New answers tagged

1

Using the author's preferred restatement in the comment: Is it okay for our IT support contractor to have the ability to remote in without authorization? Under normal circumstances, Yes. Let's talk about the specific key words. Remote: Assuming you don't work from home, remember that the IT Admins can sit in your chair at the end of the day and login ...


-3

Well, no. If he can get in without authorization than anybody can get in without authorization. However, 1) You did provide him with legal authorization. This is not the same thing as technical authorization. If I called somebody up and asked for help and he up and did it remotely and I don't know how he got in to do it I would be nervous too. 2) Your IT ...


56

You haven't actually provided enough details to say one way or the other. The fact that you didn't see an authentication prompt doesn't preclude there from being one. The remote access tools I use in my job (which also deals with HIPAA) both require me to authenticate with my domain admin credentials and do not prompt users to accept the connection, ...


-4

I completely disagree with the answer stating: "HIPAA does not get to specifics of policy". While they won't tell you how to write, or create a policy, they do get into VERY specific guidance. Here is the unbiased, facts to answer your question. The rules on HIPAA requirements administrative, physical and technical safeguards mandate basic requirements for ...


27

HIPAA does not get to specifics of policy, the substance of it is that organization have to have sufficient controls in place to protect data. There's nothing inherently wrong with an unprompted takeover from a HIPAA perspective, as long as other controls (authentication, authorization, access control lists, access logging and auditing, antimalware on the ...



Top 50 recent answers are included