{"text_format":"1","workbook":"xlsx","n_sheets":9,"sheets":["Introduction","How to Complete the Forms","800-66 Risk Guidance","Practice Summary","Inventory (Preparation)","Screening Questions (Step 1)","People and Processes  (Step 2a)","Technology (Step 2b)","Findings-Remediation (Step 3)"],"not_rendered":{"charts":0,"images":2,"macros":1,"external_links":0,"defined_names":24,"comments":1,"pivot_tables":0},"unopened":[],"bounds":{"document_bytes":16777216,"sheet_cells":100000,"rows_first":2000,"rows_last":500,"rows_between":2000,"halvings":0,"cell_chars":16384,"cell_head_chars":4096},"cells_cut":0,"cells_raw":0,"read":"whole","date_system":"1900"}

{"sheet":"Introduction","index":0,"n_rows":22,"n_cols":2,"rows_kept":22,"cut":false,"hidden":false,"merged":[]}
[]
[]
["HIT Security Risk Assessment Tool"]
["Presented By:","The National Learning Consortium (NLC)"]
["Developed By:","Health Information Technology Research Center (HITRC)                                                                                  "]
[null,"Privacy and Security Community of Practice (Toolkit Workgroup)"]
["Version:",1]
["Date:","2011-10-21"]
[" Description: ","The purpose of a risk assessment is to identify conditions where Electronic Protected Health Information (EPHI) could be disclosed without proper authorization, improperly modified, or made unavailable when needed. This information is then used to make risk management decisions on what reasonable and appropriate safeguards are needed to reduce risk to an acceptable level. This Risk Assessment Tool is intended to be a starting point for identifying cybersecurity risks to your organization. Please note that this tool is best printed using landscape orientation and on legal sized paper. \n"]
["Table of Contents:","How to Complete the Forms"]
[null,"800-66 Risk Guidance"]
[null,"Practice Summary"]
[null,"Inventory (Preparation)"]
[null,"Screening Questions (Step 1)"]
[null,"People and Processes  (Step 2a)"]
[null,"Technology (Step 2b)"]
[null,"Findings-Remediation (Step 3)"]
[]
[null,"The National Learning Consortium (NLC) is a virtual and evolving body of knowledge and tools designed to support healthcare providers and health IT professionals working towards the implementation, adoption and meaningful use of certified EHR systems.  \n\nThe NLC represents the collective EHR implementation experiences and knowledge gained directly from the field of ONC’s outreach programs (REC, Beacon, State HIE) and through the Health Information Technology Research Center (HITRC) Communities of Practice (CoPs).\n\nThe following resource is a tool used in the field today and recommended by “boots-on-the-ground” professionals for use by others who have made the commitment to implement or upgrade to certified EHR systems. \n"]
[]
["Table of Contents"]
["Vendor Eval Matrix Ratings"]

{"sheet":"How to Complete the Forms","index":1,"n_rows":0,"n_cols":0,"rows_kept":0,"cut":false,"hidden":false,"merged":[]}

{"sheet":"800-66 Risk Guidance","index":2,"n_rows":0,"n_cols":0,"rows_kept":0,"cut":false,"hidden":false,"merged":[]}

{"sheet":"Practice Summary","index":3,"n_rows":46,"n_cols":2,"rows_kept":46,"cut":false,"hidden":false,"merged":[[45,1,1048575,1]]}
[]
[null,"Practice Summary"]
["Last Revision Date"]
["Contributors\n(persons involved with the assessment)"]
[]
["Practice Information"]
["Practice Name"]
["Contact Information\n(Practice Point of Contact)","Name:\nEmail:\nPhone:"]
["Office Locations"]
[]
["EHR Information"]
["EHR Model\n(Hosted or Client/Server)"]
["EHR System"]
["Certified Version?"]
