urn: urn:intuitem:risk:library:nist-sp-800-66-rev2
locale: en
ref_id: NIST-SP-800-66-rev2
name: NIST SP-800-66 rev2 (HIPAA)
description: 'Implementing the Health Insurance Portability and Accountability Act
  (HIPAA) Security Rule: A Cybersecurity Resource Guide, 2.0.0

  Source: https://csrc.nist.gov/Projects/cprt/catalog#/cprt/framework/version/SP800_66_2_0_0/home'
copyright: With the exception of material marked as copyrighted, information presented
  on NIST sites are considered public information and may be distributed or copied.
version: 2
publication_date: 2025-05-22
provider: NIST
packager: intuitem
objects:
  framework:
    urn: urn:intuitem:risk:framework:nist-sp-800-66-rev2
    ref_id: nist-sp-800-66-rev2
    name: NIST SP-800-66 rev2 (HIPAA)
    description: 'Implementing the Health Insurance Portability and Accountability
      Act (HIPAA) Security Rule: A Cybersecurity Resource Guide, 2.0.0

      Source: https://csrc.nist.gov/Projects/cprt/catalog#/cprt/framework/version/SP800_66_2_0_0/home'
    implementation_groups_definition:
    - ref_id: R
      name: Required
      description: null
    - ref_id: A
      name: Addressable
      description: null
    - ref_id: N
      name: Neutral
      description: null
    requirement_nodes:
    - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:164.308
      assessable: false
      depth: 1
      ref_id: '164.308'
      description: "Administrative Safeguards:\nDefined in the Security Rule as the\
        \ \u201Cadministrative actions and policies, and procedures to manage the\
        \ selection, development, implementation, and maintenance of security measures\
        \ to protect electronic protected health information and to manage the conduct\
        \ of the covered entity's workforce in relation to the protection of that\
        \ information.\u201D"
    - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:164.308(a)(1)
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:164.308
      ref_id: 164.308(a)(1)
      description: 'Security Management Process:

        HIPAA Standard: Implement policies and procedures to prevent, detect, contain,
        and correct security violations.'
    - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node4
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:164.308(a)(1)
      name: 1. Identify all ePHI and Relevant Information Systems
      description: 'Identify where ePHI is generated within the organization, where
        it enters the organization, where it moves within the organization, where
        it is stored, and where it leaves the organization.


        Identify all systems  that house ePHI. Be sure to identify mobile devices,
        medical equipment, and medical IoT devices that store, process, or transmit
        ePHI.


        Include all hardware and software that are used to collect, store, process,
        or transmit ePHI.


        Analyze business functions and verify the ownership and control of information
        system elements as necessary.


        Consider the impact of a merger or acquisition on risks to ePHI. During a
        merger or acquisition, new data pathways may be introduced that lead to ePHI
        being stored, processed, or transmitted in previously unanticipated places.'
      implementation_groups:
      - N
      questions:
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node4:question:1:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node4:question:1:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node4:question:1:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node4:question:1:choice:3
            value: N/A
          text: Has all ePHI generated, stored, processed, and transmitted within
            the organization been identified?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node4:question:2:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node4:question:2:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node4:question:2:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node4:question:2:choice:3
            value: N/A
          text: Are all hardware and software for which the organization is responsible
            periodically inventoried?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node4:question:3:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node4:question:3:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node4:question:3:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node4:question:3:choice:3
            value: N/A
          text: Is the hardware and software inventory updated on a regular basis?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node4:question:4:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node4:question:4:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node4:question:4:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node4:question:4:choice:3
            value: N/A
          text: Have hardware and software that maintains or transmits ePHI been identified?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node4:question:5:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node4:question:5:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node4:question:5:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node4:question:5:choice:3
            value: N/A
          text: Does this inventory include removable media and remote access devices?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node4:question:6:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node4:question:6:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node4:question:6:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node4:question:6:choice:3
            value: N/A
          text: Is the current configuration of organizational systems documented,
            including connections to other systems?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node4:question:7:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node4:question:7:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node4:question:7:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node4:question:7:choice:3
            value: N/A
          text: Has a BIA been performed?
    - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node6
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:164.308(a)(1)
      name: 2. Conduct Risk Assessment
      description: Conduct an accurate and thorough assessment of the potential risks
        and vulnerabilities to the confidentiality, integrity, and availability of
        ePHI held by the covered entity or business associate.
      implementation_groups:
      - N
      questions:
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node6:question:1:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node6:question:1:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node6:question:1:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node6:question:1:choice:3
            value: N/A
          text: Are there any prior risk assessments, audit comments, security requirements,
            and/or security test results?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node6:question:2:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node6:question:2:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node6:question:2:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node6:question:2:choice:3
            value: N/A
          text: Is there intelligence available from agencies, the Office of the Inspector
            General (OIG), the US-CERT, virus alerts, and/or vendors?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node6:question:3:
          type: text
          text: What are the human, natural, and environmental threats to systems
            that contain, store, process, or transmit ePHI?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node6:question:4:
          type: text
          text: What are the current and planned controls?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node6:question:5:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node6:question:5:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node6:question:5:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node6:question:5:choice:3
            value: N/A
          text: Have likelihood and impact been determined for relevant threats and
            vulnerabilities?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node6:question:6:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node6:question:6:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node6:question:6:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node6:question:6:choice:3
            value: N/A
          text: Have risk ratings been determined for relevant threats and vulnerabilities?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node6:question:7:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node6:question:7:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node6:question:7:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node6:question:7:choice:3
            value: N/A
          text: Is the facility located in a region prone to any natural disasters,
            such as earthquakes, floods, or fires?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node6:question:8:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node6:question:8:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node6:question:8:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node6:question:8:choice:3
            value: N/A
          text: "Has responsibility been assigned to check all hardware and software\
            \ \u2013 including hardware and software used for remote access \u2013\
            \ to determine whether selected security settings are enabled?"
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node6:question:9:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node6:question:9:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node6:question:9:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node6:question:9:choice:3
            value: N/A
          text: Is there an analysis of current safeguards and their effectiveness
            relative to the identified risks?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node6:question:10:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node6:question:10:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node6:question:10:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node6:question:10:choice:3
            value: N/A
          text: Have all processes involving ePHI been considered, including creating,
            receiving, maintaining, and transmitting it?
    - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node8
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:164.308(a)(1)
      name: Implementation Specification (Required)
      description: Conduct an accurate and thorough assessment of the potential risks
        and vulnerabilities to the confidentiality, integrity, and availability of
        ePHI held by the covered entity or business associate.
      implementation_groups:
      - R
    - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node10
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:164.308(a)(1)
      name: 3. Implement a Risk Management Program
      description: "Implement security measures sufficient to reduce risks and vulnerabilities\
        \ to a reasonable and appropriate level to comply with \xA7164.306(a).\n\n\
        Risk management should be performed with regular frequency to examine past\
        \ decisions, reevaluate risk likelihood and impact levels, and assess the\
        \ effectiveness of past remediation efforts\n\nCreate a Risk Management policy\
        \ and program that outlines organizational risk appetite and risk tolerance,\
        \ personnel duties, responsible parties, the frequency of risk management,\
        \ and required documentation.\n\nA risk management methodology is included\
        \ in Section 4.\n\nRisk management resources are also included in Appendix\
        \ F."
      implementation_groups:
      - N
      questions:
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node10:question:1:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node10:question:1:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node10:question:1:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node10:question:1:choice:3
            value: N/A
          text: Is executive leadership and/or management involved in risk management
            decisions?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node10:question:2:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node10:question:2:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node10:question:2:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node10:question:2:choice:3
            value: N/A
          text: Has a risk management program been created with related policies?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node10:question:3:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node10:question:3:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node10:question:3:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node10:question:3:choice:3
            value: N/A
          text: Does the regulated entity need to engage other resources (e.g., external
            expertise) to assist in risk management?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node10:question:4:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node10:question:4:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node10:question:4:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node10:question:4:choice:3
            value: N/A
          text: Do current safeguards ensure the confidentiality, integrity, and availability
            of all ePHI?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node10:question:5:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node10:question:5:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node10:question:5:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node10:question:5:choice:3
            value: N/A
          text: Do current safeguards protect against reasonably anticipated uses
            or disclosures of ePHI that are not permitted by the Privacy Rule?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node10:question:6:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node10:question:6:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node10:question:6:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node10:question:6:choice:3
            value: N/A
          text: Has the regulated entity used the results of risk assessment and risk
            management processes to guide the selection and implementation of appropriate
            controls to protect ePHI?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node10:question:7:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node10:question:7:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node10:question:7:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node10:question:7:choice:3
            value: N/A
          text: Has the regulated entity protected against all reasonably anticipated
            threats or hazards to the security and integrity of ePHI?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node10:question:8:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node10:question:8:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node10:question:8:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node10:question:8:choice:3
            value: N/A
          text: Has the regulated entity assured compliance with all policies and
            procedures by its workforce?
    - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node12
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:164.308(a)(1)
      name: Implementation Specification (Required)
      description: "Implement security measures sufficient to reduce risks and vulnerabilities\
        \ to a reasonable and appropriate level to comply with \xA7164.306(a)"
      implementation_groups:
      - R
    - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node14
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:164.308(a)(1)
      name: 4. Acquire IT Systems and Services
      description: 'Regulated entities should consider how cloud services and other
        third-party IT system and service offerings can both assist regulated entities
        in protecting ePHI while also potentially introducing new risks to ePHI.


        Although the HIPAA Security Rule does not require purchasing any particular
        technology, adequately protecting information may require additional hardware,
        software, or services. Considerations for their selection should include the
        following:'
      implementation_groups:
      - N
      questions:
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node14:question:1:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node14:question:1:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node14:question:1:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node14:question:1:choice:3
            value: N/A
          text: Will new security controls work with the existing IT architecture?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node14:question:2:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node14:question:2:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node14:question:2:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node14:question:2:choice:3
            value: N/A
          text: Have the security requirements of the organization been compared to
            the security features of existing or proposed hardware and software?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node14:question:3:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node14:question:3:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node14:question:3:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node14:question:3:choice:3
            value: N/A
          text: Has a cost-benefit analysis been conducted to determine the reasonableness
            of the investment given the security risks identified?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node14:question:4:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node14:question:4:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node14:question:4:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node14:question:4:choice:3
            value: N/A
          text: Has a training strategy been developed?
    - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node16
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:164.308(a)(1)
      name: 5. Create and Deploy Policies and Procedures
      description: 'Implement the decisions concerning the management, operational,
        and technical controls selected to mitigate identified risks.


        Create policies that clearly establish roles and responsibilities, and assign
        ultimate responsibility for the implementation of each control to particular
        individuals or offices.


        Create procedures to be followed to accomplish particular security-related
        tasks.


        Establish a frequency for reviewing policy and procedures'
      implementation_groups:
      - N
      questions:
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node16:question:1:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node16:question:1:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node16:question:1:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node16:question:1:choice:3
            value: N/A
          text: Has the regulated entity documented an organizational risk assessment/management
            policy that outlines the duties, responsible parties, frequency, and required
            documentation of the risk management program?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node16:question:2:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node16:question:2:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node16:question:2:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node16:question:2:choice:3
            value: N/A
          text: Are policies and procedures in place for security?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node16:question:3:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node16:question:3:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node16:question:3:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node16:question:3:choice:3
            value: N/A
          text: Is there a formal (documented) system security plan?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node16:question:4:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node16:question:4:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node16:question:4:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node16:question:4:choice:3
            value: N/A
          text: Is there a formal contingency plan?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node16:question:5:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node16:question:5:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node16:question:5:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node16:question:5:choice:3
            value: N/A
          text: Is there a process for communicating policies and procedures to the
            affected workforce members?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node16:question:6:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node16:question:6:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node16:question:6:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node16:question:6:choice:3
            value: N/A
          text: Are policies and procedures reviewed and updated as needed?
    - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node18
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:164.308(a)(1)
      name: 6. Develop and Implement a Sanction Policy
      description: "Apply appropriate sanctions against workforce members who fail\
        \ to comply with the security policies and procedures of the covered entity\
        \ or business associate\n\nDevelop policies and procedures for imposing appropriate\
        \ sanctions (e.g., reprimand, termination) for noncompliance with the organization\u2019\
        s security policies.\n\nImplement sanction policy as cases arise."
      implementation_groups:
      - N
      questions:
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node18:question:1:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node18:question:1:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node18:question:1:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node18:question:1:choice:3
            value: N/A
          text: Does the regulated entity have existing sanction policies and procedures
            to meet the requirements of this implementation specification?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node18:question:2:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node18:question:2:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node18:question:2:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node18:question:2:choice:3
            value: N/A
          text: If not, can existing sanction policies be modified to include language
            related to violations of these policies and procedures?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node18:question:3:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node18:question:3:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node18:question:3:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node18:question:3:choice:3
            value: N/A
          text: Is there a formal process in place to address system misuse, abuse,
            and fraudulent activity?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node18:question:4:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node18:question:4:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node18:question:4:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node18:question:4:choice:3
            value: N/A
          text: Have workforce members been made aware of policies concerning sanctions
            for inappropriate access, use, and disclosure of ePHI?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node18:question:5:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node18:question:5:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node18:question:5:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node18:question:5:choice:3
            value: N/A
          text: Has the need and appropriateness of a tiered structure of sanctions
            that accounts for the magnitude of harm and possible types of inappropriate
            disclosures been considered?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node18:question:6:
          type: text
          text: How will managers and workforce members be notified regarding suspect
            activity?
    - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node20
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:164.308(a)(1)
      name: Implementation Specification (Required)
      description: Apply appropriate sanctions against workforce members who fail
        to comply with the security policies and procedures of the covered entity
        or business associate
      implementation_groups:
      - R
    - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node22
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:164.308(a)(1)
      name: 7. Develop and Deploy the Information System Activity Review Process
      description: 'Implement procedures to regularly review records of information
        system activity, such as audit logs, access reports, and security incident
        tracking reports.


        Implement regular reviews of information system activity, and consider ways
        to automate the review for the protection of ePHI.'
      implementation_groups:
      - N
      questions:
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node22:question:1:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node22:question:1:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node22:question:1:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node22:question:1:choice:3
            value: N/A
          text: Is there a policy that establishes what reviews will be conducted?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node22:question:2:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node22:question:2:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node22:question:2:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node22:question:2:choice:3
            value: N/A
          text: Are there corresponding procedures that describe the specifics of
            the reviews?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node22:question:3:
          type: text
          text: Who is responsible for the overall process and results?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node22:question:4:
          type: text
          text: How often will reviews take place?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node22:question:5:
          type: text
          text: How often will review results be analyzed?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node22:question:6:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node22:question:6:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node22:question:6:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node22:question:6:choice:3
            value: N/A
          text: Has the regulated entity considered all available capabilities to
            automate the reviews?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node22:question:7:
          type: text
          text: Where will audit information reside (e.g., separate server)?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node22:question:8:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node22:question:8:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node22:question:8:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node22:question:8:choice:3
            value: N/A
          text: Will it be stored external to the organization (e.g., cloud service
            provider)?
    - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node24
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:164.308(a)(1)
      name: Implementation Specification (Required)
      description: Implement procedures to regularly review records of information
        system activity, such as audit logs, access reports, and security incident
        tracking reports.
      implementation_groups:
      - R
    - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node26
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:164.308(a)(1)
      name: 8. Develop Appropriate Standard Operating Procedures
      description: Determine the types of audit trail data and monitoring procedures
        that will be needed to derive exception reports.
      implementation_groups:
      - N
      questions:
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node26:question:1:
          type: text
          text: How will exception reports or logs be reviewed?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node26:question:2:
          type: text
          text: Where will monitoring reports and their reviews be documented and
            maintained?
    - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node28
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:164.308(a)(1)
      name: 9. Implement the Information System Activity Review and Audit Process
      description: 'Activate the necessary review process.


        Begin auditing and logging activity.'
      implementation_groups:
      - N
      questions:
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node28:question:1:
          type: text
          text: What mechanisms will be implemented to assess the effectiveness of
            the review process (measures)?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node28:question:2:
          type: text
          text: What is the plan to revise the review process when needed?
    - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:164.308(a)(2)
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:164.308
      ref_id: 164.308(a)(2)
      description: 'Assigned Security Responsibility:

        HIPAA Standard: Identify the security official who is responsible for the
        development and implementation of the policies and procedures required by
        this subpart for the covered entity or business associate.'
    - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node31
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:164.308(a)(2)
      name: 1. Select a Security Official to be Assigned Responsibility for HIPAA
        Security
      description: 'Identify the individual who has final responsibility for security.


        Select an individual who is able to assess effective security to serve as
        the point of contact for security policy, implementation, and monitoring.'
      implementation_groups:
      - N
      questions:
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node31:question:1:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node31:question:1:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node31:question:1:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node31:question:1:choice:3
            value: N/A
          text: Does the security official have adequate access and communications
            with senior officials in the organization, such as executives, chief information
            officers, chief compliance officers, and in-house counsel?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node31:question:2:
          type: text
          text: Who in the organization is authorized to accept risks from systems
            on behalf of the organization?
    - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node33
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:164.308(a)(2)
      name: "2. Assign and Document the Individual\u2019s Responsibility"
      description: "Document the assignment to one individual\u2019s responsibilities\
        \ in a job description.\n\nCommunicate this assigned role to the entire organization."
      implementation_groups:
      - N
      questions:
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node33:question:1:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node33:question:1:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node33:question:1:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node33:question:1:choice:3
            value: N/A
          text: Is there a complete job description that accurately reflects assigned
            security duties and responsibilities?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node33:question:2:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node33:question:2:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node33:question:2:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node33:question:2:choice:3
            value: N/A
          text: Have the staff members in the organization been notified as to whom
            to call in the event of a security problem?
    - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:164.308(a)(3)
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:164.308
      ref_id: 164.308(a)(3)
      description: 'Workforce Security:

        HIPAA Standard: Implement policies and procedures to ensure that all members
        of its workforce have appropriate access to electronic protected health information,
        as provided under paragraph (a)(4) of this section, and to prevent those workforce
        members who do not have access under paragraph (a)(4) of this section from
        obtaining access to electronic protected health information.'
    - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node36
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:164.308(a)(3)
      name: 1. Implement Policies and Procedures for Authorization and/or Supervision
      description: Implement procedures for the authorization and/or supervision of
        workforce members who work with ePHI or in locations where it might be accessed.
      implementation_groups:
      - N
      questions:
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node36:question:1:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node36:question:1:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node36:question:1:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node36:question:1:choice:3
            value: N/A
          text: Have chains of command and lines of authority been established?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node36:question:2:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node36:question:2:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node36:question:2:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node36:question:2:choice:3
            value: N/A
          text: Have staff members been made aware of the identity and roles of their
            supervisors?
    - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node38
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:164.308(a)(3)
      name: Implementation Specification (Addressable)
      description: Implement procedures for the authorization and/or supervision of
        workforce members who work with ePHI or in locations where it might be accessed.
      implementation_groups:
      - A
    - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node40
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:164.308(a)(3)
      name: 2. Establish Clear Job Descriptions and Responsibilities
      description: 'Define roles and responsibilities for all job functions.


        Assign appropriate levels of security oversight, training, and access.


