Page History

...

1. Request is submitted and goes to the CISO HIPAA Liaison for approval.
2. Building manager receives approved request and removes access.
3. Building manager closes the ticket. (If not closed within 24 hours or creation, Security Office is alerted). An email is sent to the person who lost access, their manager, the building manager, and the CISO HIPAA Liaison.

Providing Access for non-Emergency Maintenance

...

1. The building manager submits a request with a description of the maintenance request.
2. The CISO HIPAA Liaison approves or rejects the request.
3. If approved, the building manager submits a work order to F&S.
4. The building manager provides an escort(s) who is a part of the NCSA Staff with ACHE Access and who stays with the maintenance person while in the secured area.
5. After the work is completed, the building manager records when it was completed and by whom along with the identity of the escort.
6. The workflow is closed by the building manager. An email is sent to the CISO HIPAA Liaison and building manager. 

...

The response must be documented and given to the CISO HIPAA Liaison. This documentation must include:

...

A request to modify physical security controls can start with the building manager, Security Office or CISO HIPAA Liaison. The workflow is as follows.

1. The building manager makes sure the request has sufficient detail and forwards it to the Security Office for approval. 
2. The Security Office reviews the changes and evaluates the impact of the change. The request is then rejected or approved and forwards approved requests to the CISO HIPAA Liaison for approval. 
3. The CISO HIPAA Liaison approves or rejects the request.
4. If approved, the building manager submits a work order to F&S.
5. The building manager provides an escort(s) who is a part of the NCSA Staff with ACHE Access and who stays with the maintenance person or vendor while in the secured area doing the work. 
6. After the work is completed, the building manager records when it was completed and by whom along with the identity of the escort.
7. The workflow is closed by the building manager.  An email is sent to the CISO HIPAA Liaison, Security Office, and building manager. 

...

1. A request to move equipment with dates and customer impacts is submitted to the CISO HIPAA Liaison.
2. The CISO HIPAA Liaison works with the appropriate offices to ensure the schedule works for the customers impacted.
3. If applicable, data is backed up using a unique encryption key known to the person making the backup and the CISO HIPAA Liaison.
4. If leaving the secured facility, sensitive data will be securely wiped and verified by the Security Office.
5. The system will be powered-off and moved.
6. The system will be restored and verified by system administrators.
7. The ticket is closed by system administrators and an email is sent to the building manager, CISO HIPAA Liaison, and others involved in the ticket or workflow.

...

1. A request with the reason for removal is sent to the CISO HIPAA Liaison who approves or rejects.

2. The requestor will place the media in the provided secure container.

3. Container shall be locked with a key kept in the secure area.

4. Security team will transport secure container for wiping / destruction.

5. The security team will unlock with second key kept at wiping / destruction station.

6. Each device will be wiped or destroyed per Security Office policy

7. The person wiping the media will electronically record the details of the wiped media and when it was sanitized. Then they will return the secure container to the secure area.

   1. If the drive has no ability to be wiped because it has had a hardware failure, it will be marked for destruction and tested on the wiping machine at least once.
   2. The drive will need to be inventoried into a failed drive inventory, and sent to surplus for destruction.
8. All media that comes from Nightingale or ACHE will be labeled with stickers requesting destruction by campus surplus.

9. The media is given to the building manager who closes the workflow and sends the drive on.  If necessary, they have the original requestor fill out the RMA paperwork.

...