[]
["Vendors/Third Parties"]
["IT Vendor"]
["EHR Vendor Company"]
["REC"]
["Other"]
[]
["Infrastructure"]
["EHR Server Information"]
["Fax Server Information"]
["Network Firewall"]
["Wireless Devices"]
["Workstations"]
["Laptops"]
["Scanners"]
["Fax Machines"]
["Copiers"]
["Tablets"]
["iPad's"]
["Medical Devices\n(Devices that may contain and/or transmit data)"]
["Other"]
[]
["Media Used"]
["Smartphones"]
["USB Thumb Drives"]
["USB Hard Drives"]
["CD's"]
["Backup Tapes"]
["Other"]
[]
["PHI Location"]
["Where is PHI Stored?"]

{"sheet":"Inventory (Preparation)","index":4,"n_rows":21,"n_cols":3,"rows_kept":21,"cut":false,"hidden":false,"merged":[]}
[]
[null,"Inventory Assets (Preparation)"]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
["Asset Type","Does this asset process, store or transmit EPHI?","People/Process or Technology Asset?"]

{"sheet":"Screening Questions (Step 1)","index":5,"n_rows":50,"n_cols":7,"rows_kept":50,"cut":false,"hidden":false,"merged":[[21,0,21,6],[1,0,1,6],[12,0,12,1],[13,0,13,6],[16,0,16,6],[18,0,18,6],[48,0,48,6],[23,0,23,6],[27,0,27,6],[29,0,29,6],[34,0,34,6],[38,0,38,6],[46,0,46,6]]}
["National Learning Consortium logo - Advancing America's Health Care","Select text object to read instructions then proceed to A14 to view and complete form"]
["Screening Questions (Step 1)"]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
["Topic",null,"Question","Response","Threat Vulnerability Statement","People/ Processes","Technology"]
["1.  Security Program"]
[1.1000000000000001,"Roles & Responsibilities","[1.1] Has your organization formally appointed a central point of contact for security coordination?\na)    If so, whom, and what is their position within the organization?\nb) Responsibilities clearly documented? i.e. job descriptions, information security policy",null,"Management has not defined responsibilities for the information security program. [TVS001]",null,"N/A"]
[1.2,"External Parties","[1.2] Do you work with third parties, such as IT service providers, that have access to your patient's information? \na)    Does your organization have Business Associate agreements in place with these third parties? i.e. REC, IT Vendor, EHR Vendor, etc.\nb)    If not, what controls does your organization have in place to monitor and assess third parties? i.e. Logging of VPN connections, EHR logs, etc.",null,"Security breaches occur when dealing with third parties due to a lack of security considerations in the related third party agreement. [TVS002]"]
["2.  Security Policy"]
[2.1,"Information Security Policy & Procedures","[2.1] Do you have documented information security policies and procedures?\na)     Do you have a formal information classification procedure? Please describe it.  In particular, how would patient data be categorized?  For example, critical, essential, and normal.\nb)    Have formal acceptable use rules been established for assets? Example assets include data assets, computer equipment, communications equipment, etc.\nDo you have formal processes in place for security policy maintenance and deviation? ",null,"Management does not set a clear policy direction in line with business objectives and demonstrate support for, and commitment to, information security. [TVS003]",null,"N/A"]
["3.  Risk Management & Compliance"]
[3.1,"Risk Assessment","[3.1] Do you have a process that addresses: the identification and measurement of potential risks, mitigating controls (measures taken to reduce risk), and the acceptance or transfer (Insurance policies, warranties for example) of the remaining (residual) risk after mitigation steps have been applied? ",null,"Information around risks and related control options are not presented to management before management decisions are made. [TVS004]"," - REC helping to start the risk assessment process by using this spreadsheet as a foundation for the risk assessment as well as risk management plan.\n - No prior risk assessments conducted"," - No regular assessments of technology is performed; including vulnerability testing, patch management, or other review of systems to help determine risks associated with them so appropriate action(s) can be taken."]
