Security Risk Analysis

Vulnerability Scan & Report
All servers are scanned by a vulnerability scanner on a regular basis. This ensures that servers are secure by applying current on software updates and best practices for user accounts
Group Membership Audit
Netgain audits user groups and permissions, highlighting risks in groups like administrative groups with unnecessary permissions.
Password Policy Adherence
Netgain will recommend, but not mandate, adherence to the following password policy. Password Expiration: 90 days | Password Complexity: enable password complexity requirements | Minimum Password Length: 8 characters | Password History: 30 days

All processes involved in Basic Audit as noted above
High-Level Review of EMR
Netgain evaluates the EMR for security, answering questions like: Does it store data in the file system? Is that file system secured? Is the data encrypted? Is file level auditing enabled? What is the Password Policy within the EMR?
Report on potentially malicious activity
At the network level, Netgain inspect packets traveling in the internal network. Netgain reports & documents attacks that are already being blocked by the firewall.

All processes involved in Basic & Intermediate Audits as noted above
Review internal security related policies
Netgain will review client’s security related policies and recommend changes to be made that address HIPAA & HITECH statutory requirements.
Assist in security plan design to improve security processes & policies
Based on the findings of the Risk Analysis, Netgain will assist in designing a Security Plan that improves the processes and polices in place to meet the requirements of HIPAA & HITECH.
Discuss findings via onsite visit or phone conference
Upon completion of the Advanced Audit, Netgain will provide a detailed report on the findings and either visit the practice or facilitate a phone conference to discuss the findings, potential issues, and recommendations.
Statement of Security Review
Netgain will provide a written Statement of Security Review proving that the analysis has been performed and what the results were. This statement can be used to prove completion of the 15th Measure (Protect Electronic Health Information) of Meaningful Use.