Last modified: marzo 14, 2025
Policy No. 4204 Security for Sensitive Workstations (For HIPAA) Procedure
Propósito
The purpose of this procedure is to ensure the security of information a sensitive workstation may have access to. Additionally, the procedure provides guidance to ensure the requirements of the HIPAA Security Rule “Workstation Security” Standard 164.310(c) are met.
Alcance
This procedure applies to any PCSD-controlled (see definition in the Data Classification Procedure) workstation. These workstations will be determined by the InfoSec Team.
Procedimiento
Appropriate measures must be taken when using workstations to ensure the confidentiality, integrity, and availability of sensitive information, including protected health information (PHI), and that access to sensitive information is restricted to authorized users.
- PCSD employees using controlled workstations shall consider the sensitivity of the information, including protected health information (PHI) that may be accessed and minimize the possibility of unauthorized access.
- PCSD will implement physical and technical safeguards for all workstations that access electronic protected health information to restrict access to authorized users.
Appropriate Measures Include:
- Restricting physical access to workstations to only authorized personnel.
- Securing workstations (screen lock or logout) prior to leaving the area to prevent unauthorized access.
- Enabling a password-protected screen saver with a short timeout period to ensure that unattended workstations are protected. The password must comply with the PCSD Password Procedure.
- Complying with all applicable password policies and procedures. See PCSD Password Procedure.
- Ensuring controlled workstations are used for authorized business purposes only.
- Never installing unauthorized software on controlled workstations.
- Storing all sensitive information, including protected health information (PHI), on secured network servers.
- Securing laptops that contain sensitive information by using cable locks or locking laptops up in drawers or cabinets.
- Complying with the Portable Workstation Encryption Procedure.
- Complying with the Baseline Workstation Configuration Standard.
- Installing privacy screen filters or using other physical barriers to alleviate exposing data.
- Exiting running applications and closing open documents before leaving the workstation.
- Ensuring that controlled workstations use a surge protector (not just a power strip) or a UPS (battery backup).
- If wireless network access is used, ensure access is secure by following the Wireless Communication Procedure.
Last Update Status:
Updated January 2015
Related Policies and Procedures
- 4204 Uso aceptable
- 4204 Auditoría
- 4204 Escritorio limpio
- 4204 Plan de recuperación en caso de catástrofe
- 4204 Correo electrónico
- 4204 Formación para la concienciación sobre seguridad de los empleados
- Cifrado 4204
- 4204 Contraseña
- 4204 Acceso remoto
- 4204 Seguridad de routers y conmutadores
- 4204 Seguridad para puestos de trabajo sensibles
- 4204 Plan de respuesta de seguridad
- 4204 Seguridad del servidor
- 4204 Instalación del software
- 4204 Seguridad de los servicios del sitio web
- 4204 Comunicación de dispositivos inalámbricos
- 4204 Comunicación de infraestructuras inalámbricas