[3.2,"Compliance with Legal Requirements - Identification of applicable legislation","[3.2] Does a process exist to identify new laws and regulations with IT security implications? (e.g., new state breach notification requirements)?\n i.e. Newsletters, Webinars, etc. ",null,"Legislative, statutory, regulatory or contractual obligations related to security are violated due to lack of controls. [TVS005]"," - Working with the REC helps to identify new laws and regulations due to the training and guidance with the REC team\n - State breach guidance also available through the REC within the privacy and security toolkit","N/A"]
["4.  Training & Awareness"]
[4.0999999999999996,"During Employment – Training, Education & Awareness","[4.1] Have your employees been provided formal information security training? Have policies been communicated to your employees?   Are periodic security reminders provided?\n i.e. New employee orientation, yearly training, posters in public areas, email reminders, etc.",null,"Applications and technology solutions are not correctly and securely used since a training curriculum for employees has not been established or regularly updated. [TVS006]"," - No formal information security training but periodic HIPAA training (random). \n - No one dedicated to the role of training. \n - No IT orientation"," - The use of technology regarding a training curriculum is not currently being utilized."]
["5.  Personnel Security"]
[5.0999999999999996,"Background Checks","[5.1] Does your organization perform background checks to examine and assess an employee’s or contractor’s work and criminal history? \n i.e. Credential verification, criminal history, references",null,"Background verification checks are not carried out and management is not aware of academic, professional, credit or criminal backgrounds of employees. [TVS007]"," - References are verified\n - Credential verification is also performed\n - No criminal background checks are performed at this time","N/A"]
[5.2,"Prior to Employment - Terms and Conditions of Employment","[5.2] Are your employees required to sign a non-disclosure agreement? If so, are employees required to sign the non-disclosure agreement annually? Non-disclosure and/or confidentiality form at initial employment",null,"Employees or contractors do not agree or sign terms or conditions of employment. [TVS008]"," - Non disclosure Agreements required prior to employment"," - Accounts are not created within the EHR until appropriate Agreements are signed"]
[5.3,"Termination or Change in Employment","[5.3] Do you have a formal process to manage the termination and or transfer of employees? \n i.e. All equipment is returned, user ID's disabled in EHR and Windows, badges and/or keys returned.",null,"Employee, contractor or third party user terminations or change of responsibilities could result in a security breach due to lack of a defined management process for terminations or changes in responsibilities. [TVS009]"," - No known procedures in place for terminations or changes of responsibilities.\n - Disabling of access within the EHR as well as retrieval of keys and equipment is performed."," - User accounts are disabled within the EHR"]
["6.  Physical Security"]
[6.1,"Secure Areas","[6.1] Do you have effective physical access controls (e.g., door locks) in place that prevent unauthorized access to facilities and a facility security plan? \na)     Are there plans in place to handle/manage contingent events or circumstances (e.g. what if the person with the key to the server room is sick)?  \nb)     Is there a facility security plan?  \nc)     How are physical access controls authorized (who is responsible for ensuring that only appropriate persons have keys or codes to the facility and to locations within the facility with ePHI)? \nd)    Are there policies and procedures to document repairs and modifications to physical components of the facility that are related to security?\n - [See Facility Walkthrough Checklist for additional information]\n",null,"Unauthorized parties gain physical access to facilities due to insufficient physical entry/exit controls. [TVS010]"," - No facility security plan is currently in place at the practice\n - Fire escape plans are posted throughout the building\n - Alarm system is currently in place and monitored 24/7\n\n - Front Desk\nWaiting room securely separated?\nAll patients must sign in?\nAll visitors must sign in?\nAll visitors & patients escorted?\nSign-in sheet secured and maintained?"," - Workstations/Laptops/Tablets\nPositioning?\nPrivacy screens used?\nCable locks used?\n\n - Server Room\nServer room location?\nLocked at all times?\nProper cooling?\nBattery backup?\nFire suppression?\n\n - Network Closet\nLocked at all times?\nProper cooling?\nBattery backup?\n\n - Building\nEmergency lighting?\nFire detection?\nFire suppression?\nBack door remains locked?\nOther doors remain locked? \nWater shut-off valves?\nEmergency power shut-off?\nBuilding alarm system?"]