        Identify in writing who has the business need and who has been granted permission
        to view, alter, retrieve, and store ePHI and at what times, under what circumstances,
        and for what purposes.'
      implementation_groups:
      - N
      questions:
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node40:question:1:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node40:question:1:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node40:question:1:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node40:question:1:choice:3
            value: N/A
          text: Are there written job descriptions that are correlated with appropriate
            levels of access to ePHI?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node40:question:2:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node40:question:2:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node40:question:2:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node40:question:2:choice:3
            value: N/A
          text: Are these job descriptions reviewed and updated on a regular basis?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node40:question:3:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node40:question:3:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node40:question:3:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node40:question:3:choice:3
            value: N/A
          text: Have staff members been provided copies of their job descriptions
            and informed of the access granted to them, as well as the conditions
            by which this access can be used?
    - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node42
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:164.308(a)(3)
      name: 3. Establish Criteria and Procedures for Hiring and Assigning Tasks
      description: 'Ensure that staff members have the necessary knowledge, skills,
        and abilities to fulfill particular roles (e.g., positions involving access
        to and use of sensitive information).


        Ensure that these requirements are included as part of the personnel hiring
        process.'
      implementation_groups:
      - N
      questions:
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node42:question:1:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node42:question:1:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node42:question:1:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node42:question:1:choice:3
            value: N/A
          text: Have the qualifications of candidates for specific positions been
            checked against the job description?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node42:question:2:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node42:question:2:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node42:question:2:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node42:question:2:choice:3
            value: N/A
          text: Have determinations been made that candidates for specific positions
            are able to perform the tasks of those positions?
    - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node44
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:164.308(a)(3)
      name: 4. Establish a Workforce Clearance Procedure
      description: 'Implement procedures to determine that the access of a workforce
        member to ePHI is appropriate.


        Implement appropriate screening of persons who will have access to ePHI.


        Implement a procedure for obtaining clearance from appropriate offices or
        individuals where access is provided or terminated.'
      implementation_groups:
      - N
      questions:
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node44:question:1:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node44:question:1:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node44:question:1:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node44:question:1:choice:3
            value: N/A
          text: Is there an implementation strategy that supports the designated access
            authorities?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node44:question:2:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node44:question:2:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node44:question:2:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node44:question:2:choice:3
            value: N/A
          text: "Are applicants\u2019 employment and educational references checked,\
            \ if reasonable and appropriate?"
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node44:question:3:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node44:question:3:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node44:question:3:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node44:question:3:choice:3
            value: N/A
          text: Have background checks been completed, if reasonable and appropriate?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node44:question:4:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node44:question:4:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node44:question:4:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node44:question:4:choice:3
            value: N/A
          text: Are there procedures for determining that the appropriate workforce
            members have access to the necessary information?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node44:question:5:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node44:question:5:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node44:question:5:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node44:question:5:choice:3
            value: N/A
          text: Do procedures exist for obtaining appropriate sign-offs to grant or
            terminate access to ePHI?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node44:question:6:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node44:question:6:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node44:question:6:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node44:question:6:choice:3
            value: N/A
          text: Have clearance and supervision procedures been developed for non-US
            based workforce members that are applicable to their location?
    - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node46
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:164.308(a)(3)
      name: Implementation Specification (Addressable)
      description: Implement procedures to determine that the access of a workforce
        member to ePHI is appropriate.
      implementation_groups:
      - A
    - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node48
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:164.308(a)(3)
      name: 5. Establish Termination Procedures
      description: "Implement procedures for terminating access to ePHI when the employment\
        \ of or other arrangement with a workforce member ends or as required by determinations\
        \ made as specified in \xA7164.308(a)(3)(ii)(B).\n\nDevelop a standard set\
        \ of procedures that should be followed to recover access control devices\
        \ (e.g., identification badges, keys, access cards) when employment ends.\n\
        \nDeactivate computer access accounts (e.g., disable user IDs and passwords)\
        \ and facility access (e.g., change facility security codes/PINs)."
      implementation_groups:
      - N
      questions:
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node48:question:1:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node48:question:1:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node48:question:1:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node48:question:1:choice:3
            value: N/A
          text: Are there separate procedures for voluntary termination (e.g., retirement,
            promotion, transfer, change of employment) versus involuntary termination
            (e.g., termination for cause, reduction in force, involuntary transfer,
            criminal or disciplinary actions), if reasonable and appropriate?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node48:question:2:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node48:question:2:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node48:question:2:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node48:question:2:choice:3
            value: N/A
          text: "Is there a standard checklist for all action items that should be\
            \ completed when a workforce member leaves (e.g., return of all access\
            \ devices, deactivation of logon accounts [including remote access], and\
            \ delivery of any needed data solely under the employee\u2019s control)?"
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node48:question:3:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node48:question:3:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node48:question:3:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node48:question:3:choice:3
            value: N/A
          text: Do other organizations need to be notified to deactivate accounts
            that the workforce member had access to in the performance of their employment
            duties?
    - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node50
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:164.308(a)(3)
      name: Implementation Specification (Addressable)
      description: "Implement procedures for terminating access to ePHI when the employment\
        \ of or other arrangement with a workforce member ends or as required by determinations\
        \ made as specified in \xA7164.308(a)(3)(ii)(B)."
      implementation_groups:
      - A
    - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:164.308(a)(4)
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:164.308
      ref_id: 164.308(a)(4)
      description: 'Information Access Management:

        HIPAA Standard: Implement policies and procedures for authorizing access to
        electronic protected health information that are consistent with the applicable
        requirements of subpart E of this part.'
    - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node53
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:164.308(a)(4)
      name: 1. Isolate Healthcare Clearinghouse Functions
      description: 'If a healthcare clearinghouse is part of a larger organization,
        the clearinghouse must implement policies and procedures that protect the
        ePHI of the clearinghouse from unauthorized access by the larger organization.


        Determine whether a component of the regulated entity constitutes a healthcare
        clearinghouse under the HIPAA Security Rule.


        If no clearinghouse functions exist, document this finding. If a clearinghouse
        exists within the organization, implement procedures for access that are consistent
        with the HIPAA Privacy Rule.'
      implementation_groups:
      - N
      questions:
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node53:question:1:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node53:question:1:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node53:question:1:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node53:question:1:choice:3
            value: N/A
          text: If healthcare clearinghouse functions are performed, are policies
            and procedures implemented to protect ePHI from the other functions of
            the larger organization?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node53:question:2:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node53:question:2:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node53:question:2:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node53:question:2:choice:3
            value: N/A
          text: Does the healthcare clearinghouse share hardware or software with
            a larger organization of which it is a part?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node53:question:3:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node53:question:3:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node53:question:3:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node53:question:3:choice:3
            value: N/A
          text: Does the healthcare clearinghouse share staff or physical space with
            staff from a larger organization?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node53:question:4:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node53:question:4:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node53:question:4:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node53:question:4:choice:3
            value: N/A
          text: Has a separate network or subsystem been established for the healthcare
            clearinghouse, if reasonable and appropriate?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node53:question:5:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node53:question:5:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node53:question:5:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node53:question:5:choice:3
            value: N/A
          text: Has staff of the healthcare clearinghouse been trained to safeguard
            ePHI from disclosure to the larger organization, if required for compliance
            with the HIPAA Privacy Rule?
    - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node55
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:164.308(a)(4)
      name: Implementation Specification (Required)
      description: If a healthcare clearinghouse is part of a larger organization,
        the clearinghouse must implement policies and procedures that protect the
        ePHI of the clearinghouse from unauthorized access by the larger organization.
      implementation_groups:
      - R
    - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node57
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:164.308(a)(4)
      name: 2. Implement Policies and Procedures for Authorizing Access
      description: 'Implement policies and procedures for granting access to ePHI,
        such as through access to a workstation, transaction, program, process, or
        other mechanism.


        Decide and document procedures for how access to ePHI will be granted to workforce
        members within the organization.


        Select the basis for restricting access to ePHI.


        Select an access control method (e.g., identity-based, role-based, or other
        reasonable and appropriate means of access.)


        Decide and document how access to ePHI will be granted for privileged functions.


        Ensure that there is a list of personnel with authority to approve user requests
        to access ePHI and systems with ePHI.


        Identify authorized users with access to ePHI, including data owners and data
        custodians.


        Consider whether multiple access control methods are needed to protect ePHI
        according to the results of the risk assessment.


        Determine whether direct access to ePHI will ever be appropriate for individuals
        external to the organization (e.g., business partners or patients seeking
        access to their own ePHI).'
      implementation_groups:
      - N
      questions:
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node57:question:1:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node57:question:1:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node57:question:1:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node57:question:1:choice:3
            value: N/A
          text: "Have appropriate authorization and clearance procedures, as specified\
            \ in Workforce Security (\xA7 164.308(a)(3)), been performed prior to\
            \ granting access?"
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node57:question:2:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node57:question:2:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node57:question:2:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node57:question:2:choice:3
            value: N/A
          text: "Do the organization\u2019s systems have the capacity to set access\
            \ controls?"
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node57:question:3:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node57:question:3:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node57:question:3:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node57:question:3:choice:3
            value: N/A
          text: Are there documented job descriptions that accurately reflect assigned
            duties and responsibilities and enforce segregation of duties?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node57:question:4:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node57:question:4:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node57:question:4:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node57:question:4:choice:3
            value: N/A
          text: Has the organization documented procedures that specify how authorized
            personnel will be granted access to ePHI?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node57:question:5:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node57:question:5:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node57:question:5:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node57:question:5:choice:3
            value: N/A
          text: Does the organization grant remote access to ePHI?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node57:question:6:
          type: text
          text: What methods of access control are used (e.g., identity-based, role-based,
            location-based, or a combination) to protect ePHI?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node57:question:7:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node57:question:7:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node57:question:7:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node57:question:7:choice:3
            value: N/A
          text: Are there additional access control requirements for users who will
            be accessing privileged functions?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node57:question:8:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node57:question:8:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node57:question:8:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node57:question:8:choice:3
            value: N/A
          text: Have organizational personnel been explicitly authorized to approve
            user requests to access ePHI and/or systems with ePHI?
    - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node59
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:164.308(a)(4)
      name: Implementation Specification (Addressable)
      description: Implement policies and procedures for granting access to ePHI,
        such as through access to a workstation, transaction, program, process, or
        other mechanism.
      implementation_groups:
      - A
    - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node61
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:164.308(a)(4)
      name: 3. Implement Policies and Procedures for Access Establishment and Modification
      description: "Implement policies and procedures that \u2013 based on the covered\
        \ entity or business associate\u2019s access authorization policies \u2013\
        \ establish, document, review, and modify a user's right of access to a workstation,\
        \ transaction, program, or process.\n\nEstablish standards for granting access\
        \ to ePHI.\n\nProvide formal authorization from the appropriate authority\
        \ before granting access to ePHI.\n\nRegularly review personnel access to\
        \ ePHI to ensure that access is still authorized and needed.\n\nModify personnel\
        \ access to ePHI, as needed, based on review activities."
      implementation_groups:
      - N
      questions:
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node61:question:1:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node61:question:1:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node61:question:1:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node61:question:1:choice:3
            value: N/A
          text: Are duties separated such that only the minimum necessary ePHI is
            made available to each workforce member based on their job requirements?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node61:question:2:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node61:question:2:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node61:question:2:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node61:question:2:choice:3
            value: N/A
          text: Are access decisions justified, approved, logged, and retained?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node61:question:3:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node61:question:3:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node61:question:3:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node61:question:3:choice:3
            value: N/A
          text: Is personnel access to ePHI regularly reviewed to ensure that access
            is still authorized and needed?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node61:question:4:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node61:question:4:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node61:question:4:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node61:question:4:choice:3
            value: N/A
          text: Are activities that review access to ePHI logged and retained, including
            decisions that arise from review activities?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node61:question:5:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node61:question:5:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node61:question:5:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node61:question:5:choice:3
            value: N/A
          text: Are decisions related to the establishment and modification of workforce
            member authorization to access ePHI documented?
    - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node63
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:164.308(a)(4)
      name: Implementation Specification (Addressable)
      description: "Implement policies and procedures that \u2013 based on the covered\
        \ entity or business associate\u2019s access authorization policies \u2013\
        \ establish, document, review, and modify a user's right of access to a workstation,\
        \ transaction, program, or process."
      implementation_groups:
      - A
    - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node65
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:164.308(a)(4)
      name: 4. Evaluate Existing Security Measures Related to Access Controls
      description: 'Evaluate the security features of access controls that are already
        in place or those of any planned for implementation, as appropriate.


        Determine whether these security features involve alignment with other existing
        management, operational, and technical controls, such as policy standards,
        personnel procedures, the maintenance and review of audit trails, the identification
        and authentication of users, and physical access controls.'
      implementation_groups:
      - N
      questions:
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node65:question:1:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node65:question:1:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node65:question:1:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node65:question:1:choice:3
            value: N/A
          text: Are there policies and procedures related to the security of access
            controls?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node65:question:2:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node65:question:2:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node65:question:2:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node65:question:2:choice:3
            value: N/A
          text: If so, are they updated regularly?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node65:question:3:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node65:question:3:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node65:question:3:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node65:question:3:choice:3
            value: N/A
          text: Are authentication mechanisms used to verify the identity of those
            accessing systems protected from inappropriate manipulation?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node65:question:4:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node65:question:4:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node65:question:4:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node65:question:4:choice:3
            value: N/A
          text: Does management regularly review the list of access authorizations,
            including remote access authorizations, to verify that the list is accurate
            and has not been inappropriately altered?
    - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:164.308(a)(5)
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:164.308
      ref_id: 164.308(a)(5)
      description: 'Security Awareness and Training:

        HIPAA Standard: Implement a security awareness and training program for all
        members of its workforce (including management).'
    - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node68
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:164.308(a)(5)
      name: 1. Conduct a Training Needs Assessment
      description: 'Determine the training needs of the organization.


        Interview and involve key personnel in assessing security training needs.


        Use feedback and analysis of past events to help determine training needs


        Review organizational behavior issues, past incidents, and/or breaches to
        determine what training is missing or needs reinforcement, improvement, or
        periodic reminders.'
      implementation_groups:
      - N
      questions:
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node68:question:1:
          type: text
          text: What awareness, training, and education programs are needed?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node68:question:2:
          type: text
          text: Which are required?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node68:question:3:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node68:question:3:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node68:question:3:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node68:question:3:choice:3
            value: N/A
          text: Is the organization monitoring current threats to determine possible
            areas of training needs?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node68:question:4:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node68:question:4:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node68:question:4:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node68:question:4:choice:3
            value: N/A
          text: Are there current, relevant threats (e.g., phishing, ransomware) about
            which personnel need training?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node68:question:5:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node68:question:5:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node68:question:5:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node68:question:5:choice:3
            value: N/A
          text: Do workforce members need training on any particular organization
            devices (e.g., medical IoT) or technology that pose a risk to ePHI?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node68:question:6:
          type: text
          text: What is the current status regarding how these needs are being addressed
            (e.g., how well are current efforts working)?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node68:question:7:
          type: text
          text: Where are the gaps between the needs and what is being done (e.g.,
            what more needs to be done)?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node68:question:8:
          type: text
          text: What are the training priorities in terms of content and audience?
    - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node70
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:164.308(a)(5)
      name: 2. Develop and Approve a Training Strategy and a Plan
      description: "Address the specific HIPAA policies that require security awareness\
        \ and training in the security awareness and training program.\n\nSet organizational\
        \ expectations for protecting ePHI.\n\nIn the security awareness and training\
        \ program, outline the program\u2019s scope, goals, target audiences, learning\
        \ objectives, deployment methods, and evaluation and measurement techniques,\
        \ as well as the frequency of training"
      implementation_groups:
      - N
      questions:
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node70:question:1:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node70:question:1:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node70:question:1:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node70:question:1:choice:3
            value: N/A
          text: Is there a procedure in place to ensure that everyone in the organization
            receives security awareness training, including teleworkers and remote
            personnel?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node70:question:2:
          type: text
          text: What type of security training is needed to address specific technical
            topics based on job responsibility?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node70:question:3:
          type: date
          text: When should training be scheduled to ensure that compliance deadlines
            are met?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node70:question:4:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node70:question:4:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node70:question:4:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node70:question:4:choice:3
            value: N/A
          text: Has the organization considered the training needs of non-employees
            (e.g., contractors, interns)?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node70:question:5:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node70:question:5:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node70:question:5:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node70:question:5:choice:3
            value: N/A
          text: Is there a need to implement information security training tailored
            to individual roles?
    - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node72
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:164.308(a)(5)
      name: 3. Protection from Malicious Software, Login Monitoring, and Password
        Management
      description: "As reasonable and appropriate, train workforce members regarding\
        \ procedures for:\n\nIncorporate information concerning workforce members\u2019\
        \ roles and responsibilities in implementing these implementation specifications\
        \ into training and awareness efforts."
      implementation_groups:
      - N
      questions:
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node72:question:1:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node72:question:1:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node72:question:1:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node72:question:1:choice:3
            value: N/A
          text: Do workforce members know the importance of the timely application
            of system patches to protect against malicious software and the exploitation
            of vulnerabilities?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node72:question:2:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node72:question:2:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node72:question:2:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node72:question:2:choice:3
            value: N/A
          text: Are workforce members aware that login attempts may be monitored?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node72:question:3:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node72:question:3:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node72:question:3:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node72:question:3:choice:3
            value: N/A
          text: Do workforce members who monitor login attempts know to whom to report
            discrepancies?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node72:question:4:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node72:question:4:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node72:question:4:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node72:question:4:choice:3
            value: N/A
          text: Do workforce members understand their roles and responsibilities in
            selecting a password of appropriate strength, safeguarding their password,
            and changing a password when it has been compromised or is suspected of
            being compromised?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node72:question:5:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node72:question:5:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node72:question:5:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node72:question:5:choice:3
            value: N/A
          text: Are there policies in place that prohibit workforce members from sharing
            passwords with others?
    - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node74
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:164.308(a)(5)
      name: Implementation Specification (Protection from Malicious Software)
      description: 'As reasonable and appropriate, train workforce members regarding
        procedures for:'
      implementation_groups:
      - N
    - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node76
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:164.308(a)(5)
      name: Implementation Specification (Log-in Monitoring)
      description: 'As reasonable and appropriate, train workforce members regarding
        procedures for:'
      implementation_groups:
      - N
    - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node78
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:164.308(a)(5)
      name: Implementation Specification (Password Management)
      description: 'As reasonable and appropriate, train workforce members regarding
        procedures for:'
      implementation_groups:
      - N
    - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node80
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:164.308(a)(5)
      name: 4. Develop Appropriate Awareness and Training Content, Materials, and
        Methods
      description: 'Select topics to be included in the training materials, and consider
        current and relevant topics (e.g., phishing, email security) for the protection
        of ePHI.


        Incorporate new information from email advisories, online IT security daily
        news websites, and periodicals, as reasonable and appropriate.


        Consider using a variety of media and avenues according to what is appropriate
        for the organization based on workforce size, location, level of education,
        and other factors.


