| Mapping practice activities against CISS |
| Standard |
Yes |
No |
If answered no |
Roles and responsibilities
Our practice has:
- designated team members who champion and manage computer and information security
- appropriate position descriptions to document these roles and responsibilities.
|
|
|
- Include a written policy that is communicated to practice team members.
- Assign and train a computer security coordinator.
|
Information security policies and procedures
Our practice has:
- documented policies and procedures for managing computer and information security.
|
|
|
- Include a policy that covers practice team and external service provider agreements.
- Where applicable, include an eHealth records system policy.
|
Managing access
Our practice:
- establishes and monitors authorised access to health information.
|
|
|
Include a clearly defined and communicated policy that contains directions on access rights, password
maintenance and management, remote access controls, auditing and appropriate software configuration. |
Business continuity and information recovery
Our practice has:
- documented and tested plans for business continuity and information recovery.
|
|
|
Include implementable business continuity and information recovery plans to ensure prompt restoration of clinical and business information systems. |
Internet and email use
Our practice has:
- processes to ensure the safe and proper use of internet and email in accordance with practice policies
- procedures for managing information security.
|
|
|
- Include details of configuration and use of internet and email.
- Provide practice team members with training in appropriate internet, email and social media practices.
|
Information backup
Our practice has:
- a reliable information backup system to support timely access to business and clinical information.
|
|
|
Include information for which systems are to be backed up and how often it must be done. |
Malware, viruses and email threats
Our practice has:
- reliable protection against computer malware, viruses and email threats.
|
|
|
- Include automatic updating of the virus protection software.
- Educate the practice team to be aware of risks.
|
Computer network perimeter controls
Our practice has:
- reliable computer network perimeter controls.
|
|
|
Ensure the firewall is correctly configured and the log files examined periodically. |
Mobile electronic devices
Our practice has:
- processes to ensure the safe and proper use of mobile electronic devices in accordance with practice policies
- procedures for managing information security.
|
|
|
Define the use and secure management of practice-owned and personal mobile devices used for clinical and business purposes. |
Physical facilities
Our practice:
- manages and maintains its physical facilities and computer hardware, software and operating system with a view to protecting information systems
|
|
|
Ensure the physical protection of equipment and the use of an uninterruptible power supply ‘UPS’. |
Security for information sharing
Our practice has:
- reliable systems for the secure electronic sharing of confidential information.
|
|
|
Ensure the appropriate configuration of secure messaging, digital certificate management and the practice website. |