["7.  Network Security"]
[7.1,"Application and Information Access Control - Sensitive System Isolation","[7.1] Describe your network configuration.   Has your IT vendor provided information regarding how your Electronic Health Record (EHR) system is protected?\na)     Are systems and networks that host, process and or transfer sensitive information ‘protected’ (isolated or separated) from other systems and or networks?  \nb)    Are internal and external networks separated by firewalls with access policies and rules?\nc)     Is there a standard approach for protecting network devices to prevent unauthorized access/ network related attacks and data-theft? \n i.e. Firewall between public and private networks, internal VLAN, firewall separation, separate WLAN network, and/or secure patient portal.",null,"Sensitive systems co-located with less sensitive systems are accessed by unauthorized parties. [TVS011]"," - No network diagram or details regarding the configurations being used are currently available."," - Network Configuration\nFirewall in place?\nWireless encryption?\nRemote access type?\nRemote access encryption?"]
[7.2,"Encryption","[7.2] Is sensitive information transferred to external recipients?  If so, are controls in place to protect sensitive information when transferred (e.g. with encryption)? i.e. Secure VPN connection with EHR and/or IT vendors or email encryption (certificate server, ZixMail).\na) Is sensitive information being sent via text, either by email (i.e. phonenumber@messaging.att.com) or by texting on the phones themselves?",null,"Information involved in electronic messaging is compromised. [TVS012]"," - No policies or procedures around the protection of electronic messaging.\n - No PHI is electronically sent via email or other electronic means except through fax."]
[7.3,"Vulnerability Assessment","[7.3] How often do you perform periodic vulnerability scans on your information technology systems, networks and supporting security systems? i.e. Internal assessments, third party assessments, automated?",null,"Technical vulnerabilities are exploited to gain inappropriate or unauthorized access to information systems due to lack of controls for those vulnerabilities. [TVS013]"," - No vulnerability testing has been completed."," - No vulnerability testing currently being performed internally or from a third party"]
[7.4,"Monitoring","[7.4] Are third party connections to your network monitored and reviewed to confirm  authorized access and appropriate usage? \n i.e. VPN logs, server Event Logs, EHR logging, automated alerts, regular review of logs or reports.",null,"Unauthorized access is given to information over third party connections. [TVS014]"]
["8.  Logical Access"]
[8.1,"Identity & Access Management","[8.1] Do you have a formal access authorization process based on 'least privilege' (employees are granted the least amount of access possible in order to perform their assigned duties) and need to know (access permissions are granted based upon the legitimate business need of the user to access the information) ?\n i.e. Role-based permissions, limited access based on specific responsibilities, network access request form?\na)     How are systems and applications configured to restrict access only to authorized individuals?  \n i.e. Use of unique ID's and passwords.\n        1) Minimum password length? Complexity? History? Lockout? Password change?\nb)    Is there a list maintained of authorized users with access (administrative access) to operating systems? i.e. Active Directory user lists, within EHR application, Excel spreadsheet of users, HR file?\nc)     Does a list of 'accepted mobile devices' (e.g., smart phones, cell phones) exist based on testing?\n Are accepted mobile devices tested prior to production use?\nd)      Is sensitive information (e.g., social security numbers) removed from, or encrypted within,  documents and or websites before it is distributed? i.e. Use of Patient Portal for distribution, de-identifying of sensitive information prior to being distributed.\ne)     Is software installation restricted for desktops, laptops and servers?\ni.e. Restricted User access to workstations, Group Policy enforcement, AD privileges on servers \n        1) automatic logoff of workstations? EHR system?\nf)    Is access to source application code restricted? If so, how? Is a list of authorized users maintained?\n",null,"Unauthorized access is gained to information systems. [TVS015]"," - Access rights to the EHR are allocated based on the employees role within the facility but no procedures are in place."," - EHR Password Security\nPassword Change?\nMinimum Length?\nComplexity?\nPassword History?\nLockout?\n\n - Windows Password Security\nPassword Change?\nMinimum Length?\nComplexity?\nPassword History?\nLockout?\n\n - Auto Logoff\nEHR?\nWindows?\n\n- Servers/Network Devices\nDefault Admin passwords have been changed?"]