        Training should be an ongoing, evolving process in response to environmental
        and operational changes that affect the security of ePHI.'
      implementation_groups:
      - N
      questions:
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node80:question:1:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node80:question:1:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node80:question:1:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node80:question:1:choice:3
            value: N/A
          text: Are the topics selected for training and awareness the most relevant
            to the threats, vulnerabilities, and risks identified during the risk
            assessment?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node80:question:2:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node80:question:2:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node80:question:2:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node80:question:2:choice:3
            value: N/A
          text: Does the organization periodically review the topics covered in training
            and awareness in light of updates to the risk assessment and current threats?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node80:question:3:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node80:question:3:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node80:question:3:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node80:question:3:choice:3
            value: N/A
          text: "Have workforce members received a copy of and do they have ready\
            \ access to the organization\u2019s security procedures and policies?"
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node80:question:4:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node80:question:4:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node80:question:4:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node80:question:4:choice:3
            value: N/A
          text: Do workforce members know whom to contact and how to handle a security
            incident?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node80:question:5:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node80:question:5:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node80:question:5:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node80:question:5:choice:3
            value: N/A
          text: Do workforce members understand the consequences of noncompliance
            with the stated security policies?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node80:question:6:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node80:question:6:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node80:question:6:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node80:question:6:choice:3
            value: N/A
          text: Do workforce members who travel, telework, or work remotely know how
            to handle physical laptop security issues and information security issues?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node80:question:7:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node80:question:7:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node80:question:7:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node80:question:7:choice:3
            value: N/A
          text: Has the regulated entity researched available training resources?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node80:question:8:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node80:question:8:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node80:question:8:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node80:question:8:choice:3
            value: N/A
          text: Is dedicated training staff available for the delivery of security
            training?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node80:question:9:
          type: text
          text: If not, who will deliver the training?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node80:question:10:
          type: text
          text: What is the security training budget?
    - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node82
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:164.308(a)(5)
      name: 5. Implement the Training
      description: 'Schedule and conduct the training outlined in the strategy and
        plan.


        Implement any reasonable technique to disseminate the security messages in
        an organization, including newsletters, screensavers, video recordings, email
        messages, teleconferencing sessions, staff meetings, and computer-based training.'
      implementation_groups:
      - N
      questions:
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node82:question:1:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node82:question:1:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node82:question:1:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node82:question:1:choice:3
            value: N/A
          text: Have all workforce members received adequate training to fulfill their
            security responsibilities?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node82:question:2:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node82:question:2:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node82:question:2:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node82:question:2:choice:3
            value: N/A
          text: Are there sanctions if workforce members do not complete the required
            training?
    - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node84
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:164.308(a)(5)
      name: 6. Implement Security Reminders
      description: 'Implement periodic security updates.


        Provide periodic security updates to staff, business associates, and contractors.


        Consider the benefits of ongoing communication with staff (e.g., emails, newsletters)
        on training topics to achieve HIPAA compliance and protect ePHI.'
      implementation_groups:
      - N
      questions:
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node84:question:1:
          type: text
          text: What methods are available or already in use to make or keep workforce
            members aware of security (e.g., posters, booklets, anti-phishing training)?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node84:question:2:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node84:question:2:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node84:question:2:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node84:question:2:choice:3
            value: N/A
          text: Is the organization making use of existing resources (e.g., from the
            405(d) program or other resources listed in Appendix F) to remind staff
            of important security topics?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node84:question:3:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node84:question:3:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node84:question:3:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node84:question:3:choice:3
            value: N/A
          text: Is security refresher training performed on a periodic basis (e.g.,
            annually)?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node84:question:4:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node84:question:4:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node84:question:4:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node84:question:4:choice:3
            value: N/A
          text: Is security awareness discussed with all new hires?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node84:question:5:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node84:question:5:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node84:question:5:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node84:question:5:choice:3
            value: N/A
          text: Are security topics reinforced during routine staff meetings?
    - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node86
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:164.308(a)(5)
      name: Implementation Specification (Addressable)
      description: Implement periodic security updates.
      implementation_groups:
      - A
    - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node88
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:164.308(a)(5)
      name: 7. Monitor and Evaluate the Training Plan
      description: 'Keep the security awareness and training program current.


        Solicit trainee feedback to determine whether the training and awareness are
        successfully reaching the intended audience.


        Conduct training whenever changes occur in the technology and practices as
        appropriate.


        Monitor the training program implementation to ensure that all workforce members
        participate.


        Implement corrective actions when problems arise.'
      implementation_groups:
      - N
      questions:
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node88:question:1:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node88:question:1:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node88:question:1:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node88:question:1:choice:3
            value: N/A
          text: Are the workforce members' training and professional development programs
            documented and monitored, if reasonable and appropriate?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node88:question:2:
          type: text
          text: How are new workforce members trained on security?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node88:question:3:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node88:question:3:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node88:question:3:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node88:question:3:choice:3
            value: N/A
          text: Are new non-employees (e.g., contractors, interns) trained on security?
    - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:164.308(a)(6)
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:164.308
      ref_id: 164.308(a)(6)
      description: 'Security Incident Procedures:

        HIPAA Standard: Implement policies and procedures to address security incidents.'
    - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node91
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:164.308(a)(6)
      name: 1. Determine the Goals of Incident Response
      description: "Gain an understanding as to what constitutes a true security incident.\
        \ Under the HIPAA Security Rule, a security incident is the attempted or successful\
        \ unauthorized access, use, disclosure, modification, or destruction of information\
        \ or interference with system operations in an information system (45 CFR\
        \ \xA7 164.304).\n\nEnsure that the incident response program covers all parts\
        \ of the organization in which ePHI is created, stored, processed, or transmitted.\n\
        \nDetermine how the organization will respond to a security incident.\n\n\
        Establish a reporting mechanism and a process to coordinate responses to the\
        \ security incident.\n\nProvide direct technical assistance, advise vendors\
        \ to address product-related problems, and provide liaisons to legal and criminal\
        \ investigative groups as needed."
      implementation_groups:
      - N
      questions:
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node91:question:1:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node91:question:1:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node91:question:1:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node91:question:1:choice:3
            value: N/A
          text: Has the HIPAA-required security risk assessment resulted in a list
            of potential physical or technological events that could lead to a breach
            of security?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node91:question:2:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node91:question:2:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node91:question:2:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node91:question:2:choice:3
            value: N/A
          text: Is there a procedure in place for reporting and handling incidents?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node91:question:3:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node91:question:3:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node91:question:3:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node91:question:3:choice:3
            value: N/A
          text: Has an analysis been conducted that relates reasonably anticipated
            organizational threats (that could result in a security incident) to the
            methods that would be used for mitigation?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node91:question:4:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node91:question:4:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node91:question:4:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node91:question:4:choice:3
            value: N/A
          text: Have the key functions of the organization been prioritized to determine
            what would need to be restored first in the event of a disruption?
    - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node93
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:164.308(a)(6)
      name: 2. Develop and Deploy an Incident Response Team or Other Reasonable and
        Appropriate Response Mechanism
      description: 'Determine whether the size, scope, mission, and other aspects
        of the organization justify the reasonableness and appropriateness of maintaining
        a standing incident response team.


        Identify appropriate individuals to be part of a formal incident response
        team if the organization has determined that implementing an incident response
        team is reasonable and appropriate.


        Consider assigning secondary personnel to be part of the incident response
        team in the event that primary personnel are unavailable.'
      implementation_groups:
      - N
      questions:
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node93:question:1:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node93:question:1:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node93:question:1:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node93:question:1:choice:3
            value: N/A
          text: "Do members of the team have adequate knowledge of the organization\u2019\
            s hardware and software?"
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node93:question:2:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node93:question:2:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node93:question:2:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node93:question:2:choice:3
            value: N/A
          text: Do members of the team have the authority to speak for the organization
            to the media, law enforcement, and clients or business partners?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node93:question:3:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node93:question:3:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node93:question:3:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node93:question:3:choice:3
            value: N/A
          text: Has the incident response team received appropriate training in incident
            response activities?
    - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node95
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:164.308(a)(6)
      name: 3. Develop and Implement Policy and Procedures to Respond to and Report
        Security Incidents
      description: 'Identify and respond to suspected or known security incidents;
        mitigate, to the extent practicable, harmful effects of security incidents
        that are known to the covered entity or business associate; and document security
        incidents and their outcomes.


        Ensure that an organizational incident response policy is in place that addresses
        all parts of the organization in which ePHI is created, stored, processed,
        or transmitted.


        Document incident response procedures that can provide a single point of reference
        to guide the day-to-day operations of the incident response team.


        Review incident response procedures with staff who have roles and responsibilities
        related to incident response; solicit suggestions for improvements; and make
        changes to reflect input if reasonable and appropriate.


        Consider conducting tests of the incident response plan.


        Update the procedures as required based on changing organizational needs.'
      implementation_groups:
      - N
      questions:
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node95:question:1:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node95:question:1:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node95:question:1:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node95:question:1:choice:3
            value: N/A
          text: Has the organization determined that maintaining a staffed security
            incident hotline would be reasonable and appropriate?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node95:question:2:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node95:question:2:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node95:question:2:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node95:question:2:choice:3
            value: N/A
          text: Has the organization developed processes for documenting and tracking
            incidents?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node95:question:3:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node95:question:3:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node95:question:3:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node95:question:3:choice:3
            value: N/A
          text: Has the organization determined reasonable and appropriate mitigation
            options for security incidents?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node95:question:4:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node95:question:4:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node95:question:4:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node95:question:4:choice:3
            value: N/A
          text: Has the organization developed standardized incident report templates
            to record necessary information related to incidents?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node95:question:5:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node95:question:5:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node95:question:5:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node95:question:5:choice:3
            value: N/A
          text: Has the organization determined that information captured in the reporting
            templates is reasonable and appropriate to investigate an incident?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node95:question:6:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node95:question:6:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node95:question:6:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node95:question:6:choice:3
            value: N/A
          text: Has the organization determined the conditions under which information
            related to a security breach will be disclosed to the media?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node95:question:7:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node95:question:7:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node95:question:7:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node95:question:7:choice:3
            value: N/A
          text: Have appropriate (internal and external) persons who should be informed
            of a security breach been identified?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node95:question:8:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node95:question:8:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node95:question:8:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node95:question:8:choice:3
            value: N/A
          text: Has a contact information list been prepared?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node95:question:9:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node95:question:9:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node95:question:9:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node95:question:9:choice:3
            value: N/A
          text: Has a written incident response plan been developed and provided to
            the incident response team?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node95:question:10:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node95:question:10:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node95:question:10:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node95:question:10:choice:3
            value: N/A
          text: Has the incident response plan been tested?
    - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node97
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:164.308(a)(6)
      name: Implementation Specification (Required)
      description: Identify and respond to suspected or known security incidents;
        mitigate, to the extent practicable, harmful effects of security incidents
        that are known to the covered entity or business associate; and document security
        incidents and their outcomes.
      implementation_groups:
      - R
    - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node99
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:164.308(a)(6)
      name: 4. Incorporate Post-Incident Analysis into Updates and Revisions
      description: 'Measure effectiveness and update security incident response procedures
        to reflect lessons learned, and identify actions to take that will improve
        security controls after a security incident.


        Incidents caused by or influenced by known risks should feed back into the
        risk assessment process for a reevaluation of impact and/or likelihood.


        Remediation and corrective action plans that arise from incidents should serve
        as input to the risk assessment/management process.'
      implementation_groups:
      - N
      questions:
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node99:question:1:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node99:question:1:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node99:question:1:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node99:question:1:choice:3
            value: N/A
          text: Has the organization analyzed records (e.g., log files, malware) to
            understand the nature, extent, and scope of the incident?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node99:question:2:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node99:question:2:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node99:question:2:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node99:question:2:choice:3
            value: N/A
          text: Does the organization reassess risk to ePHI based on findings from
            this analysis?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node99:question:3:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node99:question:3:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node99:question:3:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node99:question:3:choice:3
            value: N/A
          text: Does the incident response team keep adequate documentation of security
            incidents and their outcomes, which may include what weaknesses were exploited
            and how access to the information was gained?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node99:question:4:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node99:question:4:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node99:question:4:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node99:question:4:choice:3
            value: N/A
          text: Do records reflect the new contacts and resources identified for responding
            to an incident?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node99:question:5:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node99:question:5:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node99:question:5:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node99:question:5:choice:3
            value: N/A
          text: Does the organization consider whether current procedures were adequate
            for responding to a particular security incident?
    - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:164.308(a)(7)
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:164.308
      ref_id: 164.308(a)(7)
      description: 'Contingency Plan:

        HIPAA Standard: Establish (and implement as needed) policies and procedures
        for responding to an emergency or other occurrence (for example, fire, vandalism,
        system failure, and natural disaster) that damages systems that contain electronic
        protected health information'
    - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node102
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:164.308(a)(7)
      name: 1. Develop a Contingency Planning Policy
      description: "Define the organization\u2019s overall contingency objectives.\n\
        \nEstablish the organizational framework, roles, and responsibilities for\
        \ this area.\n\nAddress scope, resource requirements, training, testing, plan\
        \ maintenance, and backup requirements."
      implementation_groups:
      - N
      questions:
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node102:question:1:
          type: text
          text: What critical services must be provided within specified time frames?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node102:question:2:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node102:question:2:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node102:question:2:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node102:question:2:choice:3
            value: N/A
          text: Have cross-functional dependencies been identified to determine how
            a failure in one system may negatively impact another one?
    - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node104
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:164.308(a)(7)
      name: 2. Conduct an Applications and Data Criticality Analysis
      description: 'Assess the relative criticality of specific applications and data
        in support of other Contingency Plan components.


        Identify the activities and material involving ePHI that are critical to business
        operations.


        Identify the critical services or operations and the manual and automated
        processes that support them involving ePHI.


        Determine the amount of time that the organization can tolerate disruptions
        to these operations, materials, or services (e.g., due to power outages).


        Evaluate the current and available levels of redundancy and geographic distribution
        of any storage service providers to identify risks to service availability
        and determine restoration times.


        Consider whether any vendor/service provider arrangements are critical to
        operations and address them as appropriate to ensure availability and reliability.


        Establish cost-effective strategies for recovering these critical services
        or processes.'
      implementation_groups:
      - N
      questions:
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node104:question:1:
          type: text
          text: What hardware, software, and personnel are critical to daily operations?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node104:question:2:
          type: text
          text: What is the impact on desired service levels if these critical assets
            are not available?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node104:question:3:
          type: text
          text: What, if any, support is provided by external providers (e.g., cloud
            service providers, internet service providers, utilities, or contractors)?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node104:question:4:
          type: text
          text: What is the nature and degree of impact on the operation if any of
            the critical resources or service providers are not available?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node104:question:5:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node104:question:5:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node104:question:5:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node104:question:5:choice:3
            value: N/A
          text: Has the organization identified vendors or service providers that
            are critical to business operations?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node104:question:6:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node104:question:6:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node104:question:6:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node104:question:6:choice:3
            value: N/A
          text: Has the organization sufficiently addressed the availability and reliability
            of these services (e.g., via service level agreements, contracts)?
    - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node106
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:164.308(a)(7)
      name: Implementation Specification (Addressable)
      description: Assess the relative criticality of specific applications and data
        in support of other Contingency Plan components.
      implementation_groups:
      - A
    - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node108
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:164.308(a)(7)
      name: 3. Identify Preventive Measures
      description: 'Identify preventive measures for each defined scenario that could
        result in the loss of a critical service operation involving the use of ePHI.


        Ensure that identified preventive measures are practical and feasible in terms
        of their applicability in a given environment.'
      implementation_groups:
      - N
      questions:
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node108:question:1:
          type: text
          text: What alternatives for continuing operations of the organization are
            available in case of the loss of any critical function or resource?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node108:question:2:
          type: text
          text: What is the cost associated with the preventive measures that may
            be considered?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node108:question:3:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node108:question:3:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node108:question:3:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node108:question:3:choice:3
            value: N/A
          text: Are the preventive measures feasible (i.e., affordable and practical
            for the environment)?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node108:question:4:
          type: text
          text: What plans, procedures, or agreements need to be initiated to enable
            the implementation of the preventive measures if they are necessary?
    - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node110
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:164.308(a)(7)
      name: 4. Develop Recovery Strategy
      description: 'Finalize the set of contingency procedures that should be invoked
        for all identified impacts, including emergency mode operation. The strategy
        must be adaptable to the existing operating environment and address allowable
        outage times and the associated priorities identified in Key Activity 2.


        If part of the strategy depends on external organizations for support, ensure
        that formal agreements are in place with specific requirements stated.'
      implementation_groups:
      - N
      questions:
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node110:question:1:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node110:question:1:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node110:question:1:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node110:question:1:choice:3
            value: N/A
          text: Have procedures related to recovery from emergency or disastrous events
            been documented?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node110:question:2:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node110:question:2:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node110:question:2:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node110:question:2:choice:3
            value: N/A
          text: Has a coordinator who manages, maintains, and updates the plan been
            designated?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node110:question:3:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node110:question:3:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node110:question:3:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node110:question:3:choice:3
            value: N/A
          text: Has an emergency call list been distributed to all workforce members?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node110:question:4:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node110:question:4:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node110:question:4:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node110:question:4:choice:3
            value: N/A
          text: Have recovery procedures been documented?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node110:question:5:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node110:question:5:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node110:question:5:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node110:question:5:choice:3
            value: N/A
          text: Has a determination been made regarding when the plan needs to be
            activated (e.g., anticipated duration of outage, tolerances for outage
            or loss of capability, impact on service delivery, etc.)?
    - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node112
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:164.308(a)(7)
      name: 5. Data Backup Plan and Disaster Recovery Plan
      description: 'Establish and implement procedures to create and maintain retrievable
        exact copies of ePHI.


