Workstation Baseline Security Configuration Standard (HIPAA)

See purpose.

The purpose of this standard is to provide guidance for workstation security for the Diocese of Paterson’s workstations in order to ensure the security of information on the workstation and information the workstation may have access to. Additionally, the standard provides guidance to ensure the requirements of the HIPAA Security Rule “Workstation Security” Standard 164.310(c) are met.

This standard applies to all The Diocese of Paterson employees, contractors, workforce members, vendors and agents with a Diocese of Paterson-owned or personal-workstation.

Appropriate measures must be taken when using workstations to ensure the confidentiality, integrity and availability of sensitive information, including protected health information (PHI) and that access to sensitive information is restricted to authorized users.

• 4.1 Active Directory
  • 4.1.1 All workstations that are compatible with Microsoft Active Directory (AD) must be added to their appropriate Organizational Unit (OU).
  • 4.1.2 All workstations must be named and logged correctly within the MSP/Helpdesk (NJHAMAA) data base if applicable.
  • 4.1.3 All workstation must have a Domain Admins group as a member of the local Administrator group.
• 4.2 Device Lockout
  • 4.2.1 All workstations must prompt a password to log back in after 15 minutes of inactivity.
• 4.3 Logging
  • 4.3.1 All Workstations must have logging enabled in order to comply with the Cloud Server Policy as well as the Information Logging Standard.
• 4.4 Anti-Malware
  • 4.4.1 All Workstations must have a standardized anti-malware approved by the Technology Department of the Diocese of Paterson. And comply with the Baseline Workstation Security Configuration Standard.
  • 4.4.2 Anti-malware must be kept up-to-date.
  • 4.4.3 Anti-malware must have a full-scan of the workstation performed weekly.
  • 4.4.4 Anti-malware must be continuously checking for updates.
• 4.5 Encryption
  • 4.5.1 All off-premise devices must be fully encrypted and have remote wipe features.
• 4.6 Vulnerability and Patch Management
  • 4.6.1 All workstations must to the best of their ability run the newest version of its Operating System.
  • 4.6.2 All workstations must have assigned personnel to ensure that all computers are kept up to date.
  • 4.6.3 All workstations must comply with the patch schedule set up by the Director of Technology or vendor.
  • 4.6.4 All workstations must undergo a regular vulnerability scan of all technology with regards to the Director of Technology or vendor.

• 5.1 Virtual Private Networks must be used to connect to the secure work environment.
• 5.2 Remote desktop (if allowed by a local admin) must be using an operating system that is up to update with the most recent patch.
• 5.3 All remote connections must be done and authenticated through multi-factor authentication.

• 6.1 Compliance Measurement
  The DoP Technology team may verify compliance to this Standard through various methods, including but not limited to, business tool reports, internal and external audits, and feedback to the Standard owner.
• 6.2 Exceptions
  All devices should be compliant with cyber insurance standards and local/federal governance standards. Any exception/outliers should be approved by the DoP Technology team in advance.
• 6.3 Non-Compliance
  An employee found to have violated this Standard may be subject to disciplinary action, up to and including termination of employment.

• 7.1 Account Security Policy
• 7.2 Information Logging Standard.
• 7.3 Cloud Server Policy.
• 7.4 Wireless Communication Standard.
• 7.5 Baseline Workstation Security Configuration Standard.
• HIPPA 164.210
• About HIPPA