[8.1999999999999993,"Identity Management","[8.2] Are user IDs for your system uniquely identifiable? \na) Any shared accounts at all? i.e. hard coded into applications, someone is sick or unavailable, emergency access to sensitive information?",null,"Unauthorized users are able to gain access to operating systems by claiming to be an authorized user. [TVS016]"," - No policy or procedure around the use of unique user ID's"," - Unique user ID's are utilized within the EHR.\n - However, user ID's are NOT unique for workstation access"]
[8.3000000000000007,"Entitlement Reviews","[8.3] Do you have a process to review user accounts and related access? i.e. manual process of reviewing HR records to user accounts in AD and EHR ",null,"Users that no longer have a business need for information systems access still have access to the information. [TVS017]"," - User accounts are not currently reviewed on a regular basis"," - No regular review of accounts currently being performed within the EHR, servers, and other systems."]
["9.  Operations Management"]
[9.1,"Antivirus","[9.1] Has antivirus software been deployed and installed on your computers and supporting systems (e.g., desktops, servers and gateways)?\n         1) Product installed? Centrally managed? Updated daily? ",null,"Systems and data are exposed to malicious software and/or unauthorized use. [TVS018]"," - No current policies and procedures surrounding the use and updating of antivirus software"]
[9.1999999999999993,"Security Monitoring","[9.2] Are systems and networks monitored for security events?  If so, please describe this monitoring. i.e. server and networking equipment logs monitored regularly. Servers, routers, switches, wireless AP's.",null,"Unauthorized information processing activities occur undetected due to lack of consistent logging and monitoring activities. [TVS019]"]
[9.3000000000000007,"Media Handling","[9.3] Do procedures exist to protect documents, computer media (e.g., tapes, disks, CD-ROMs, etc.), from unauthorized disclosure, modification, removal, and destruction? Is sensitive data encrypted when stored on laptop, desktop and server hard drives, flash drives, backup tapes, etc.? \n i.e. Data at Rest - Is data encrypted on the EHR server? Backups? Mobile devices? SD Cards?",null,"Media (e.g., documents, computer media (e.g. tapes, disks), input/output data, system documentation) is compromised by unauthorized parties due to ineffective handling procedures. [TVS020]"," - No procedures in place surrounding the handling of media."," - Backups\nAre backups encrypted?"]
[9.4,"Secure Disposal","[9.4] Are there security procedures for the decommissioning (replacement) of IT equipment and IT storage devices which contain or process sensitive information?  i.e. use of Shred-IT, Retire-IT, wiping, NIST 800-88",null,"Unauthorized parties access data from discarded media. [TVS021]",null,"N/A"]
[9.5,"Segregation of Computing Environment","[9.5] Are development, test and production environments separated from operational IT environments to protect production (actively used) applications from inadvertent changes or disruption? ",null,"The production environment is impacted due to the lack of separation of development and production environments. [TVS022]"," - Testing that relates to the EHR occurs though the EHR vendor and not performed internally."," - No test systems\n - EHR vendor tests their updates and then notifies the Practice for installation into production"]
[9.6,"Segregation of Duties","[9.6] Are duties separated, where appropriate, to reduce the opportunity for unauthorized modification, unintentional modification or misuse of the organization's IT assets? i.e. front desk duties separated from accounting. Nurse duties separated from Doctor's?",null,"The integrity of a business process is compromised due to the lack of segregation of duties (e.g., maker & checker). [TVS023]"," - Job duties are separated within the EHR based on their job roles but not formally outlined within any policy or procedure.","N/A"]
[9.6999999999999993,"Change Management","[9.7] Do formal change management procedures exist for networks, systems, desktops, software releases, deployments, and software vulnerability (e.g., Virus or Spyware) patching activities? i.e. Changes to the EHR? Changes to the workstations and servers? Appropriate testing, notification, and approval?",null,"The change management process in place does not adequately protect the environment from disruptive changes in production. [TVS024]"," - No formal change management procedures currently in place.\n - The existing process for EHR updating involves being contacted by the vendor and then scheduling a time for installation."," - No internal tracking or reporting of changes to the systems\n - EHR vendor does keep records of any changes performed through the use of their ticketing system\n\n - Windows Updates\nWorkstations update automatically?\nServers are updated regularly?"]