        Establish (and implement as needed) procedures to restore any loss of data.'
      implementation_groups:
      - N
      questions:
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node112:question:1:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node112:question:1:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node112:question:1:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node112:question:1:choice:3
            value: N/A
          text: Is there a formal, written contingency plan?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node112:question:2:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node112:question:2:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node112:question:2:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node112:question:2:choice:3
            value: N/A
          text: Does it address disaster recovery and data backup?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node112:question:3:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node112:question:3:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node112:question:3:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node112:question:3:choice:3
            value: N/A
          text: Does the disaster recovery plan address what data is to be restored
            and in what order?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node112:question:4:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node112:question:4:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node112:question:4:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node112:question:4:choice:3
            value: N/A
          text: Do data backup procedures exist that include all ePHI?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node112:question:5:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node112:question:5:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node112:question:5:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node112:question:5:choice:3
            value: N/A
          text: Is the frequency of backups appropriate for the environment?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node112:question:6:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node112:question:6:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node112:question:6:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node112:question:6:choice:3
            value: N/A
          text: Are responsibilities assigned to conduct backup activities?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node112:question:7:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node112:question:7:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node112:question:7:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node112:question:7:choice:3
            value: N/A
          text: Are data backup procedures documented and available to other staff?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node112:question:8:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node112:question:8:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node112:question:8:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node112:question:8:choice:3
            value: N/A
          text: Are backup logs reviewed and data restoration tests conducted to ensure
            the integrity of data backups?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node112:question:9:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node112:question:9:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node112:question:9:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node112:question:9:choice:3
            value: N/A
          text: Is at least one copy of the data backup stored offline to protect
            against corruption due to ransomware or other similar attacks?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node112:question:10:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node112:question:10:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node112:question:10:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node112:question:10:choice:3
            value: N/A
          text: Are backups or images of operating systems, devices, software, and
            configuration files necessary to support the confidentiality, integrity,
            and availability of ePHI included in the data backup plan?
    - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node114
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:164.308(a)(7)
      name: Implementation Specification (Required)
      description: Establish and implement procedures to create and maintain retrievable
        exact copies of ePHI.
      implementation_groups:
      - R
    - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node116
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:164.308(a)(7)
      name: Implementation Specification (Required)
      description: Establish (and implement as needed) procedures to restore any loss
        of data.
      implementation_groups:
      - R
    - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node118
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:164.308(a)(7)
      name: 6. Develop and Implement an Emergency Mode Operation Plan
      description: "Establish (and implement as needed) procedures to enable the continuation\
        \ of critical business processes to protect the security of ePHI while operating\
        \ in emergency mode.\n\n\u201CEmergency mode\u201D operation involves only\
        \ those critical business processes that must occur to protect the security\
        \ of ePHI during and immediately after a crisis situation."
      implementation_groups:
      - N
      questions:
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node118:question:1:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node118:question:1:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node118:question:1:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node118:question:1:choice:3
            value: N/A
          text: Have procedures been developed to continue the critical functions
            identified in Key Activity 2?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node118:question:2:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node118:question:2:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node118:question:2:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node118:question:2:choice:3
            value: N/A
          text: If so, have those critical functions that also involve the use of
            ePHI been identified?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node118:question:3:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node118:question:3:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node118:question:3:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node118:question:3:choice:3
            value: N/A
          text: Would different staff, facilities, or systems be needed to perform
            those functions?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node118:question:4:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node118:question:4:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node118:question:4:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node118:question:4:choice:3
            value: N/A
          text: Has the security of ePHI in that alternative mode of operation been
            assured?
    - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node120
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:164.308(a)(7)
      name: Implementation Specification (Required)
      description: Establish (and implement as needed) procedures to enable the continuation
        of critical business processes to protect the security of ePHI while operating
        in emergency mode.
      implementation_groups:
      - R
    - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node122
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:164.308(a)(7)
      name: 7. Testing and Revision Procedure
      description: 'Implement procedures for the periodic testing and revision of
        contingency plans.


        Test the contingency plan on a predefined cycle (stated in the policy developed
        under Key Activity 1), if reasonable and appropriate.


        Train those with defined plan responsibilities in their roles.


        If possible, involve external entities (e.g., vendors, alternative site or
        service providers) in testing exercises.


        Make key decisions regarding how the testing is to occur (e.g., tabletop exercise
        versus staging a real operational scenario, including actual loss of capability).


        Decide how to segment the type of testing based on the assessment of business
        impact and the acceptability of a sustained loss of service.'
      implementation_groups:
      - N
      questions:
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node122:question:1:
          type: text
          text: How is the contingency plan to be tested?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node122:question:2:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node122:question:2:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node122:question:2:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node122:question:2:choice:3
            value: N/A
          text: Does testing lend itself to a phased approach?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node122:question:3:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node122:question:3:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node122:question:3:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node122:question:3:choice:3
            value: N/A
          text: Is it feasible to actually take down functions or services for the
            purposes of testing?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node122:question:4:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node122:question:4:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node122:question:4:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node122:question:4:choice:3
            value: N/A
          text: Has the organization conducted backup recovery testing to ensure that
            critical data can be recovered using existing data backups?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node122:question:5:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node122:question:5:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node122:question:5:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node122:question:5:choice:3
            value: N/A
          text: Does the backup recovery testing verify the ability to recover data
            and operations based on identified testing scenarios using actual tests
            (i.e., not tabletop exercises)?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node122:question:6:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node122:question:6:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node122:question:6:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node122:question:6:choice:3
            value: N/A
          text: Can testing be done during normal business hours or must it take place
            during off hours?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node122:question:7:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node122:question:7:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node122:question:7:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node122:question:7:choice:3
            value: N/A
          text: Have the tests included personnel with contingency planning responsibilities?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node122:question:8:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node122:question:8:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node122:question:8:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node122:question:8:choice:3
            value: N/A
          text: Have the results of each test been documented and any problems with
            the test reviewed and corrected?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node122:question:9:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node122:question:9:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node122:question:9:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node122:question:9:choice:3
            value: N/A
          text: If full testing is infeasible, has a tabletop scenario (e.g., a classroom-like
            exercise) been considered?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node122:question:10:
          type: text
          text: How frequently will the plan be tested (e.g., annually)?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node122:question:11:
          type: date
          text: When should the plan be revised?
    - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node124
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:164.308(a)(7)
      name: Implementation Specification (Addressable)
      description: Implement procedures for the periodic testing and revision of contingency
        plans.
      implementation_groups:
      - A
    - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:164.308(a)(8)
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:164.308
      ref_id: 164.308(a)(8)
      description: "Evaluation:\nHIPAA Standard: Perform a periodic technical and\
        \ nontechnical evaluation, based initially upon the standards implemented\
        \ under this rule and subsequently, in response to environmental or operational\
        \ changes affecting the security of electronic protected health information,\
        \ that establishes the extent to which a covered entity\u2019s or business\
        \ associate\u2019s security policies and procedures meet the requirements\
        \ of this subpart."
    - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node127
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:164.308(a)(8)
      name: 1. Determine Whether Internal or External Evaluation is Most Appropriate
      description: 'Decide whether the evaluation will be conducted with internal
        staff resources or external consultants.


        Engage external expertise to assist the internal evaluation team where additional
        skills and expertise are determined to be reasonable and appropriate.


        Use internal resources to supplement an external source of help because these
        internal resources can provide the best institutional knowledge and history
        of internal policies and practices.'
      implementation_groups:
      - N
      questions:
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node127:question:1:
          type: text
          text: Which staff has the technical experience and expertise to evaluate
            the systems?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node127:question:2:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node127:question:2:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node127:question:2:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node127:question:2:choice:3
            value: N/A
          text: Are the evaluators sufficiently independent to provide objective reporting?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node127:question:3:
          type: text
          text: How much training will staff need on security-related technical and
            non-technical issues?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node127:question:4:
          type: text
          text: If an outside vendor is used, what factors should be considered when
            selecting the vendor, such as credentials and experience?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node127:question:5:
          type: text
          text: What is the budget for internal resources to assist with an evaluation?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node127:question:6:
          type: text
          text: What is the budget for external services to assist with an evaluation?
    - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node129
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:164.308(a)(8)
      name: 2. Develop Standards and Measurements for Reviewing All Standards and
        Implementation Specifications of the Security Rule
      description: "Develop and document organizational policies and procedures for\
        \ conducting evaluation.\n\nOnce security controls have been implemented in\
        \ response to the organization\u2019s risk assessment and management processes,\
        \ periodically review these implemented security measures to ensure their\
        \ continued effectiveness in protecting ePHI.\n\nConsider determining any\
        \ specific evaluation metrics and/or measurements to be captured during evaluation.\
        \ Metrics and/or measurements can assist in tracking progress over time.\n\
        \nUse an evaluation strategy and tool that considers all elements of the HIPAA\
        \ Security Rule and can be tracked, such as a questionnaire or checklist.\n\
        \nImplement tools that can provide reports on the level of compliance, integration,\
        \ or maturity of a particular security safeguard deployed to protect ePHI.\n\
        \nIf available, consider engaging corporate, legal, or regulatory compliance\
        \ staff when conducting the analysis.\n\nLeverage any existing reports or\
        \ documentation that may already be prepared by the organization addressing\
        \ the compliance, integration, or maturity of a particular security safeguard\
        \ deployed to protect ePHI."
      implementation_groups:
      - N
      questions:
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node129:question:1:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node129:question:1:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node129:question:1:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node129:question:1:choice:3
            value: N/A
          text: Has the organization documented policies and procedures for conducting
            the evaluation of security controls?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node129:question:2:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node129:question:2:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node129:question:2:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node129:question:2:choice:3
            value: N/A
          text: Have management, operational, and technical issues been considered?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node129:question:3:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node129:question:3:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node129:question:3:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node129:question:3:choice:3
            value: N/A
          text: Do the elements of each evaluation procedure (e.g., questions, statements,
            or other components) address individual, measurable security safeguards
            for ePHI?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node129:question:4:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node129:question:4:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node129:question:4:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node129:question:4:choice:3
            value: N/A
          text: Has the organization developed evaluation procedures that capture
            any desired metrics or measurements?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node129:question:5:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node129:question:5:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node129:question:5:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node129:question:5:choice:3
            value: N/A
          text: Has the organization determined that the procedure must be tested
            in a few areas or systems?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node129:question:6:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node129:question:6:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node129:question:6:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node129:question:6:choice:3
            value: N/A
          text: Does the evaluation tool consider all standards and implementation
            specifications of the HIPAA Security Rule?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node129:question:7:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node129:question:7:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node129:question:7:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node129:question:7:choice:3
            value: N/A
          text: Does the evaluation tool address the protection of ePHI that is collected,
            used, or disclosed?
    - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node131
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:164.308(a)(8)
      name: 3. Conduct Evaluation
      description: 'Determine in advance what departments and/or staff will participate
        in the evaluation.


        Determine what constitutes an environmental or operational change that affects
        the security of ePHI.


        Determine when evaluations are conducted in response to an environmental or
        operational change that affects the security of ePHI (e.g., prior to the change,
        contemporaneous with the change, after the change).


        Secure management support for the evaluation process to ensure participation.


        Collect and document all needed information. Collection methods may include
        the use of interviews, surveys, and the outputs of automated tools, such as
        access control auditing tools, system logs, and the results of penetration
        testing.


        Conduct penetration testing (where testers attempt to compromise system security
        for the sole purpose of testing the effectiveness of security controls), if
        reasonable and appropriate.


        Evaluation may include reviewing organizational policies and procedures, assessing
        the implementation of security controls, collecting evidence of security control
        implementation, and performing physical walk- throughs.'
      implementation_groups:
      - N
      questions:
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node131:question:1:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node131:question:1:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node131:question:1:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node131:question:1:choice:3
            value: N/A
          text: If available, have staff members with knowledge of IT security been
            consulted and included in the evaluation team?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node131:question:2:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node131:question:2:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node131:question:2:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node131:question:2:choice:3
            value: N/A
          text: Are appropriate personnel notified of planned environmental or operational
            changes that could affect the security of ePHI?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node131:question:3:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node131:question:3:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node131:question:3:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node131:question:3:choice:3
            value: N/A
          text: Is a change management process in place that includes identification
            and communication of environmental and operational changes that could
            affect the security of ePHI?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node131:question:4:
          type: text
          text: If penetration testing has been determined to be reasonable and appropriate,
            has specifically worded, written approval from senior management been
            received for any planned penetration testing?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node131:question:5:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node131:question:5:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node131:question:5:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node131:question:5:choice:3
            value: N/A
          text: Has the process been formally communicated to those who have been
            assigned roles and responsibilities in the evaluation process?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node131:question:6:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node131:question:6:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node131:question:6:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node131:question:6:choice:3
            value: N/A
          text: Has the organization explored the use of automated tools to support
            the evaluation process?
    - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node133
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:164.308(a)(8)
      name: 4. Document Results
      description: 'Document each evaluation finding, as well as remediation options,
        recommendations, and decisions.


        Document known gaps between identified risks, mitigating security controls,
        and any acceptance of risk, including justification.


        Develop security program priorities, and establish targets for continuous
        improvement.


        Utilize the results of evaluations to inform impactful security changes to
        protect ePHI.


        Communicate evaluation results, metrics, and/or measurements to relevant organizational
        personnel.'
      implementation_groups:
      - N
      questions:
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node133:question:1:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node133:question:1:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node133:question:1:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node133:question:1:choice:3
            value: N/A
          text: Does the process support the development of security recommendations?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node133:question:2:
          type: date
          text: When determining how best to display evaluation results, have written
            reports that highlight key findings and recommendations been considered?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node133:question:3:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node133:question:3:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node133:question:3:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node133:question:3:choice:3
            value: N/A
          text: If a written final report is to be circulated among key staff, have
            steps been taken to ensure that it is made available only to those persons
            designated to receive it?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node133:question:4:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node133:question:4:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node133:question:4:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node133:question:4:choice:3
            value: N/A
          text: Does the organization use evaluation results to enhance the protection
            of ePHI rather than for the sake of compliance?
    - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node135
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:164.308(a)(8)
      name: 5. Repeat Evaluations Periodically
      description: 'Establish the frequency of evaluations, and consider the sensitivity
        of the ePHI controlled by the organization as well as the organization''s
        size, complexity, and environmental and/or operational changes (e.g., other
        relevant laws or accreditation requirements).


        In addition to periodic reevaluations, consider repeating evaluations when
        environmental and operational changes that affect the security of ePHI are
        made to the organization (e.g., if new technology is adopted or if there are
        newly recognized risks to the security of ePHI).'
      implementation_groups:
      - N
      questions:
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node135:question:1:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node135:question:1:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node135:question:1:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node135:question:1:choice:3
            value: N/A
          text: Do security policies specify that evaluations will be repeated when
            environmental and operational changes are made that affect the security
            of ePHI?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node135:question:2:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node135:question:2:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node135:question:2:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node135:question:2:choice:3
            value: N/A
          text: Do policies on the frequency of security evaluations reflect any and
            all relevant federal or state laws that bear on environmental or operational
            changes affecting the security of ePHI?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node135:question:3:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node135:question:3:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node135:question:3:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node135:question:3:choice:3
            value: N/A
          text: Has the organization explored the use of automated tools to support
            periodic evaluations?
    - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:164.308(b)(1)
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:164.308
      ref_id: 164.308(b)(1)
      description: "Business Associate Contracts and Other Arrangements:\nHIPAA Standard:\
        \ A covered entity may permit a business associate to create, receive, maintain,\
        \ or transmit electronic protected health information on the covered entity\u2019\
        s behalf only if the covered entity obtains satisfactory assurances, in accordance\
        \ with \xA7 164.314(a), that the business associate will appropriately safeguard\
        \ the information. A covered entity is not required to obtain such satisfactory\
        \ assurances from a business associate that is a subcontractor."
    - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node138
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:164.308(b)(1)
      name: 1. Identify Entities that are Business Associates Under the HIPAA Security
        Rule
      description: 'Identify the individual or department who will be responsible
        for coordinating the execution of business associate agreements or other arrangements.


        Reevaluate the list of business associates to determine who has access to
        ePHI in order to assess whether the list is complete and current.


        Identify systems covered by the contract/agreement.


        Business associates must have a BAA in place with each of their subcontractor
        business associates. Subcontractor business associates are also directly liable
        for their own Security Rule violations.'
      implementation_groups:
      - N
      questions:
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node138:question:1:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node138:question:1:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node138:question:1:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node138:question:1:choice:3
            value: N/A
          text: Does each written and executed BAA contain sufficient language to
            ensure that ePHI and any other required information types will be protected?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node138:question:2:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node138:question:2:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node138:question:2:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node138:question:2:choice:3
            value: N/A
          text: Have all organizations or vendors that provide a service or function
            on behalf of the organization been identified?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node138:question:3:
          type: text
          text: 'Such services may include:'
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node138:question:4:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node138:question:4:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node138:question:4:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node138:question:4:choice:3
            value: N/A
          text: Have outsourced functions that involve the use of ePHI been considered?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node138:question:5:
          type: text
          text: 'Such functions may include:'
    - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node140
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:164.308(b)(1)
      name: 2. Establish a Process for Measuring Contract Performance and Terminating
        the Contract if Security Requirements Are Not Being Met
      description: 'Maintain clear lines of communication between covered entities
        and business associates regarding the protection of ePHI as per the BAA or
        contract.


        Establish criteria for measuring contract performance.'
      implementation_groups:
      - N
      questions:
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node140:question:1:
          type: text
          text: What is the service being performed?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node140:question:2:
          type: text
          text: What is the expected outcome?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node140:question:3:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node140:question:3:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node140:question:3:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node140:question:3:choice:3
            value: N/A
          text: Is there a process for reporting security incidents related to the
            agreement?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node140:question:4:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node140:question:4:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node140:question:4:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node140:question:4:choice:3
            value: N/A
          text: Are additional assurances of protections for ePHI from the business
            associate necessary?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node140:question:5:
          type: text
          text: If so, where will such additional assurances be documented (e.g.,
            in the BAA, service-level agreement, or other documentation), and how
            will they be met (e.g., providing documentation of implemented safeguards,
            audits, certifications)?
    - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node142
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:164.308(b)(1)
      name: 3. Written Contract or Other Arrangement
      description: "Document the satisfactory assurances required by this standard\
        \ through a written contract or other arrangement with the business associate\
        \ that meets the applicable requirements of \xA7164.314(a). Readers may find\
        \ useful resources in Appendix F, including OCR BAA guidance and/or templates\
        \ that include applicable language.\n\nExecute new or update existing agreements\
        \ or arrangements as appropriate.\n\nIdentify roles and responsibilities.\n\
        \nInclude security requirements in business associate contracts and agreements\
        \ to address the confidentiality, integrity, and availability of ePHI.\n\n\
        Specify any training requirements associated with the contract/agreement or\
        \ arrangement, if reasonable and appropriate."
      implementation_groups:
      - N
      questions:
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node142:question:1:
          type: text
          text: Who is responsible for coordinating and preparing the final agreement
            or arrangement?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node142:question:2:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node142:question:2:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node142:question:2:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node142:question:2:choice:3
            value: N/A
          text: Does the agreement or arrangement specify how information is to be
            transmitted to and from the business associate?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node142:question:3:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node142:question:3:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node142:question:3:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node142:question:3:choice:3
            value: N/A
          text: Have security controls been specified for the business associate?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node142:question:4:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node142:question:4:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node142:question:4:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node142:question:4:choice:3
            value: N/A
          text: Are clear responsibilities identified and established regarding potentially
            overlapping HIPAA obligations (e.g., if hosting ePHI in the cloud, will
            the CE, BA, or both address encryption)?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node142:question:5:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node142:question:5:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node142:question:5:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node142:question:5:choice:3
            value: N/A
          text: Have appropriate organizational personnel been trained in the process
            of initiating and maintaining a business associate agreement (BAA)?
    - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node144
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:164.308(b)(1)
      name: Implementation Specification (Required)
      description: "Document the satisfactory assurances required by this standard\
        \ through a written contract or other arrangement with the business associate\
        \ that meets the applicable requirements of \xA7164.314(a). Readers may find\
        \ useful resources in Appendix F, including OCR BAA guidance and/or templates\
        \ that include applicable language."
      implementation_groups:
      - R
    - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:164.310
      assessable: false
      depth: 1
      ref_id: '164.310'
      description: "Physical Safeguards:\nDefined as the \u201Cphysical measures,\
        \ policies, and procedures to protect a covered entity\u2019s electronic information\
        \ systems and related buildings and equipment, from natural and environmental\
        \ hazards, and unauthorized intrusion.\u201D"
    - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:164.310(a)
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:164.310
      ref_id: 164.310(a)
      description: 'Facility Access Controls:

        HIPAA Standard: Implement policies and procedures to limit physical access
        to its electronic information systems and the facility or facilities in which
        they are housed, while ensuring that properly authorized access is allowed.'
    - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node148
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:164.310(a)
      name: 1. Conduct an Analysis of Existing Physical Security Vulnerabilities
      description: 'Inventory facilities and identify shortfalls and/or vulnerabilities
        in current physical security capabilities.


