Requirement
164.308(a)(5) - Implement a security awareness and training program for all members of its workforce (including management).
Implementation Specifications
Security Reminders (Addressable) - 164.308(a)(5)(ii)(A)
Requirement: Periodic security updates
Protection from Malicious Software (Addressable) - 164.308(a)(5)(ii)(B)
Requirement: Procedures for guarding against, detecting, and reporting malicious software.
Log-in Monitoring (Addressable) - 164.308(a)(5)(ii)(C)
Requirement: Procedures for monitoring log-in attempts and reporting discrepancies.
Password Management (Addressable) - 164.308(a)(5)(ii)(D)
Requirement: Procedures for creating, changing, and safeguarding passwords.
Explanation
Regardless of the Administrative Safeguards a covered entity implements, those safeguards will not protect the EPHI if the workforce is unaware of its role in adhering to and enforcing them. Many security risks and vulnerabilities within covered entities are internal. Security training for all new and existing members of the covered entity’s workforce is required. In addition, periodic retraining should be given whenever environmental or operational changes affect the security of EPHI. Changes may include: new or updated policies and procedures; new or upgraded software or hardware; and new security technology