["10.  Incident Management"]
[10.1,"Process & Procedures","[10.1] How do you identify, respond to and mitigate suspected or known security incidents?\ni.e. Incident Form filled out as a response to an incident\na)     During the investigation of a security incident, is evidence properly collected and maintained?\ni.e. Chain of custody and other computer forensic methodologies followed by internal and/or external parties?\nb)     Are incidents identified, investigated, and reported according to applicable legal requirements?\nc)     How are incidents escalated and communicated? i.e. documented process for escalation to management and even outside authorities.",null,"Security incidents are not managed with a consistent and effective approach. [TVS025]"," - Incidents are reported but not consistent in the approach and no formalized incident response plan is currently in place.","\n - No incident management tracking / reporting software is being utilized"]
["11.  Business Continuity Management"]
[11.1,"Disaster Recovery Plan & Backups","[11.1] Do you have a mechanism to back up critical IT systems and sensitive data? i.e. nightly, weekly, quarterly backups? Taken offsite?\na)  Have you had to restore files after a systems outage?  \nDoes a Disaster Recovery plan exist for the organization and does it consider interruption to, or failure of, critical IT systems?\na)  Are disaster recovery plans updated at least annually?\nb)  If not, has the backup and restoration process been tested? ",null,"Information systems cannot be recovered due to a lack of written disaster recovery plans. [TVS026]"," - No Disaster Recovery Plan or Emergency Operations Plan currently in place at the facility"," -EHR backup services are utilized for secure offsite backups of the database.\n - Test restore of backups are periodically completed especially as needed but not consistently tested on a regular basis\n - No alternate facility available to recover from a disaster"]

{"sheet":"People and Processes  (Step 2a)","index":6,"n_rows":87,"n_cols":12,"rows_kept":87,"cut":false,"hidden":false,"merged":[[1,0,1,11],[54,1,54,2],[54,3,54,4],[54,6,54,11]]}
[]
["People and Processes (Step 2a)"]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[null,null,null,"Perform Control Analysis",null,"Exposure","Assess Risk"]
["Asset Management Category","Threat-Vulnerability Statement","Recommended Control Measures","Perform Control Analysis\nExisting Control","Perform Control Analysis\nExisting Control Effectiveness","Exposure Potential","Assess Risk\nLikelihood","Hidden Likelihood \nScore","\nImpact","Hidden Impact \nScore","Hidden Risk Rating \nScore","Assess Risk\nRisk Rating"]
["Security Program",{"$f":"'Screening Questions (Step 1)'!E15","v":"Management has not defined responsibilities for the information security program. [TVS001]"},"All information security responsibilities are clearly documented .  This is to ensure timely, safe and effective handling of all situations, administration user accounts- including additions, deletions, and modifications. [RCM001]\n - Ensure responsibilities are formalized within the employee(s) job descriptions as well as within relevant IS policies.\n - The Information Security Policy Template provided by the REC could help formalize this role.",{"$f":"'Screening Questions (Step 1)'!F15","v":0},null,{"$f":"IF('Screening Questions (Step 1)'!D11=\"Addressed\",\"Low\",(IF('Screening Questions (Step 1)'!D11=\"Partially Addressed\",\"Medium\",IF('Screening Questions (Step 1)'!D11=\"Not Addressed\",\"High\",\" \"))))","v":" "},null,{"$f":"IF(G57=\"Not Likely\",\"1\",(IF(G57=\"Likely\",2,IF(G57=\"Very Likely\",3,0))))","v":0},"High",{"$f":"IF(I57=\"Low\",\"1\",(IF(I57=\"Medium\",2,IF(I57=\"High\",3,0))))","v":3},{"$f":"H57*J57","v":0},{"$f":"IF(AND(K57>=4,K57<7),\"Medium\",IF(AND(K57<4,K57>=1),\"Low\",IF(K57>7,\"High\",IF(K57=0,\" \"))))","v":" "}]
