Write Workforce Security Policies Essay

Workforce Security Policies
GRADING:
· You will earn full points by ensuring that key policy elements listed below are addressed, and the policies are written in a professional manner. Review the lecture material on what the purpose of a policy is and how it is structured. You can also use Google for ideas, but the writing must be in your own words. Do not copy-paste from the web, as TurnItIn will reveal that plagiarism. There should not be any references listed, as this all your own thinking and writing, based on what you have learned and ideas you find from researching.
· You may discuss and brainstorm with other students, but again, you must write your own words….TurnItIn will reveal shared content as well.
· PEER REVIEW: While the instructor makes the final grading decision, two of your peers will review your policies for quality and completeness and share their opinion with the instructor. This process helps you continue to learn, as you see how others have written their policies. It’s harder to write a policy than it seems!
· View your peers as employees of the organization you would develop these policies for. Ask yourself, will they easily understand the policies? Would their use of these polices actually protect the organization’s data?
BACKGROUND:
You are writing a policy for a single doctor dental practice located in an office complex.
· There are 4 employees (the dentist, two dental hygienists and an office manager).
· There are 3 desktop computers (the office manager computer (used for collecting credit card payments and scheduling appointments) and two computers beside the dental chairs (used for taking x-rays and recording health details).
· You can assume computers never leave the office.
· The EHR software used by the practice is tab32 (Links to an external site.) (for managing the practice).
· Microsoft 365 Business Basic (Links to an external site.) for web browser-based email only (Teams and Sharepoint are NOT used).
· You can assume patient data is never emailed.
· The office is secured with two external doors that are locked after hours and everyone in the organization is given a metal key to unlock.
· There are no video cameras, but the last person to leave activates an alarm.
· The front door is unlocked during the day and the office manager greets anyone that may come through that door.
DELIVERABLES:
· Create a single document called “ACME Dental Workforce Security Policies” and save as a PDF that you attach and upload.
· The audience for these polices is everyone within the organization, meaning the “entire workforce” (employees, contractors and volunteers).
· These policies should tell the workforce what to do in their daily activities to ensure security of the organization’s data.
· The document should be at least 1,000 words in length.
· The document should contain at a minimum policy items that address the following:
· Secure use of the EHR
· Account and password use
· Accessing from home or public computers
· Printing patient data
· Logging off
· Secure use of Microsoft 365 for email
· Account and password use
· Accessing from home or public computers
· Detecting and reporting phishing emails
· Opening attachments
· Clicking on links from un-known senders
· Forwarding company email to external recipients
· Forwarding company email to employee’s personal email accounts
· Emailing patient data (or not!)
· Using the EHR and Microsoft 365 from a BYOD device (e.g., personal phone, personal computer at home)
· Prohibiting company data on personal cloud-applications (e.g., DropBox)
· Using (or not!) the EHR and Microsoft 365 from a public computer (e.g., computer in the lobby of a hotel)
· Company Computers
· Use of company computers for personal needs and random web surfing
· Use of company computers for illegal, dangerous or inappropriate activities
· Accepting software updates
· Never disabling antivirus and other security controls
· Office security
· Securing the office after-hours
· Sharing of keys
· Visitors (not patients, but friends or family of the employees)
· Leaving the front door unattended
· Other concerns
· Attending periodic security training sessions
· Reporting concerns that patient privacy or security has been violated
· Reporting issues or concerns with computers, email or the EHR