        Assign degrees of significance to each vulnerability identified and ensure
        that proper access is allowed.


        Determine which types of facilities require access controls to safeguard ePHI,
        such as:'
      implementation_groups:
      - N
      questions:
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node148:question:1:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node148:question:1:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node148:question:1:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node148:question:1:choice:3
            value: N/A
          text: If reasonable and appropriate, do non-public areas have locks and
            cameras?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node148:question:2:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node148:question:2:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node148:question:2:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node148:question:2:choice:3
            value: N/A
          text: Are computing devices protected from public access or viewing?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node148:question:3:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node148:question:3:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node148:question:3:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node148:question:3:choice:3
            value: N/A
          text: Are entrances and exits that lead to locations with ePHI secured?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node148:question:4:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node148:question:4:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node148:question:4:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node148:question:4:choice:3
            value: N/A
          text: Do policies and procedures already exist regarding access to and use
            of facilities and equipment?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node148:question:5:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node148:question:5:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node148:question:5:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node148:question:5:choice:3
            value: N/A
          text: Are there possible natural or human-made disasters that could happen
            in the environment?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node148:question:6:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node148:question:6:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node148:question:6:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node148:question:6:choice:3
            value: N/A
          text: Do normal physical protections exist (e.g., locks on doors, windows,
            and other means of preventing unauthorized access)?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node148:question:7:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node148:question:7:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node148:question:7:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node148:question:7:choice:3
            value: N/A
          text: Are network wiring cables protected and not exposed to unauthorized
            personnel?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node148:question:8:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node148:question:8:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node148:question:8:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node148:question:8:choice:3
            value: N/A
          text: Is there a list of workforce members who can access the facility after
            hours via the use of keys, badge access, and knowledge of the security
            or alarm system?
    - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node150
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:164.310(a)
      name: 2. Identify Corrective Measures
      description: 'Identify and assign responsibility for the measures and activities
        necessary to correct deficiencies, and ensure that proper physical access
        is allowed.


        Develop and deploy policies and procedures to ensure that repairs, upgrades,
        and/or modifications are made to the appropriate physical areas of the facility
        while ensuring that proper access is allowed.'
      implementation_groups:
      - N
      questions:
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node150:question:1:
          type: text
          text: Who is responsible for security?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node150:question:2:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node150:question:2:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node150:question:2:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node150:question:2:choice:3
            value: N/A
          text: Is a workforce member other than the security official responsible
            for facility/physical security?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node150:question:3:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node150:question:3:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node150:question:3:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node150:question:3:choice:3
            value: N/A
          text: Are facility access control policies and procedures already in place?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node150:question:4:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node150:question:4:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node150:question:4:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node150:question:4:choice:3
            value: N/A
          text: Do they need to be revised?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node150:question:5:
          type: text
          text: What training will be needed for workforce members to understand the
            policies and procedures?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node150:question:6:
          type: text
          text: How will decisions and actions be documented?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node150:question:7:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node150:question:7:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node150:question:7:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node150:question:7:choice:3
            value: N/A
          text: Is a property owner or external party (e.g., cloud service provider)
            required to make physical changes to meet the requirements?
    - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node152
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:164.310(a)
      name: 3. Develop a Facility Security Plan
      description: "Implement policies and procedures to safeguard the facility and\
        \ the equipment therein from unauthorized physical access, tampering, and\
        \ theft.\n\nImplement appropriate measures to provide physical security protection\
        \ for ePHI in a regulated entity\u2019s possession.\n\nInclude documentation\
        \ of the facility inventory, physical maintenance records, and a history of\
        \ changes, upgrades, and other modifications.\n\nIdentify points of access\
        \ to the facility and existing security controls."
      implementation_groups:
      - N
      questions:
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node152:question:1:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node152:question:1:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node152:question:1:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node152:question:1:choice:3
            value: N/A
          text: Is there an inventory of facilities and existing security practices?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node152:question:2:
          type: text
          text: What are the current procedures for securing the facilities (e.g.,
            exterior, interior, equipment, access controls, maintenance records)?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node152:question:3:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node152:question:3:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node152:question:3:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node152:question:3:choice:3
            value: N/A
          text: Is a workforce member other than the security official responsible
            for the facility plan?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node152:question:4:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node152:question:4:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node152:question:4:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node152:question:4:choice:3
            value: N/A
          text: Is there a contingency plan already in place, under revision, or under
            development?
    - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node154
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:164.310(a)
      name: Implementation Specification (Addressable)
      description: Implement policies and procedures to safeguard the facility and
        the equipment therein from unauthorized physical access, tampering, and theft.
      implementation_groups:
      - A
    - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node156
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:164.310(a)
      name: 4. Develop Access Control and Validation Procedures
      description: 'Implement procedures to control and validate a person''s access
        to facilities based on their role or function, including visitor control and
        control of access to software programs for testing and revision.


        Implement procedures to provide facility access to authorized personnel and
        visitors and exclude unauthorized persons.'
      implementation_groups:
      - N
      questions:
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node156:question:1:
          type: text
          text: What are the policies and procedures in place for controlling access
            by staff, contractors, visitors, and probationary workforce members?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node156:question:2:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node156:question:2:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node156:question:2:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node156:question:2:choice:3
            value: N/A
          text: Do the procedures identify individuals, roles, or job functions that
            are authorized to access software programs for testing and revision?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node156:question:3:
          type: text
          text: How many access points exist in each facility?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node156:question:4:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node156:question:4:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node156:question:4:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node156:question:4:choice:3
            value: N/A
          text: Is there an inventory?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node156:question:5:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node156:question:5:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node156:question:5:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node156:question:5:choice:3
            value: N/A
          text: Is monitoring equipment necessary?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node156:question:6:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node156:question:6:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node156:question:6:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node156:question:6:choice:3
            value: N/A
          text: Is there a periodic review of personnel with physical access?
    - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node158
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:164.310(a)
      name: Implementation Specification (Addressable)
      description: Implement procedures to control and validate a person's access
        to facilities based on their role or function, including visitor control and
        control of access to software programs for testing and revision.
      implementation_groups:
      - A
    - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node160
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:164.310(a)
      name: 5. Establish Contingency Operations Procedures
      description: Establish (and implement as needed) procedures that allow facility
        access in support of the restoration of lost data under the Disaster Recovery
        Plan and Emergency Mode Operations Plan in the event of an emergency.
      implementation_groups:
      - N
      questions:
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node160:question:1:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node160:question:1:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node160:question:1:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node160:question:1:choice:3
            value: N/A
          text: Are there procedures to allow facility access while restoring lost
            data in the event of an emergency?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node160:question:2:
          type: text
          text: Who needs access to ePHI in the event of a disaster?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node160:question:3:
          type: text
          text: What is the backup plan for access to the facility and/or ePHI?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node160:question:4:
          type: text
          text: Who is responsible for the contingency plan for access to ePHI?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node160:question:5:
          type: text
          text: Who is responsible for implementing the contingency plan for access
            to ePHI in each department or unit?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node160:question:6:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node160:question:6:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node160:question:6:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node160:question:6:choice:3
            value: N/A
          text: Will the contingency plan be appropriate in the event of all types
            of potential disasters (e.g., fire, flood, earthquake, etc.)?
    - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node162
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:164.310(a)
      name: Implementation Specification (Addressable)
      description: Establish (and implement as needed) procedures that allow facility
        access in support of the restoration of lost data under the Disaster Recovery
        Plan and Emergency Mode Operations Plan in the event of an emergency.
      implementation_groups:
      - A
    - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node164
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:164.310(a)
      name: 6. Maintain Maintenance Records
      description: Implement policies and procedures to document repairs and modifications
        to the physical components of a facility that are related to security (e.g.,
        hardware, walls, doors, and locks).
      implementation_groups:
      - N
      questions:
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node164:question:1:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node164:question:1:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node164:question:1:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node164:question:1:choice:3
            value: N/A
          text: Are policies and procedures developed and implemented that specify
            how to document repairs and modifications to the physical components of
            a facility that are related to security?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node164:question:2:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node164:question:2:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node164:question:2:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node164:question:2:choice:3
            value: N/A
          text: Are records of repairs to hardware, walls, doors, and locks maintained?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node164:question:3:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node164:question:3:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node164:question:3:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node164:question:3:choice:3
            value: N/A
          text: Has responsibility for maintaining these records been assigned?
    - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node166
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:164.310(a)
      name: Implementation Specification (Addressable)
      description: Implement policies and procedures to document repairs and modifications
        to the physical components of a facility that are related to security (e.g.,
        hardware, walls, doors, and locks).
      implementation_groups:
      - A
    - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:164.310(b)
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:164.310
      ref_id: 164.310(b)
      description: 'Workstation Use:

        HIPAA Standard: Implement policies and procedures that specify the proper
        functions to be performed, the manner in which those functions are to be performed,
        and the physical attributes of the surroundings of a specific workstation
        or class of workstation that can access electronic protected health information.'
    - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node169
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:164.310(b)
      name: 1. Identify Workstation and Device Types and Functions or Uses
      description: "Inventory workstations and devices that create, store, process\
        \ or transmit ePHI. Be sure to consider the multitude of computing devices\
        \ (e.g., medical equipment, medical IoT devices, tablets, smart phones, etc.).\n\
        \nDevelop policies and procedures for each type of device and identify and\
        \ accommodate their unique issues.\n\nClassify devices based on the capabilities,\
        \ connections, and allowable activities for each device used.\n\nDetermine\
        \ the proper function and manner by which specific workstations or classes\
        \ of workstations are permitted to access ePHI (e.g., applications permitting\
        \ access to ePHI that are allowed on workstations used by a hospital\u2019\
        s customer service call center or its radiology department)."
      implementation_groups:
      - N
      questions:
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node169:question:1:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node169:question:1:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node169:question:1:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node169:question:1:choice:3
            value: N/A
          text: Do the policies and procedures identify devices that access ePHI and
            those that do not?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node169:question:2:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node169:question:2:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node169:question:2:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node169:question:2:choice:3
            value: N/A
          text: Is there an inventory of device types and locations in the organization?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node169:question:3:
          type: text
          text: Who is responsible for this inventory and its maintenance?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node169:question:4:
          type: text
          text: What tasks are commonly performed on a given device or type of device?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node169:question:5:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node169:question:5:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node169:question:5:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node169:question:5:choice:3
            value: N/A
          text: Are all types of computing devices used as workstations identified
            along with the use of these devices?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node169:question:6:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node169:question:6:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node169:question:6:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node169:question:6:choice:3
            value: N/A
          text: Are all devices that create, store, process, or transmit ePHI owned
            by the regulated entity?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node169:question:7:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node169:question:7:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node169:question:7:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node169:question:7:choice:3
            value: N/A
          text: Are some devices personally owned or owned by another party?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node169:question:8:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node169:question:8:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node169:question:8:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node169:question:8:choice:3
            value: N/A
          text: Has the organization considered the use of automation to manage device
            inventory?
    - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node171
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:164.310(b)
      name: 2. Identify the Expected Performance of Each Type of Workstation and Device
      description: Develop and document policies and procedures related to the proper
        use and performance of devices that create, store, process, or transmit ePHI.
      implementation_groups:
      - N
      questions:
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node171:question:1:
          type: text
          text: How are these devices used in day-to-day operations?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node171:question:2:
          type: text
          text: Which devices are involved in various work activities?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node171:question:3:
          type: text
          text: What are key operational risks that could result in a breach of security?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node171:question:4:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node171:question:4:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node171:question:4:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node171:question:4:choice:3
            value: N/A
          text: Do the policies and procedures address the use of these devices for
            any personal use?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node171:question:5:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node171:question:5:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node171:question:5:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node171:question:5:choice:3
            value: N/A
          text: Has the organization updated training and awareness content to include
            the proper use and performance of these devices?
    - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node173
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:164.310(b)
      name: 3. Analyze Physical Surroundings for Physical Attributes
      description: "Ensure that any risks associated with a device\u2019s surroundings\
        \ are known and analyzed for possible negative impacts.\n\nDevelop policies\
        \ and procedures that will prevent or preclude the unauthorized access of\
        \ unattended devices, limit the ability of unauthorized persons to view sensitive\
        \ information, and dispose of sensitive information as needed."
      implementation_groups:
      - N
      questions:
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node173:question:1:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node173:question:1:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node173:question:1:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node173:question:1:choice:3
            value: N/A
          text: Do the policies and procedures specify where to place devices to only
            allow viewing by authorized personnel?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node173:question:2:
          type: text
          text: Where are devices located?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node173:question:3:
          type: text
          text: Where does work on ePHI occur?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node173:question:4:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node173:question:4:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node173:question:4:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node173:question:4:choice:3
            value: N/A
          text: Are some devices stationary?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node173:question:5:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node173:question:5:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node173:question:5:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node173:question:5:choice:3
            value: N/A
          text: Are some devices mobile and leave the physical facility?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node173:question:6:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node173:question:6:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node173:question:6:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node173:question:6:choice:3
            value: N/A
          text: Is viewing by unauthorized individuals restricted or limited on these
            devices?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node173:question:7:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node173:question:7:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node173:question:7:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node173:question:7:choice:3
            value: N/A
          text: Do changes need to be made in the space configuration?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node173:question:8:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node173:question:8:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node173:question:8:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node173:question:8:choice:3
            value: N/A
          text: Do workforce members understand the security requirements for the
            data they use in their day-to-day jobs?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node173:question:9:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node173:question:9:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node173:question:9:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node173:question:9:choice:3
            value: N/A
          text: Are any computing components (e.g., servers, workstations, medical
            devices) kept in locations that put the confidentiality, integrity, and
            availability of ePHI at risk?
    - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:164.310(c)
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:164.310
      ref_id: 164.310(c)
      description: 'Workstation Security:

        HIPAA Standard: Implement physical safeguards for all workstations that access
        electronic protected health information, to restrict access to authorized
        users.'
    - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node176
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:164.310(c)
      name: 1. Identify All Methods of Physical Access to Workstations and Devices
      description: 'Document the different ways that users access workstations and
        other devices that create, store, process, or transmit ePHI. Be sure to consider
        the multitude of computing devices (e.g., medical equipment, medical IoT devices,
        tablets, smart phones, etc.).


        Consider any mobile devices that leave the physical facility as well as remote
        workers who access devices that create, store, process, or transmit ePHI.'
      implementation_groups:
      - N
      questions:
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node176:question:1:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node176:question:1:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node176:question:1:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node176:question:1:choice:3
            value: N/A
          text: Is there an inventory of all current device locations?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node176:question:2:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node176:question:2:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node176:question:2:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node176:question:2:choice:3
            value: N/A
          text: Are any devices located in public areas?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node176:question:3:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node176:question:3:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node176:question:3:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node176:question:3:choice:3
            value: N/A
          text: Are laptops or other computing devices used as workstations to create,
            access, store, process, or transmit ePHI?
    - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node178
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:164.310(c)
      name: 2. Analyze the Risks Associated with Each Type of Access
      description: Determine which type of access identified in Key Activity 1 poses
        the greatest threat to the security of ePHI.
      implementation_groups:
      - N
      questions:
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node178:question:1:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node178:question:1:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node178:question:1:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node178:question:1:choice:3
            value: N/A
          text: Do any devices leave the facility?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node178:question:2:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node178:question:2:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node178:question:2:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node178:question:2:choice:3
            value: N/A
          text: Are any devices housed in areas that are more vulnerable to unauthorized
            use, theft, or viewing of the data they contain?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node178:question:3:
          type: text
          text: What are the options for modifying the current access configuration
            to protect ePHI?
    - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node180
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:164.310(c)
      name: 3. Identify and Implement Physical Safeguards for Workstations and Devices
      description: 'Implement physical safeguards and other security measures to minimize
        the possibility of inappropriate access to ePHI through computing devices.


        If there are impediments to physically securing devices and/or the facilities
        where devices are located, additional safeguards should be considered, such
        as:'
      implementation_groups:
      - N
      questions:
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node180:question:1:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node180:question:1:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node180:question:1:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node180:question:1:choice:3
            value: N/A
          text: Are physical safeguards implemented for all devices that access ePHI
            to restrict access to authorized users?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node180:question:2:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node180:question:2:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node180:question:2:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node180:question:2:choice:3
            value: N/A
          text: Are devices and other tools used in the provisioning of treatment,
            payment and operations protected from unauthorized access, viewing, modification,
            and/or theft within mobile healthcare environments?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node180:question:3:
          type: text
          text: What safeguards are in place,(e.g., locked doors, screen barriers,
            cameras, guards)?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node180:question:4:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node180:question:4:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node180:question:4:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node180:question:4:choice:3
            value: N/A
          text: Are additional physical safeguards needed to protect devices with
            ePHI?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node180:question:5:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node180:question:5:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node180:question:5:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node180:question:5:choice:3
            value: N/A
          text: Do any devices need to be relocated to enhance physical security?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node180:question:6:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node180:question:6:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node180:question:6:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node180:question:6:choice:3
            value: N/A
          text: Are safeguards such as anti-theft devices, physical privacy screens,
            or other procedures used to help prevent unauthorized audio and video
            recording
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node180:question:7:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node180:question:7:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node180:question:7:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node180:question:7:choice:3
            value: N/A
          text: Have workforce members been trained on security?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node180:question:8:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node180:question:8:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node180:question:8:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node180:question:8:choice:3
            value: N/A
          text: Are some devices not owned by the organization?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node180:question:9:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node180:question:9:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node180:question:9:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node180:question:9:choice:3
            value: N/A
          text: Do these ownership considerations preclude the use of any physical
            security controls on the device?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node180:question:10:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node180:question:10:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node180:question:10:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node180:question:10:choice:3
            value: N/A
          text: Do the policies and procedures specify the use of additional security
            measures to protect devices with ePHI, such as using privacy screens,
            enabling password-protected screen savers, or logging off the device?
    - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:164.310(d)
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:164.310
      ref_id: 164.310(d)
      description: 'Device and Media Controls:

        HIPAA Standard: Implement policies and procedures that govern the receipt
        and removal of hardware and electronic media that contain electronic protected
        health information into and out of a facility, and the movement of these items
        within the facility.'
    - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node183
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:164.310(d)
      name: 1. Implement Methods for the Final Disposal of ePHI
      description: 'Implement policies and procedures to address the final disposition
        of ePHI and/or the hardware or electronic media on which it is stored.


        Determine and document the appropriate methods to dispose of hardware, software,
        and the data itself.


