Hello again and welcome to the H C I s P p certification course with Sai Buri
awareness of her party requirements.
My name is Shalane Hutchins in on your instructor.
In this video, we're gonna cover information flow mapping and scope,
privacy and security requirements
and risks associated with third parties.
The world in which health care entities operate today
requires information sherry to coordinate care and provide enhanced offerings to individuals.
Security professionals are paramount to helping toe identify risks in the full of information
where it starts, where it travels, where it is stored and how it's used.
Information. Security professionals can identify risks associated with various technologies and make recommendations on minimizing the risk to the data.
To be able to correctly assess risks surrounding the data, it is important that the primary entity understands the value of its data.
It would seem easy to declare that all information is sensitive,
but a solid data classification system can help to make decisions that can influence decisions about how to protect the processing, transmission and storage of the data.
As an example, simple names and addresses of patients may be protected at a different level, than a database of patients with identified mental illnesses.
Privacy is really the what in this question, it dictates what needs to be protected.
Sensitivity in value of the data play an important role,
as discussed earlier. Matt all data is created equal.
Some elements are more valuable than others, while others offer value. When combined with additional data elements,
it is important to consider the rights of the data owner when a primary entity interest into a relationship with a third party.
For example, if the data belongs to patients, what risks are introduced to the data by entrusting it to a third party?
it goes hand in hand with the privacy because it determines what protections need to be in place to guard data based on its sensitivity and value as well as the risk of exposure.
It is the primary entities responsibility to perform due diligence to determine the level of risk
introduced by a fender.
This activity should occur not only prior to engaging in a relationship with the vendor,
but also throughout the duration of the contract, especially because technology, business processes and regulations continue to evolve over time.
The risk assessment should take into account
the nature of the work performed by the vendor,
the amount of sensitive data that will be handled,
the frequency of the contact with the data
and the criticality of the vendor to the primary entities business operations.
During the course of the vendor relationship,
it is important for the primary entity to oversee and assess the controls that the vendor has implemented.
A primary entity has to determine how much oversight is Thea appropriate amount.
if the vendor invests in audits like a stock to Type two and certifications like ice, so that appeared to provide a high level of confidence in its control environment, the primary entity may be able to place more reliance on assessments performed by external entities. Yet
it's always a good practice toe. Ask questions specific to the business relationship and to inspect facilities where work is being performed. For example, when I was in Victor Risk management role, I had the experience of performing on site assessment of a vendor
who didn't really have a physical location.
We ended up conducting the assessment in a hotel conference room,
so, needless to say,
that relationship ended up changing.
It's time for another Malik check.
Information flow mapping includes all except
what elements are included in the data
B where the data is stored.
See how the data is used
or d where the data starts.
The answer is a what elements are included.
True or false, privacy is how data needs to be protected,
and security is what data needs to be protected.
That answer is false. Privacy is what data needs to be protected, and security is the how the data needs to be protected.
In summary, we've covered information flow, mapping and scope,
privacy and security requirements and risks associated with third parties.
Thank you for taking this journey with me.
Please continue to leverage the supplemental materials as you prepare for your exam.
I wish you much success in achieving your certification.