1. Purpose

To establish the administrative, physical and technical safeguards that protect the confidentiality, integrity and availability of electronic protected health information at Quillbrook.

2. Scope

Applies to all workforce members and to every device, system, network, application and physical location that creates, receives, maintains or transmits electronic protected health information, including personally owned devices approved for work use.

3. Responsibilities

• IT Director & HIPAA Security Officer: Owns the security programme, risk analysis, access control, audit log review and incident technical response.
• HIPAA Privacy Officer: Coordinates privacy and security policy, training content and incident assessment.
• Information Security Analyst: Monitors alerts, reviews audit logs, and maintains vulnerability and patch records.
• All Workforce Members: Protect credentials and devices, use only approved systems, and report suspected incidents immediately.

4. Definitions

Electronic protected health information (ePHI)

Protected health information created, received, maintained or transmitted in electronic form.

Risk analysis

The documented assessment of potential risks and vulnerabilities to the confidentiality, integrity and availability of ePHI.

Business associate agreement (BAA)

The contract required before a vendor may create, receive, maintain or transmit PHI on behalf of the covered entity.

Automatic logoff

A technical control that terminates an electronic session after a predetermined period of inactivity.

5. Procedure

1. Conduct and document an enterprise risk analysis at least annually and after any significant change in systems, facilities or services, and maintain a prioritised risk management plan.
2. Maintain written security policies and procedures, review them annually, and retain them and all required documentation for at least six years from creation or last effective date.
3. Assign every workforce member a unique user identification and authenticate with a strong password plus multi-factor authentication for all remote and administrative access; never share or reuse credentials.
4. Apply role-based access with least privilege: grant access to ePHI only for the systems and records the person's role requires, on documented authorisation from the system owner.
5. Review user access rights at least quarterly, remove unnecessary privileges, and terminate all access on the same business day a workforce member departs or changes role.
6. Enforce automatic logoff after no more than fifteen minutes of inactivity on workstations and applications that access ePHI, and require a password-protected screen lock.
7. Encrypt ePHI at rest on all laptops, desktops, servers, mobile devices and removable media using full-disk or file-level encryption, and prohibit storage of ePHI on unencrypted media.
8. Encrypt ePHI in transit: use TLS for all application traffic, an encrypted email gateway or secure portal for any email containing PHI, and approved secure file transfer for data exchange; never use personal email or consumer cloud storage.
9. Secure the physical environment: badge-controlled entry to areas holding ePHI, locked cabinets for paper records, visitor logging and escort, and a maintenance record for physical security repairs.
10. Position and shield workstations so displays are not visible to visitors or subjects, use privacy filters in shared areas, lock screens whenever leaving a workstation, and never leave records unattended.
11. Maintain an inventory of all hardware and media that store ePHI, track movement, and sanitise or destroy media before reuse or disposal using approved methods with documented certificates.
12. Enable audit logging in every system holding ePHI, protect logs from alteration, retain them for at least six years, and review them at a documented frequency of at least monthly for inappropriate access.
13. Maintain malware protection, centralised patch management with defined remediation timelines by severity, network segmentation and firewall rules, and document exceptions with compensating controls.
14. Maintain a contingency plan including data backup, disaster recovery, emergency mode operation, and an applications and data criticality analysis, and test restoration at least annually.
15. Execute a business associate agreement before any vendor, laboratory, courier, sponsor service provider or cloud platform creates, receives, maintains or transmits PHI on the site's behalf, and track expiry dates.
16. Apply sanctions consistently for workforce members who violate security policy, document the sanction, and record it per the sanction policy.
17. Complete security awareness training at hire and annually, including phishing recognition, and document completion per TRN-001.
18. Report any suspected security incident to the HIPAA Security Officer immediately and process it under HIP-003.

6. References

• 45 CFR Part 164, Subpart C — Security Standards for the Protection of ePHI
• 45 CFR 164.308 — Administrative safeguards
• 45 CFR 164.310 — Physical safeguards
• 45 CFR 164.312 — Technical safeguards
• 45 CFR 164.316 — Policies, procedures and documentation
• 21 CFR Part 11 — Electronic Records; Electronic Signatures
• HIP-003 Privacy & Security Incident Response and Breach Notification

7. Revision History

• v2.0 · Oct 17, 2022 — Added multi-factor authentication and quarterly access reviews.
• v3.0 · Nov 05, 2024 — Added patch management timelines and annual restoration testing.
• v3.1 · Jan 12, 2026 — Clarified email encryption and workstation security requirements.