        Ensure that ePHI is properly destroyed and cannot be recreated.'
      implementation_groups:
      - N
      questions:
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node183:question:1:
          type: text
          text: What ePHI is created, stored, processed, and transmitted by the organization?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node183:question:2:
          type: text
          text: On what media is it located?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node183:question:3:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node183:question:3:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node183:question:3:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node183:question:3:choice:3
            value: N/A
          text: Is data stored on removable, reusable media (e.g., flash drives, Secure
            Digital (SD) memory cards)?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node183:question:4:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node183:question:4:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node183:question:4:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node183:question:4:choice:3
            value: N/A
          text: Are policies and procedures developed and implemented that address
            the disposal of ePHI and/or the hardware and media on which ePHI is stored?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node183:question:5:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node183:question:5:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node183:question:5:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node183:question:5:choice:3
            value: N/A
          text: Is there a process for destroying data on all media?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node183:question:6:
          type: text
          text: What are the options for disposing of data on hardware?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node183:question:7:
          type: text
          text: What are the costs?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node183:question:8:
          type: text
          text: Prior to disposal, have media and devices containing ePHI been sanitized  in
            accordance with SP 800-88?
    - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node185
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:164.310(d)
      name: Implementation Specification (Required)
      description: Implement policies and procedures to address the final disposition
        of ePHI and/or the hardware or electronic media on which it is stored.
      implementation_groups:
      - R
    - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node187
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:164.310(d)
      name: 2. Develop and Implement Procedures for the Reuse of Electronic Media
      description: 'Implement procedures for the removal of ePHI from electronic media
        before the media become available for reuse.


        Ensure that ePHI previously stored on any electronic media cannot be accessed
        and reused.


        Identify removable media and their uses.


        Ensure that ePHI is removed from reusable media before they are used to record
        new information.'
      implementation_groups:
      - N
      questions:
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node187:question:1:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node187:question:1:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node187:question:1:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node187:question:1:choice:3
            value: N/A
          text: Do policies and procedures already exist regarding the reuse of electronic
            media (i.e., hardware and software)?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node187:question:2:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node187:question:2:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node187:question:2:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node187:question:2:choice:3
            value: N/A
          text: Have reused media been erased to the point where previous ePHI is
            neither readily available nor recoverable?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node187:question:3:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node187:question:3:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node187:question:3:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node187:question:3:choice:3
            value: N/A
          text: Is one individual and/or department responsible for coordinating the
            disposal of data and the reuse of the hardware and software?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node187:question:4:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node187:question:4:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node187:question:4:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node187:question:4:choice:3
            value: N/A
          text: Are workforce members appropriately trained on the security risks
            to ePHI when reusing software and hardware?
    - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node189
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:164.310(d)
      name: Implementation Specification (Required)
      description: Implement procedures for the removal of ePHI from electronic media
        before the media become available for reuse.
      implementation_groups:
      - R
    - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node191
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:164.310(d)
      name: 3. Maintain Accountability for Hardware and Electronic Media
      description: 'Maintain a record of the movements of hardware and electronic
        media and any person responsible for them.


        Ensure that ePHI is not inadvertently released or shared with any unauthorized
        party.


        Ensure that an individual is responsible for and records the receipt and removal
        of hardware and software with ePHI.'
      implementation_groups:
      - N
      questions:
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node191:question:1:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node191:question:1:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node191:question:1:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node191:question:1:choice:3
            value: N/A
          text: Have policies and procedures been implemented that govern the receipt
            and removal of hardware and electronic media that contain ePHI into and
            out of a facility, and the movement of these items within the facility?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node191:question:2:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node191:question:2:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node191:question:2:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node191:question:2:choice:3
            value: N/A
          text: Has a process been implemented to maintain a record of the movements
            of and persons responsible for hardware and electronic media that contain
            ePHI?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node191:question:3:
          type: text
          text: Where is data stored (i.e., what type of media)?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node191:question:4:
          type: text
          text: What procedures already exist to track hardware and software within
            the organization (e.g., an enterprise inventory management system)?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node191:question:5:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node191:question:5:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node191:question:5:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node191:question:5:choice:3
            value: N/A
          text: If workforce members are allowed to remove electronic media that contain
            or may be used to access ePHI, do procedures exist to track the media
            externally?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node191:question:6:
          type: text
          text: Who is responsible for maintaining records of hardware and software?
    - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node193
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:164.310(d)
      name: Implementation Specification (Addressable)
      description: Maintain a record of the movements of hardware and electronic media
        and any person responsible for them.
      implementation_groups:
      - A
    - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node195
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:164.310(d)
      name: 4. Develop Data Backup and Storage Procedures
      description: 'Create a retrievable exact copy of ePHI, when needed, before movement
        of equipment.


        Ensure that an exact retrievable copy of the data is retained and protected
        to maintain the integrity of ePHI during equipment relocation.'
      implementation_groups:
      - N
      questions:
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node195:question:1:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node195:question:1:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node195:question:1:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node195:question:1:choice:3
            value: N/A
          text: Has a process been implemented to create a retrievable, exact copy
            of ePHI when needed and before the movement of equipment?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node195:question:2:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node195:question:2:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node195:question:2:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node195:question:2:choice:3
            value: N/A
          text: Are backup files maintained offsite to ensure data availability in
            the event that data is lost while transporting or moving electronic media
            that contain ePHI?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node195:question:3:
          type: text
          text: If data were to be unavailable while media are transported or moved
            for a period of time, what would the business impact be?
    - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node197
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:164.310(d)
      name: Implementation Specification (Addressable)
      description: Create a retrievable exact copy of ePHI, when needed, before movement
        of equipment.
      implementation_groups:
      - A
    - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:164.312
      assessable: false
      depth: 1
      ref_id: '164.312'
      description: "Technical Safeguards:\nDefined as the \u201Cthe technology and\
        \ the policy and procedures for its use that protect electronic protected\
        \ health information and control access to it.\u201D"
    - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:164.312(a)
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:164.312
      ref_id: 164.312(a)
      description: "Access Control:\nHIPAA Standard: Implement technical policies\
        \ and procedures for electronic information systems that maintain electronic\
        \ protected health information to allow access only to those persons or software\
        \ programs that have been granted access rights as specified in \xA7 164.308(a)(4)."
    - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node201
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:164.312(a)
      name: 1. Analyze Workloads and Operations to Identify the Access Needs of All
        Users
      description: 'Identify an approach for access control.


        Consider all applications and systems containing ePHI that should only be
        available to authorized users, processes, and services.


        Integrate these activities into the access granting and management process.'
      implementation_groups:
      - N
      questions:
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node201:question:1:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node201:question:1:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node201:question:1:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node201:question:1:choice:3
            value: N/A
          text: Have all applications and systems with ePHI been identified?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node201:question:2:
          type: text
          text: What user roles are defined for those applications and systems?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node201:question:3:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node201:question:3:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node201:question:3:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node201:question:3:choice:3
            value: N/A
          text: Is access to systems containing ePHI only granted to authorized processes
            and services?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node201:question:4:
          type: text
          text: Where is the ePHI supporting those applications and systems currently
            housed (e.g., stand-alone computer, network storage, database)?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node201:question:5:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node201:question:5:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node201:question:5:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node201:question:5:choice:3
            value: N/A
          text: Are data and/or systems being accessed remotely?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node201:question:6:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node201:question:6:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node201:question:6:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node201:question:6:choice:3
            value: N/A
          text: "Have access decisions been based on determinations from \xA7 164.308(a)(4)\
            \ Information Access Management?"
    - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node203
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:164.312(a)
      name: 2. Identify Technical Access Control Capabilities
      description: "Determine the access control capabilities of all systems with\
        \ ePHI.\n\nDetermine whether network infrastructure can limit access to systems\
        \ with ePHI (e.g., network segmentation).\n\nImplement technical access controls\
        \ to limit access to ePHI to only that which has been granted in accordance\
        \ with the regulated entity\u2019s information access management policies\
        \ and procedures (see 45 CFR 164.308(a)(4))."
      implementation_groups:
      - N
      questions:
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node203:question:1:
          type: text
          text: How are the systems accessed for viewing, modifying, or creating data?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node203:question:2:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node203:question:2:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node203:question:2:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node203:question:2:choice:3
            value: N/A
          text: "Can identified technical access controls limit access to ePHI to\
            \ only what is authorized in accordance with the regulated entity\u2019\
            s information access management policies and procedures (see 45 CFR 164.308(a)(4))?"
    - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node205
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:164.312(a)
      name: 3. Ensure that All System Users Have Been Assigned a Unique Identifier
      description: 'Assign a unique name and/or number for identifying and tracking
        user identity.


        Ensure that system activity can be traced to a specific user.


        Ensure that the necessary data is available in the system logs to support
        audit and other related business functions.'
      implementation_groups:
      - N
      questions:
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node205:question:1:
          type: text
          text: How should the identifier be established (e.g., length and content)?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node205:question:2:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node205:question:2:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node205:question:2:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node205:question:2:choice:3
            value: N/A
          text: Should the identifier be self-selected, organizationally selected,
            or randomly generated?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node205:question:3:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node205:question:3:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node205:question:3:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node205:question:3:choice:3
            value: N/A
          text: Are logs associated with access events created?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node205:question:4:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node205:question:4:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node205:question:4:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node205:question:4:choice:3
            value: N/A
          text: Are these access logs regularly reviewed?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node205:question:5:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node205:question:5:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node205:question:5:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node205:question:5:choice:3
            value: N/A
          text: Can the unique user identifier be used to track user access to ePHI?
    - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node207
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:164.312(a)
      name: Implementation Specification (Required)
      description: Assign a unique name and/or number for identifying and tracking
        user identity.
      implementation_groups:
      - R
    - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node209
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:164.312(a)
      name: 4. Develop Access Control Policy  and Procedures
      description: 'Establish a formal policy for access control that will guide the
        development of procedures.


        Specify requirements for access control that are both feasible and cost-effective.'
      implementation_groups:
      - N
      questions:
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node209:question:1:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node209:question:1:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node209:question:1:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node209:question:1:choice:3
            value: N/A
          text: Have rules of behavior been established and communicated to system
            users?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node209:question:2:
          type: text
          text: How will rules of behavior be enforced?
    - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node211
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:164.312(a)
      name: 5. Implement Access Control Procedures Using Selected Hardware and Software
      description: Implement the policy and procedures using existing or additional
        hardware or software solutions.
      implementation_groups:
      - N
      questions:
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node211:question:1:
          type: text
          text: Who will manage the access control procedures?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node211:question:2:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node211:question:2:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node211:question:2:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node211:question:2:choice:3
            value: N/A
          text: Are current users trained in access control management?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node211:question:3:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node211:question:3:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node211:question:3:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node211:question:3:choice:3
            value: N/A
          text: Will user training be needed to implement access control procedures?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node211:question:4:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node211:question:4:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node211:question:4:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node211:question:4:choice:3
            value: N/A
          text: Do the medical devices in use by the organization support user authentication?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node211:question:5:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node211:question:5:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node211:question:5:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node211:question:5:choice:3
            value: N/A
          text: Are there processes in place to manage this authentication?
    - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node213
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:164.312(a)
      name: 6. Review and Update Access for Users and Processes
      description: "Enforce the policy and procedures as a matter of ongoing operations.\n\
        \nDetermine whether any changes are needed for access control mechanisms.\n\
        \nEnsure that the modification of technical controls that affect a user\u2019\
        s access to ePHI continue to limit access to ePHI to that which has been granted\
        \ in accordance with the regulated entity\u2019s information access management\
        \ policies and procedures (see 45 CFR 164.308(a)(4)).\n\nEstablish procedures\
        \ for updating access when users require the following:"
      implementation_groups:
      - N
      questions:
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node213:question:1:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node213:question:1:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node213:question:1:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node213:question:1:choice:3
            value: N/A
          text: Have new workforce members/users been given proper instructions for
            protecting data and systems?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node213:question:2:
          type: text
          text: What are the procedures for new employee/user access to data and systems?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node213:question:3:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node213:question:3:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node213:question:3:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node213:question:3:choice:3
            value: N/A
          text: Are there procedures for reviewing and, if appropriate, modifying
            access authorizations for existing users, services, and processes?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node213:question:4:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node213:question:4:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node213:question:4:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node213:question:4:choice:3
            value: N/A
          text: Do users and processes have the appropriate set of permissions to
            ePHI to which they were granted access and to the appropriate systems
            that create, store, process, or transmit ePHI?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node213:question:5:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node213:question:5:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node213:question:5:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node213:question:5:choice:3
            value: N/A
          text: Has the regulated entity considered the use of automation for reviewing
            the access needs of users and processes?
    - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node215
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:164.312(a)
      name: 7. Establish an Emergency Access Procedure
      description: 'Establish (and implement as needed) procedures for obtaining necessary
        electronic protected health information during an emergency.


        Identify a method for supporting continuity of operations should the normal
        access procedures be disabled or unavailable due to system problems.'
      implementation_groups:
      - N
      questions:
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node215:question:1:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node215:question:1:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node215:question:1:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node215:question:1:choice:3
            value: N/A
          text: Are there policies and procedures in place to provide appropriate
            access to ePHI in emergency situations?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node215:question:2:
          type: date
          text: When should the emergency access procedure be activated?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node215:question:3:
          type: text
          text: Who is authorized to make the decision?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node215:question:4:
          type: text
          text: Who has assigned roles in the process?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node215:question:5:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node215:question:5:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node215:question:5:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node215:question:5:choice:3
            value: N/A
          text: Will systems automatically default to settings and functionalities
            that will enable the emergency access procedure or will the mode be activated
            by the system administrator or other authorized individual?
    - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node217
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:164.312(a)
      name: Implementation Specification (Required)
      description: Establish (and implement as needed) procedures for obtaining necessary
        electronic protected health information during an emergency.
      implementation_groups:
      - R
    - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node219
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:164.312(a)
      name: 8. Automatic Logoff and Encryption and Decryption
      description: 'Consider whether the addressable implementation specifications
        of this standard are reasonable and appropriate:'
      implementation_groups:
      - N
      questions:
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node219:question:1:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node219:question:1:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node219:question:1:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node219:question:1:choice:3
            value: N/A
          text: "Are automatic logoff features available for any of the regulated\
            \ entity\u2019s operating systems or other major applications?"
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node219:question:2:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node219:question:2:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node219:question:2:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node219:question:2:choice:3
            value: N/A
          text: If applications have been created or developed in-house, is it reasonable
            and appropriate to modify them to feature an automatic logoff capability?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node219:question:3:
          type: text
          text: What period of inactivity prior to automatic logoff is reasonable
            and appropriate for the regulated entity?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node219:question:4:
          type: text
          text: "What encryption capabilities are available for the regulated entity\u2019\
            s ePHI?"
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node219:question:5:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node219:question:5:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node219:question:5:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node219:question:5:choice:3
            value: N/A
          text: Is encryption appropriate for storing and maintaining ePHI (i.e.,
            at rest)?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node219:question:6:
          type: text
          text: Based on the risk assessment, is encryption needed to effectively
            protect ePHI at rest from unauthorized access?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node219:question:7:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node219:question:7:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node219:question:7:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node219:question:7:choice:3
            value: N/A
          text: Is email encryption necessary for the organization to protect ePHI?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node219:question:8:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node219:question:8:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node219:question:8:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node219:question:8:choice:3
            value: N/A
          text: Are automated confidentiality statements needed for email leaving
            the organization?
    - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node221
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:164.312(a)
      name: Implementation Specification (Automatic Logoff)
      description: 'Consider whether the addressable implementation specifications
        of this standard are reasonable and appropriate:'
      implementation_groups:
      - N
    - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node223
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:164.312(a)
      name: Implementation Specification (Encryption and Decryption)
      description: 'Consider whether the addressable implementation specifications
        of this standard are reasonable and appropriate:'
      implementation_groups:
      - N
    - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node225
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:164.312(a)
      name: 9. Terminate Access if it is No Longer Required
      description: 'Ensure that access to ePHI is terminated if the access is no longer
        authorized.


        Consider implementing a user recertification process to ensure that least
        privilege is enforced.'
      implementation_groups:
      - N
      questions:
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node225:question:1:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node225:question:1:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node225:question:1:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node225:question:1:choice:3
            value: N/A
          text: Are rules being enforced to remove access by staff members who no
            longer have a need to know because they have changed assignments or have
            stopped working for the organization?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node225:question:2:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node225:question:2:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node225:question:2:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node225:question:2:choice:3
            value: N/A
          text: Does the organization revisit user access requirements regularly to
            ensure least privilege?
    - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:164.312(b)
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:164.312
      ref_id: 164.312(b)
      description: 'Audit Controls:

        HIPAA Standard: Implement hardware, software, and/or procedural mechanisms
        that record and examine activity in information systems that contain or use
        electronic protected health information.'
    - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node228
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:164.312(b)
      name: 1. Determine the Activities that Will Be Tracked or Audited
      description: "Determine the appropriate scope of audit controls that will be\
        \ necessary in information systems that contain or use ePHI based on the regulated\
        \ entity\u2019s risk assessment and other organizational factors.\n\nDetermine\
        \ what activities need to be captured using the results of the risk assessment\
        \ and risk management processes."
      implementation_groups:
      - N
      questions:
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node228:question:1:
          type: text
          text: Where is ePHI at risk in the organization?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node228:question:2:
          type: text
          text: What systems, applications, or processes make ePHI vulnerable to unauthorized
            or inappropriate tampering, uses, or disclosures?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node228:question:3:
          type: text
          text: What activities will be audited (e.g., creating ePHI, accessing ePHI,
            modifying ePHI, transmitting ePHI, and/or deleting files or records that
            contain ePHI)?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node228:question:4:
          type: text
          text: What should the audit record include (e.g., user responsible for the
            activity; event type, date, or time)?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node228:question:5:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node228:question:5:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node228:question:5:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node228:question:5:choice:3
            value: N/A
          text: Are audit records generated for all systems/devices that create, store,
            process, or transmit ePHI?
    - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node230
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:164.312(b)
      name: 2. Select the Tools that Will Be Deployed for Auditing and System Activity
        Reviews
      description: Evaluate existing system capabilities and determine whether any
        changes or upgrades are necessary.
      implementation_groups:
      - N
      questions:
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node230:question:1:
          type: text
          text: What tools are in place?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node230:question:2:
          type: text
          text: What are the most appropriate monitoring tools for the organization
            (e.g., third party, freeware, or operating system-provided)?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node230:question:3:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node230:question:3:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node230:question:3:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node230:question:3:choice:3
            value: N/A
          text: Are changes/upgrades to information systems reasonable and appropriate?
    - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node232
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:164.312(b)
      name: 3. Develop and Deploy the Information System Activity Review/Audit Policy
      description: "Document and communicate to the workforce the organization\u2019\
        s decisions on audits and reviews."
      implementation_groups:
      - N
      questions:
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node232:question:1:
          type: text
          text: Who is responsible for the overall audit process and results?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node232:question:2:
          type: text
          text: How often will audits take place?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node232:question:3:
          type: text
          text: How often will audit results be analyzed?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node232:question:4:
          type: text
          text: "What is the organization\u2019s sanction policy for employee violations?"
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node232:question:5:
          type: text
          text: Where will audit information reside (e.g., separate server)?
    - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node234
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:164.312(b)
      name: 4. Develop Appropriate Standard Operating Procedures
      description: 'Determine the types of audit trail data and monitoring procedures
        that will be needed to derive exception reports.


