly protected with the
appropriate controls given the type of CI or encrypted. Each department
will document appropriate methods of transmission, including email, that
protect against unauthorized access to CI.
2. Transmission will include the minimum necessary information for the
appropriate business duty.
3. Departments will document their procedures and implement security
measures to ensure that CI is not improperly modified without detection
until it is disposed of.
Revision History
Version Revision Date Description of Revision
1 10 Dec 2014 Initial version
Page 6 of 6