        Determine the frequency of audit log reviews based on the risk assessment
        and risk management processes.'
      implementation_groups:
      - N
      questions:
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node234:question:1:
          type: text
          text: How will exception reports or logs be reviewed?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node234:question:2:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node234:question:2:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node234:question:2:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node234:question:2:choice:3
            value: N/A
          text: Has the organization considered the use of automation to assist in
            the monitoring and review of system activity?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node234:question:3:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node234:question:3:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node234:question:3:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node234:question:3:choice:3
            value: N/A
          text: "Are the organization\u2019s monitoring system activity and logs reviewed\
            \ frequently enough to sufficiently protect ePHI?"
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node234:question:4:
          type: text
          text: Where will monitoring reports be filed and maintained?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node234:question:5:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node234:question:5:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node234:question:5:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node234:question:5:choice:3
            value: N/A
          text: Is there a formal process in place to address system misuse, abuse,
            and fraudulent activity?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node234:question:6:
          type: text
          text: How will managers and workforce members be notified, when appropriate,
            regarding suspect activity?
    - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node236
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:164.312(b)
      name: 5. Implement the Audit/System Activity Review Process
      description: 'Activate the necessary audit system.

        Begin logging and auditing procedures.'
      implementation_groups:
      - N
      questions:
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node236:question:1:
          type: text
          text: What mechanisms (e.g., metrics) will be implemented to assess the
            effectiveness of the audit process?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node236:question:2:
          type: text
          text: What is the plan to revise the audit process when needed?
    - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:164.312(c)
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:164.312
      ref_id: 164.312(c)
      description: 'Integrity:

        HIPAA Standard: Implement policies and procedures to protect electronic protected
        health information from improper alteration or destruction.'
    - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node239
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:164.312(c)
      name: 1. Identify All Users Who Have Been Authorized to Access ePHI
      description: 'Identify all approved users with the ability to alter or destroy
        ePHI, if reasonable and appropriate.


        Address this Key Activity in conjunction with the identification of unauthorized
        sources in Key Activity 2.'
      implementation_groups:
      - N
      questions:
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node239:question:1:
          type: text
          text: How are users authorized to access the information?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node239:question:2:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node239:question:2:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node239:question:2:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node239:question:2:choice:3
            value: N/A
          text: Is there a sound basis for why they need the access?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node239:question:3:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node239:question:3:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node239:question:3:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node239:question:3:choice:3
            value: N/A
          text: Have they been trained on how to use the information?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node239:question:4:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node239:question:4:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node239:question:4:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node239:question:4:choice:3
            value: N/A
          text: Is there an audit trail established for all accesses to the information?
    - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node241
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:164.312(c)
      name: 2. Identify Any Possible Unauthorized Sources that May Be Able to Intercept
        the Information and Modify It
      description: 'Identify scenarios that may result in modification to the ePHI
        by unauthorized sources (e.g., hackers, ransomware, insider threats, business
        competitors, user errors).


        Conduct this activity as part of a risk analysis.


        Consider how the organization will detect unauthorized modification to ePHI'
      implementation_groups:
      - N
      questions:
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node241:question:1:
          type: text
          text: What are likely sources that could jeopardize information integrity?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node241:question:2:
          type: text
          text: What can be done to protect the integrity of the information when
            it is residing in a system (at rest)?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node241:question:3:
          type: text
          text: What procedures and policies can be established to decrease or prevent
            alteration of the information during transmission?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node241:question:4:
          type: text
          text: What options exist to detect the unauthorized modification of ePHI?
    - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node243
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:164.312(c)
      name: 3. Develop the Integrity Policy and Requirements
      description: Establish a formal written set of integrity requirements based
        on the results of the analysis completed in Key Activities 1 and 2.
      implementation_groups:
      - N
      questions:
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node243:question:1:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node243:question:1:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node243:question:1:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node243:question:1:choice:3
            value: N/A
          text: Have the requirements been discussed and agreed to by identified key
            personnel involved in the processes that are affected?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node243:question:2:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node243:question:2:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node243:question:2:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node243:question:2:choice:3
            value: N/A
          text: Have the requirements been documented?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node243:question:3:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node243:question:3:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node243:question:3:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node243:question:3:choice:3
            value: N/A
          text: Has a written policy been developed and communicated to personnel?
    - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node245
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:164.312(c)
      name: 4. Implement Procedures to Address These Requirements
      description: 'Identify and implement methods that will be used to protect ePHI
        from unauthorized modification.


        Identify and implement tools and techniques to be developed or procured that
        support the assurance of integrity.'
      implementation_groups:
      - N
      questions:
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node245:question:1:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node245:question:1:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node245:question:1:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node245:question:1:choice:3
            value: N/A
          text: Are current audit, logging, and access control techniques sufficient
            to address the integrity of ePHI?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node245:question:2:
          type: text
          text: If not, what additional techniques (e.g., quality control process,
            transaction and output reconstruction) can be utilized to check the integrity
            of ePHI?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node245:question:3:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node245:question:3:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node245:question:3:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node245:question:3:choice:3
            value: N/A
          text: Are technical solutions in place to prevent and detect the malicious
            alteration or destruction of ePHI (e.g., anti-malware, anti-ransomware,
            file integrity monitoring solutions)?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node245:question:4:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node245:question:4:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node245:question:4:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node245:question:4:choice:3
            value: N/A
          text: Can the additional training of users decrease instances attributable
            to human errors?
    - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node247
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:164.312(c)
      name: 5. Implement a Mechanism to Authenticate ePHI
      description: 'Implement electronic mechanisms to corroborate that ePHI has not
        been altered or destroyed in an unauthorized manner.


        Consider possible mechanisms for integrity verification, such as:'
      implementation_groups:
      - N
      questions:
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node247:question:1:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node247:question:1:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node247:question:1:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node247:question:1:choice:3
            value: N/A
          text: Are the uses of both electronic and non-electronic mechanisms necessary
            for the protection of ePHI?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node247:question:2:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node247:question:2:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node247:question:2:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node247:question:2:choice:3
            value: N/A
          text: Are appropriate electronic authentication tools available?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node247:question:3:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node247:question:3:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node247:question:3:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node247:question:3:choice:3
            value: N/A
          text: Are available electronic authentication tools interoperable with other
            applications and system components?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node247:question:4:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node247:question:4:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node247:question:4:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node247:question:4:choice:3
            value: N/A
          text: If ePHI is detected as altered by unauthorized users or improperly
            altered by authorized users, is a process in place to respond?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node247:question:5:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node247:question:5:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node247:question:5:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node247:question:5:choice:3
            value: N/A
          text: Is this response process tied to organizational incident management
            processes?
    - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node249
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:164.312(c)
      name: Implementation Specification (Addressable)
      description: Implement electronic mechanisms to corroborate that ePHI has not
        been altered or destroyed in an unauthorized manner.
      implementation_groups:
      - A
    - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node251
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:164.312(c)
      name: 6. Establish a Monitoring Process to Assess How the Implemented Process
        is Working
      description: 'Review existing processes to determine whether objectives are
        being addressed.


        Continually reassess integrity processes as technology and operational environments
        change to determine whether they need to be revised.'
      implementation_groups:
      - N
      questions:
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node251:question:1:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node251:question:1:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node251:question:1:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node251:question:1:choice:3
            value: N/A
          text: Are there reported instances of information integrity problems?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node251:question:2:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node251:question:2:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node251:question:2:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node251:question:2:choice:3
            value: N/A
          text: Have they decreased since integrity procedures were implemented?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node251:question:3:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node251:question:3:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node251:question:3:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node251:question:3:choice:3
            value: N/A
          text: Does the process, as implemented, provide a higher level of assurance
            that information integrity is being maintained?
    - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:164.312(d)
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:164.312
      ref_id: 164.312(d)
      description: 'Person or Entity Authentication:

        HIPAA Standard: Implement procedures to verify that a person or entity seeking
        access to electronic protected health information is the one claimed.'
    - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node254
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:164.312(d)
      name: 1. Determine Authentication Applicability to Current Systems/Applications
      description: "Identify the methods available for authentication. Under the HIPAA\
        \ Security Rule, authentication is the corroboration that a person is the\
        \ one claimed (45 CFR \xA7 164.304).\n\nIdentify points of electronic access\
        \ that require or should require authentication. Ensure that the regulated\
        \ entity\u2019s risk analysis properly assesses risks for such access points\
        \ (e.g., risks of unauthorized access from within the enterprise could be\
        \ different than those of remote unauthorized access).\n\nAuthentication requires\
        \ establishing the validity of a transmission source and/or verifying an individual\u2019\
        s claim that they have been authorized for specific access privileges to information\
        \ and information systems."
      implementation_groups:
      - N
      questions:
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node254:question:1:
          type: text
          text: What authentication methods are available?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node254:question:2:
          type: text
          text: What are the advantages and disadvantages of each method?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node254:question:3:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node254:question:3:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node254:question:3:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node254:question:3:choice:3
            value: N/A
          text: Can risks of unauthorized access be sufficiently reduced for each
            point of electronic access with available authentication methods?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node254:question:4:
          type: text
          text: What will it cost to implement the available methods in the environment?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node254:question:5:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node254:question:5:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node254:question:5:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node254:question:5:choice:3
            value: N/A
          text: Are there trained staff who can maintain the system or should outsourced
            support be considered?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node254:question:6:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node254:question:6:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node254:question:6:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node254:question:6:choice:3
            value: N/A
          text: Are passwords being used?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node254:question:7:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node254:question:7:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node254:question:7:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node254:question:7:choice:3
            value: N/A
          text: If so, are they unique to the individual?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node254:question:8:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node254:question:8:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node254:question:8:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node254:question:8:choice:3
            value: N/A
          text: Is MFA being used?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node254:question:9:
          type: text
          text: If so, how and where is it implemented?
    - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node256
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:164.312(d)
      name: 2. Evaluate Available Authentication Options
      description: 'Weigh the relative advantages and disadvantages of commonly used
        authentication approaches.


        There are three commonly used authentication approaches available:


        MFA utilizes two or more authentication approaches to enforce stronger authentication.


        Consider implementing MFA solutions when the risk to ePHI is sufficiently
        high.'
      implementation_groups:
      - N
      questions:
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node256:question:1:
          type: text
          text: What are the strengths and weaknesses of each available option?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node256:question:2:
          type: text
          text: Which can be best supported with assigned resources (e.g., budget/staffing)?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node256:question:3:
          type: text
          text: What level of authentication is appropriate for each access to ePHI
            based on the assessment of risk?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node256:question:4:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node256:question:4:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node256:question:4:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node256:question:4:choice:3
            value: N/A
          text: Has the organization identified all instances of access to ePHI (including
            by services, vendors, or application programming interfaces [APIs]) and
            considered appropriate authentication requirements based on the risk assessment?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node256:question:5:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node256:question:5:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node256:question:5:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node256:question:5:choice:3
            value: N/A
          text: Has the organization considered MFA for access to ePHI that poses
            high risk (e.g., remote access, access to privileged functions)?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node256:question:6:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node256:question:6:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node256:question:6:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node256:question:6:choice:3
            value: N/A
          text: Has the organization researched available MFA options and made a selection
            based on risk to ePHI?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node256:question:7:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node256:question:7:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node256:question:7:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node256:question:7:choice:3
            value: N/A
          text: Is outside vendor support required to implement the process?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node256:question:8:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node256:question:8:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node256:question:8:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node256:question:8:choice:3
            value: N/A
          text: Are there password-less authentication options (e.g., biometric authentication)
            available that can sufficiently address the risk to ePHI?
    - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node258
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:164.312(d)
      name: 3. Select and Implement   Authentication Options
      description: 'Consider the results of the analysis conducted under Key Activity
        2, and select appropriate authentication methods based on the results of the
        risk assessment and risk management processes.


        Implement the methods selected in organizational operations and activities.'
      implementation_groups:
      - N
      questions:
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node258:question:1:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node258:question:1:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node258:question:1:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node258:question:1:choice:3
            value: N/A
          text: "Has the organization\u2019s selection of authentication methods been\
            \ made based on the results of the risk assessment?"
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node258:question:2:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node258:question:2:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node258:question:2:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node258:question:2:choice:3
            value: N/A
          text: If passwords are being used as an authentication element, are they
            of sufficient length and strength to protect ePHI?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node258:question:3:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node258:question:3:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node258:question:3:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node258:question:3:choice:3
            value: N/A
          text: Is this enforced by technical policies?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node258:question:4:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node258:question:4:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node258:question:4:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node258:question:4:choice:3
            value: N/A
          text: Has necessary user and support staff training been completed?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node258:question:5:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node258:question:5:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node258:question:5:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node258:question:5:choice:3
            value: N/A
          text: Have a formal authentication policy and procedures been established
            and communicated?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node258:question:6:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node258:question:6:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node258:question:6:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node258:question:6:choice:3
            value: N/A
          text: Has necessary testing been completed to ensure that the authentication
            system is working as prescribed?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node258:question:7:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node258:question:7:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node258:question:7:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node258:question:7:choice:3
            value: N/A
          text: Do the procedures include ongoing system maintenance and updates?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node258:question:8:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node258:question:8:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node258:question:8:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node258:question:8:choice:3
            value: N/A
          text: Is the process implemented in such a way that it does not compromise
            the authentication information (e.g., password file encryption, etc.)?
    - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:164.312(e)(1)
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:164.312
      ref_id: 164.312(e)(1)
      description: 'Transmission Security:

        HIPAA Standard: Implement technical security measures to guard against unauthorized
        access to electronic protected health information that is being transmitted
        over an electronic communications network.'
    - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node261
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:164.312(e)(1)
      name: 1. Identify Any Possible Unauthorized Sources that May Be Able to Intercept
        and/or Modify the Information
      description: 'Identify all pathways by which ePHI will be transmitted into,
        within, and outside of the organization.


        Identify scenarios (e.g., telehealth, claims processing) that may result in
        access to or modification of the ePHI by unauthorized sources during transmission
        (e.g., hackers, disgruntled workforce members, business competitors).


        Identify scenarios and pathways that may put ePHI at a high level of risk.'
      implementation_groups:
      - N
      questions:
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node261:question:1:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node261:question:1:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node261:question:1:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node261:question:1:choice:3
            value: N/A
          text: Have all pathways by which ePHI will be transmitted (e.g., file transfers,
            email, web portals, mobile apps, communications with servers or databases
            containing ePHI, online tracking) been identified?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node261:question:2:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node261:question:2:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node261:question:2:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node261:question:2:choice:3
            value: N/A
          text: Has a risk assessment been used to determine transmission pathways
            and scenarios that may pose high risk to ePHI?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node261:question:3:
          type: text
          text: What measures exist to protect ePHI in transmission?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node261:question:4:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node261:question:4:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node261:question:4:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node261:question:4:choice:3
            value: N/A
          text: Have appropriate protection mechanisms been identified for all scenarios
            and pathways by which ePHI is transmitted?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node261:question:5:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node261:question:5:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node261:question:5:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node261:question:5:choice:3
            value: N/A
          text: Is there an auditing process in place to verify that ePHI has been
            protected against unauthorized access during transmission?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node261:question:6:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node261:question:6:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node261:question:6:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node261:question:6:choice:3
            value: N/A
          text: Are there trained staff members to monitor transmissions?
    - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node263
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:164.312(e)(1)
      name: 2. Develop and Implement Transmission Security Policy and Procedures
      description: 'Establish a formal written set of requirements for transmitting
        ePHI.


        Identify methods of transmission that will be used to safeguard ePHI.


        Identify tools and techniques that will be used to support the transmission
        security policy.


        Implement procedures for transmitting ePHI using hardware and/or software,
        if needed.'
      implementation_groups:
      - N
      questions:
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node263:question:1:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node263:question:1:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node263:question:1:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node263:question:1:choice:3
            value: N/A
          text: Have the requirements been discussed and agreed to by identified key
            personnel involved in transmitting ePHI?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node263:question:2:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node263:question:2:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node263:question:2:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node263:question:2:choice:3
            value: N/A
          text: Has a written policy been developed and communicated to system users?
    - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node265
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:164.312(e)(1)
      name: 3. Implement Integrity Controls
      description: Implement security measures to ensure that electronically transmitted
        ePHI is not improperly modified without detection until disposed of.
      implementation_groups:
      - N
      questions:
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node265:question:1:
          type: text
          text: What security measures are currently used to protect ePHI during transmission?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node265:question:2:
          type: text
          text: What measures are planned to protect ePHI in transmission?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node265:question:3:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node265:question:3:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node265:question:3:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node265:question:3:choice:3
            value: N/A
          text: Is there assurance that information is not altered during transmission?
    - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node267
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:164.312(e)(1)
      name: Implementation Specification (Addressable)
      description: Implement security measures to ensure that electronically transmitted
        ePHI is not improperly modified without detection until disposed of.
      implementation_groups:
      - A
    - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node269
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:164.312(e)(1)
      name: 4. Implement Encryption
      description: Implement a mechanism to encrypt ePHI whenever appropriate.
      implementation_groups:
      - N
      questions:
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node269:question:1:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node269:question:1:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node269:question:1:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node269:question:1:choice:3
            value: N/A
          text: Is encryption reasonable and appropriate to protect ePHI in transmission?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node269:question:2:
          type: text
          text: Based on the risk assessment, is encryption needed to effectively
            protect the information from unauthorized access during transmission?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node269:question:3:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node269:question:3:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node269:question:3:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node269:question:3:choice:3
            value: N/A
          text: Has the organization considered the use of email encryption and automated
            confidentiality statements when emailing outside of the organization?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node269:question:4:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node269:question:4:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node269:question:4:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node269:question:4:choice:3
            value: N/A
          text: Is encryption feasible and cost-effective in this environment?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node269:question:5:
          type: text
          text: What encryption algorithms and mechanisms are available?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node269:question:6:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node269:question:6:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node269:question:6:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node269:question:6:choice:3
            value: N/A
          text: Are available encryption algorithms and mechanisms of sufficient strength
            to protect electronically transmitted ePHI?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node269:question:7:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node269:question:7:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node269:question:7:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node269:question:7:choice:3
            value: N/A
          text: Is electronic transmission hardware/software configured so that the
            strength of encryption used in transmitting ePHI cannot be weakened?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node269:question:8:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node269:question:8:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node269:question:8:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node269:question:8:choice:3
            value: N/A
          text: Have all applications used on devices  that support the provisioning
            of health services been assessed to verify that strong transmission security
            is implemented?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node269:question:9:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node269:question:9:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node269:question:9:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node269:question:9:choice:3
            value: N/A
          text: Does the covered entity have the appropriate staff to maintain a process
            for encrypting ePHI during transmission?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node269:question:10:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node269:question:10:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node269:question:10:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node269:question:10:choice:3
            value: N/A
          text: Are workforce members skilled in the use of encryption?
    - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node271
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:164.312(e)(1)
      name: Implementation Specification (Addressable)
      description: Implement a mechanism to encrypt ePHI whenever appropriate.
      implementation_groups:
      - A
    - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:164.314
      assessable: false
      depth: 1
      ref_id: '164.314'
      description: 'Organizational Requirements:

        Includes standards for business associate contracts and other arrangements
        between a covered entity and a business associate and between a business associate
        and a subcontractor, as well as requirements for group health plans.'
    - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:164.314(a)
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:164.314
      ref_id: 164.314(a)
      description: "Business Associate Contracts or Other Arrangements:\nHIPAA Standard:\
        \ (i) The contract or other arrangement between the covered entity and its\
        \ business associate required by \xA7 164.308(b)(3) must meet the requirements\
        \ of paragraph (a)(2)(i), (a)(2)(ii), or (a)(2)(iii) of this section, as applicable.\
        \ (ii) A covered entity is in compliance with paragraph (a)(1) of this section\
        \ if it has another arrangement in place that meets the requirements of \xA7\
        \ 164.504(e)(3). (iii) The requirements of paragraphs (a)(2)(i) and (a)(2)(ii)\
        \ of this section apply to the contract or other arrangement between a business\
        \ associate and a subcontractor required by \xA7 164.308(b)(4) in the same\
        \ manner as such requirements apply to contracts or other arrangements between\
        \ a covered entity and business associate."
    - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node275
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:164.314(a)
      name: 1. Contract Must Provide that Business Associates Will Comply with the
        Applicable Requirements of the Security Rule
      description: 'Contracts between covered entities and business associates must
        provide that business associates will implement administrative, physical,
        and technical safeguards that reasonably and appropriately protect the confidentiality,
        integrity, and availability of the ePHI that the business associate creates,
        receives, maintains, or transmits on behalf of the covered entity.


        Readers may find useful resources in Appendix F, including OCR BAA guidance
        and templates that include applicable language.'
      implementation_groups:
      - N
      questions:
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node275:question:1:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node275:question:1:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node275:question:1:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node275:question:1:choice:3
            value: N/A
          text: Does the written agreement between the covered entity and the business
            associate address the applicable functions related to creating, receiving,
            maintaining, and transmitting ePHI that the business associate is to perform
            on behalf of the covered entity?
    - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node277
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:164.314(a)
      name: Implementation Specification (Required)
      description: Contracts between covered entities and business associates must
        provide that business associates will implement administrative, physical,
        and technical safeguards that reasonably and appropriately protect the confidentiality,
        integrity, and availability of the ePHI that the business associate creates,
        receives, maintains, or transmits on behalf of the covered entity.
      implementation_groups:
      - R
    - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node279
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:164.314(a)
      name: 2. Contract Must Provide that the Business Associates Enter into Contracts
        with Subcontractors to Ensure the Protection of ePHI
      description: "In accordance with \xA7 164.308(b)(2), ensure that any subcontractors\
        \ that create, receive, maintain, or transmit ePHI on behalf of the business\
        \ associate agree to comply with the applicable requirements of this subpart\
        \ by entering into a contract or other arrangement that complies with this\
        \ section."
      implementation_groups:
      - N
      questions:
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node279:question:1:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node279:question:1:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node279:question:1:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node279:question:1:choice:3
            value: N/A
          text: Has the business associate identified all of its subcontractors that
            will create, receive, maintain, or transmit ePHI?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node279:question:2:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node279:question:2:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node279:question:2:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node279:question:2:choice:3
            value: N/A
          text: "Has the business associate ensured that contracts in accordance with\
            \ \xA7 164.314 are in place with its subcontractors identified in the\
            \ previous question?"
    - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node281
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:164.314(a)
      name: Implementation Specification (Required)
      description: "In accordance with \xA7 164.308(b)(2), ensure that any subcontractors\
        \ that create, receive, maintain, or transmit ePHI on behalf of the business\
        \ associate agree to comply with the applicable requirements of this subpart\
        \ by entering into a contract or other arrangement that complies with this\
        \ section."
      implementation_groups:
      - R
    - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node283
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:164.314(a)
      name: 3. Contract Must Provide that Business Associates will Report Security
        Incidents
      description: "Report to the covered entity any security incident of which it\
        \ becomes aware, including breaches of unsecured PHI as required by \xA7 164.410.\n\
        \nMaintain clear lines of communication between covered entities and business\
        \ associates regarding the protection of ePHI as per the BAA or contract.\n\
        \nEstablish a reporting mechanism and a process for the business associate\
        \ to use in the event of a security incident or breach."
      implementation_groups:
      - N
      questions:
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node283:question:1:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node283:question:1:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node283:question:1:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node283:question:1:choice:3
            value: N/A
          text: Is there a procedure in place for reporting security incidents, including
            breaches of unsecured PHI by business associates?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node283:question:2:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node283:question:2:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node283:question:2:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node283:question:2:choice:3
            value: N/A
          text: Have key business associate staff been identified as points of contact
            in the event of a security incident or breach?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node283:question:3:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node283:question:3:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node283:question:3:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node283:question:3:choice:3
            value: N/A
          text: Does the contract include clear time frames and responsibilities regarding
            the investigation and reporting of security incidents and breaches?
    - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node285
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:164.314(a)
      name: Implementation Specification (Required)
      description: "Report to the covered entity any security incident of which it\
        \ becomes aware, including breaches of unsecured PHI as required by \xA7 164.410."
      implementation_groups:
      - R
    - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node287
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:164.314(a)
      name: 4. Other Arrangements
      description: "The covered entity complies with paragraph (a)(1) of this section\
        \ if it has another arrangement in place that meets the requirements of \xA7\
        \ 164.504(e)(3)."
      implementation_groups:
      - N
      questions:
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node287:question:1:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node287:question:1:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node287:question:1:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node287:question:1:choice:3
            value: N/A
          text: Has the covered entity made a good faith attempt to obtain satisfactory
            assurances that the security standards required by this section are met?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node287:question:2:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node287:question:2:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node287:question:2:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node287:question:2:choice:3
            value: N/A
          text: Are attempts to obtain satisfactory assurances and the reasons that
            assurances cannot be obtained documented?
    - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node289
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:164.314(a)
      name: Implementation Specification (Required)
      description: "The covered entity complies with paragraph (a)(1) of this section\
        \ if it has another arrangement in place that meets the requirements of \xA7\
        \ 164.504(e)(3)."
      implementation_groups:
      - R
    - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node291
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:164.314(a)
      name: 5. Business Associate Contracts with Subcontractors
      description: The requirements of paragraphs (a)(2)(i) and (a)(2)(ii) of this
        section apply to the contract or other arrangement between a business associate
        and a subcontractor in the same manner as such requirements apply to contracts
        or other arrangements between a covered entity and business associate.
      implementation_groups:
      - N
      questions:
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node291:question:1:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node291:question:1:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node291:question:1:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node291:question:1:choice:3
            value: N/A
          text: Do business associate contracts or other arrangements between the
            business associate and its subcontractors include appropriate language
            to comply with paragraphs (a)(2)(i) and (a)(2)(ii) of this section?
    - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node293
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:164.314(a)
      name: Implementation Specification (Required)
      description: The requirements of paragraphs (a)(2)(i) and (a)(2)(ii) of this
        section apply to the contract or other arrangement between a business associate
        and a subcontractor in the same manner as such requirements apply to contracts
        or other arrangements between a covered entity and business associate.
      implementation_groups:
      - R
    - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:164.314(b)
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:164.314
      ref_id: 164.314(b)
      description: "Requirements for Group Health Plans:\nHIPAA Standard: Except when\
        \ the only electronic protected health information disclosed to a plan sponsor\
        \ is disclosed pursuant to \xA7 164.504(f)(1)(ii) or (iii), or as authorized\
        \ under \xA7 164.508, a group health plan must ensure that its plan documents\
        \ provide that the plan sponsor will reasonably and appropriately safeguard\
        \ electronic protected health information created, received, maintained, or\
        \ transmitted to or by the plan sponsor on behalf of the group health plan."
    - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node296
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:164.314(b)
      name: "1. Amend Plan Documents of the Group Health Plan to Address the Plan\
        \ Sponsor\u2019s Security of ePHI"
      description: Amend the plan documents to incorporate provisions to require the
        plan sponsor to implement administrative, technical, and physical safeguards
        that will reasonably and appropriately protect the confidentiality, integrity,
        and availability of ePHI that it creates, receives, maintains, or transmits
        on behalf of the group health plan.
      implementation_groups:
      - N
      questions:
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node296:question:1:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node296:question:1:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node296:question:1:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node296:question:1:choice:3
            value: N/A
          text: Does the plan sponsor fall under the exception described in the standard?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node296:question:2:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node296:question:2:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node296:question:2:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node296:question:2:choice:3
            value: N/A
          text: Do the plan documents require the plan sponsor to reasonably and appropriately
            safeguard ePHI?
    - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node298
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:164.314(b)
      name: Implementation Specification (Required)
      description: Amend the plan documents to incorporate provisions to require the
        plan sponsor to implement administrative, technical, and physical safeguards
        that will reasonably and appropriately protect the confidentiality, integrity,
        and availability of ePHI that it creates, receives, maintains, or transmits
        on behalf of the group health plan.
      implementation_groups:
      - R
    - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node300
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:164.314(b)
      name: 2. Amend Plan Documents of the Group Health Plan to Address Adequate Separation
      description: "Amend the plan documents to incorporate provisions to require\
        \ the plan sponsor to ensure that the adequate separation between the group\
        \ health plan and plan sponsor required by \xA7164.504(f)(2)(iii) is supported\
        \ by reasonable and appropriate security measures."
      implementation_groups:
      - N
      questions:
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node300:question:1:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node300:question:1:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node300:question:1:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node300:question:1:choice:3
            value: N/A
          text: "Do plan documents address the obligation to keep ePHI secure with\
            \ respect to the plan sponsor\u2019s workforce members, classes of workforce\
            \ members, or other persons who will be given access to ePHI?"
    - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node302
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:164.314(b)
      name: Implementation Specification (Required)
      description: "Amend the plan documents to incorporate provisions to require\
        \ the plan sponsor to ensure that the adequate separation between the group\
        \ health plan and plan sponsor required by \xA7164.504(f)(2)(iii) is supported\
        \ by reasonable and appropriate security measures."
      implementation_groups:
      - R
    - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node304
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:164.314(b)
      name: "3. Amend Plan Documents of the Group Health Plan to Address the Security\
        \ of ePHI Supplied to the Plan Sponsors\u2019 Agents and Subcontractors"
      description: Amend plan documents to incorporate provisions to require the plan
        sponsor to report any security incident of which it becomes aware to the group
        health plan.
      implementation_groups:
      - N
      questions:
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node304:question:1:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node304:question:1:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node304:question:1:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node304:question:1:choice:3
            value: N/A
          text: Do the plan documents of the group health plan address the issue of
            subcontractors and other agents of the plan sponsor implementing reasonable
            and appropriate security measures?
    - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node306
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:164.314(b)
      name: Implementation Specification (Required)
      description: Amend plan documents to incorporate provisions to require the plan
        sponsor to ensure that any agent to whom it provides ePHI agrees to implement
        reasonable and appropriate security measures to protect the ePHI.
      implementation_groups:
      - R
    - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node308
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:164.314(b)
      name: 4. Amend Plan Documents of Group Health Plans to Address the Reporting
        of Security Incidents
      description: 'Amend plan documents to incorporate provisions to require the
        plan sponsor to report any security incident of which it becomes aware to
        the group health plan.


        Establish a specific policy for security incident reporting.


        Establish a reporting mechanism and a process for the plan sponsor to use
        in the event of a security incident.'
      implementation_groups:
      - N
      questions:
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node308:question:1:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node308:question:1:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node308:question:1:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node308:question:1:choice:3
            value: N/A
          text: Is there a procedure in place for security incident reporting?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node308:question:2:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node308:question:2:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node308:question:2:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node308:question:2:choice:3
            value: N/A
          text: Are procedures in place for responding to security incidents?
    - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node310
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:164.314(b)
      name: Implementation Specification (Required)
      description: Amend plan documents to incorporate provisions to require the plan
        sponsor to report any security incident of which it becomes aware to the group
        health plan.
      implementation_groups:
      - R
    - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:164.316
      assessable: false
      depth: 1
      ref_id: '164.316'
      description: 'Policies and Procedures and Documentation Requirements:

        Requires the implementation of reasonable and appropriate policies and procedures
        to comply with the standards, implementation specifications, and other requirements
        of the Security Rule; the maintenance of written (may be electronic) documentation
        and/or records that include the policies, procedures, actions, activities,
        or assessments required by the Security Rule; and retention, availability,
        and update requirements related to the documentation.'
    - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:164.316(a)
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:164.316
      ref_id: 164.316(a)
      description: "Policies and Procedures:\nHIPAA Standard: Implement reasonable\
        \ and appropriate policies and procedures to comply with the standards, implementation\
        \ specifications, or other requirements of this subpart, taking into account\
        \ those factors specified in \xA7 164.306(b)(2)(i), (ii), (iii), and (iv).\
        \ This standard is not to be construed to permit or excuse an action that\
        \ violates any other standard, implementation specification, or other requirements\
        \ of this subpart. A covered entity or business associate may change its policies\
        \ and procedures at any time, provided that the changes are documented and\
        \ are implemented in accordance with this subpart."
    - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node314
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:164.316(a)
      name: 1. Create and Deploy Policies and Procedures
      description: 'Implement reasonable and appropriate policies and procedures to
        comply with the standards, implementation specifications, and other requirements
        of the HIPAA Security Rule.


        Consider the importance of documenting processes and procedures for demonstrating
        the adequate implementation of recognized security practices.


        Periodically evaluate written policies and procedures to verify that:'
      implementation_groups:
      - N
      questions:
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node314:question:1:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node314:question:1:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node314:question:1:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node314:question:1:choice:3
            value: N/A
          text: Are reasonable and appropriate policies and procedures to comply with
            each of the standards, applicable implementation specifications, and other
            requirements of the HIPAA Security Rule in place?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node314:question:2:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node314:question:2:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node314:question:2:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node314:question:2:choice:3
            value: N/A
          text: 'Are policies and procedures reasonable and appropriate given:'
    - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node316
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:164.316(a)
      name: 2. Update the Documentation of the Policy and Procedures
      description: Change policies and procedures as is reasonable and appropriate
        at any time, provided that the changes are documented and implemented in accordance
        with the requirements of the HIPAA Security Rule.
      implementation_groups:
      - N
      questions:
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node316:question:1:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node316:question:1:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node316:question:1:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node316:question:1:choice:3
            value: N/A
          text: Is a process in place for periodically reevaluating the policies and
            procedures and updating them as necessary?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node316:question:2:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node316:question:2:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node316:question:2:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node316:question:2:choice:3
            value: N/A
          text: Should HIPAA documentation be updated in response to periodic evaluations,
            following security incidents, and/or after acquisitions of new technology
            or new procedures?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node316:question:3:
          type: text
          text: As policies and procedures are changed, are new versions made available
            and are workforce members appropriately trained?
    - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:164.316(b)
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:164.316
      ref_id: 164.316(b)
      description: 'Documentation:

        HIPAA Standard: (i) Maintain the policies and procedures implemented to comply
        with this subpart in written (which may be electronic) form; and (ii) if an
        action, activity or assessment is required by this subpart to be documented,
        maintain a written (which may be electronic) record of the action, activity,
        or assessment.'
    - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node319
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:164.316(b)
      name: 1. Draft, Maintain, and Update Required Documentation
      description: 'Document decisions concerning the management, operational, and
        technical controls selected to mitigate identified risks.


        Written documentation may be incorporated into existing manuals, policies,
        and other documents or be created specifically for the purpose of demonstrating
        compliance with the HIPAA Security Rule.


        Consider the importance of documenting the processes and procedures for demonstrating
        the adequate implementation of recognized security practices.


        Use feedback from risk assessments and contingency plan tests to help determine
        when to update documentation.'
      implementation_groups:
      - N
      questions:
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node319:question:1:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node319:question:1:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node319:question:1:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node319:question:1:choice:3
            value: N/A
          text: Are all required policies and procedures documented?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node319:question:2:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node319:question:2:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node319:question:2:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node319:question:2:choice:3
            value: N/A
          text: Should HIPAA Security Rule documentation be maintained by the individual
            responsible for HIPAA Security Rule implementation?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node319:question:3:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node319:question:3:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node319:question:3:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node319:question:3:choice:3
            value: N/A
          text: Should HIPAA Security Rule documentation be updated in response to
            periodic evaluations, following security incidents, and/or after acquisitions
            of new technology or new procedures?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node319:question:4:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node319:question:4:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node319:question:4:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node319:question:4:choice:3
            value: N/A
          text: Have dates of creation and validity periods been included in all documentation?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node319:question:5:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node319:question:5:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node319:question:5:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node319:question:5:choice:3
            value: N/A
          text: Has appropriate management reviewed and approved all documentation?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node319:question:6:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node319:question:6:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node319:question:6:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node319:question:6:choice:3
            value: N/A
          text: Are actions, activities, and assessments required by the Security
            Rule documented as appropriate?
    - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node321
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:164.316(b)
      name: 2. Retain Documentation for at Least Six Years
      description: Retain documentation required by paragraph (b)(1) of this section
        for six years from the date of its creation or the date when it last was in
        effect, whichever is later.
      implementation_groups:
      - N
      questions:
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node321:question:1:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node321:question:1:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node321:question:1:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node321:question:1:choice:3
            value: N/A
          text: "Have documentation retention requirements under HIPAA been aligned\
            \ with the organization\u2019s other data retention policies?"
    - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node323
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:164.316(b)
      name: Implementation Specification (Required)
      description: Retain documentation required by paragraph (b)(1) of this section
        for six years from the date of its creation or the date when it last was in
        effect, whichever is later.
      implementation_groups:
      - R
    - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node325
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:164.316(b)
      name: 3. Ensure that Documentation is Available to Those Responsible for Implementation
      description: Make documentation available to those persons responsible for implementing
        the procedures to which the documentation pertains.
      implementation_groups:
      - N
      questions:
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node325:question:1:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node325:question:1:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node325:question:1:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node325:question:1:choice:3
            value: N/A
          text: Is the location of the documentation known to all staff who need to
            access it?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node325:question:2:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node325:question:2:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node325:question:2:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node325:question:2:choice:3
            value: N/A
          text: Is availability of the documentation made known as part of education,
            training, and awareness activities?
    - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node327
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:164.316(b)
      name: Implementation Specification (Required)
      description: Make documentation available to those persons responsible for implementing
        the procedures to which the documentation pertains.
      implementation_groups:
      - R
    - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node329
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:164.316(b)
      name: 4. Update Documentation as Required
      description: Review documentation periodically and update as needed in response
        to environmental or operational changes that affect the security of the ePHI.
      implementation_groups:
      - N
      questions:
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node329:question:1:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node329:question:1:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node329:question:1:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node329:question:1:choice:3
            value: N/A
          text: Is there a version control procedure that allows for the verification
            of the timeliness of policies and procedures, if reasonable and appropriate?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node329:question:2:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node329:question:2:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node329:question:2:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node329:question:2:choice:3
            value: N/A
          text: Is there a process for soliciting input on updates of policies and
            procedures from staff, if reasonable and appropriate?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node329:question:3:
          type: unique_choice
          choices:
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node329:question:3:choice:1
            value: 'Yes'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node329:question:3:choice:2
            value: 'No'
          - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node329:question:3:choice:3
            value: N/A
          text: Are policies and procedures updated in response to environmental or
            operational changes that affect the security of ePHI?
        urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node329:question:4:
          type: date
          text: When were the policies and procedures last updated or reviewed?
    - urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:node331
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:nist-sp-800-66-rev2:164.316(b)
      name: Implementation Specification (Required)
      description: Review documentation periodically and update as needed in response
        to environmental or operational changes that affect the security of the ePHI.
      implementation_groups:
      - R