["Security Program",{"$f":"'Screening Questions (Step 1)'!E16","v":"Security breaches occur when dealing with third parties due to a lack of security considerations in the related third party agreement. [TVS002]"},"Agreements with third parties, such as IT vendors,  which involve accessing, processing, communicating with or managing the organization's information or information processing facilities, or adding products or services to information processing facilities cover all relevant security requirements.\nContracts between business associates and covered entities address administrative, physical, and technical safeguards that reasonably and appropriately protect the confidentiality, integrity, and availability of information. [RCM002]\n - Verify and ensure Business Associate agreements are in place with all third parties that use or disclose PHI. This includes those that even have access to PHI like IT service providers and EHR vendors.",{"$f":"'Screening Questions (Step 1)'!F16","v":0},null,{"$f":"IF('Screening Questions (Step 1)'!D12=\"Addressed\",\"Low\",(IF('Screening Questions (Step 1)'!D12=\"Partially Addressed\",\"Medium\",IF('Screening Questions (Step 1)'!D12=\"Not Addressed\",\"High\",\" \"))))","v":" "},null,0,"High",{"$f":"IF(I58=\"Low\",\"1\",(IF(I58=\"Medium\",2,IF(I58=\"High\",3,0))))","v":3},{"$f":"H58*J58","v":0},{"$f":"IF(AND(K58>=4,K58<7),\"Medium\",IF(AND(K58<4,K58>=1),\"Low\",IF(K58>7,\"High\",IF(K58=0,\" \"))))","v":" "}]
["Security Policy",{"$f":"'Screening Questions (Step 1)'!E18","v":"Management does not set a clear policy direction in line with business objectives and demonstrate support for, and commitment to, information security. [TVS003]"},"An information security policy is approved by management in accordance with business requirements and all relevant laws and regulations. [RCM003]\n - An Information Security Policy template has been provided by the REC and can be used if desired. If used, it should be reviewed, filled out appropriately, and formally adopted within the facility. Refer to section IS-1.1.",{"$f":"'Screening Questions (Step 1)'!F18","v":0},null,{"$f":"IF('Screening Questions (Step 1)'!D14=\"Addressed\",\"Low\",(IF('Screening Questions (Step 1)'!D14=\"Partially Addressed\",\"Medium\",IF('Screening Questions (Step 1)'!D14=\"Not Addressed\",\"High\",\" \"))))","v":" "},null,0,"High",3,{"$f":"H59*J59","v":0}," "]
["Risk Management & Compliance",{"$f":"'Screening Questions (Step 1)'!E20","v":"Information around risks and related control options are not presented to management before management decisions are made. [TVS004]"},"Risk assessments are conducted to identify, quantify, prioritize and manage risks.  The prioritization is accomplished by creating and using criteria for risk acceptance and objectives which are important to the organization. [RCM004]\n - Ensure this risk assessment is accurate with all information that has been filled out as well as the risk ratings (likelihood and impact) that have also been completed based on the  information provided.\n - After verifying the accuracy of information, the Medium and High risk items from the Findings-Remediation tab should be addressed by making the necessary business decisions on whether to mitigate, transfer, or accept the risks. It is recommended to mitigate risks that are easy to address.\n - It is important to continue the risk assessment process by assessing additional risks to your facility, systems, and all other assets to ensure a thorough and up-to-date risk assessment is conducted.",{"$f":"'Screening Questions (Step 1)'!F20","v":" - REC helping to start the risk assessment process by using this spreadsheet as a foundation for the risk assessment as well as risk management plan.\n - No prior risk assessments conducted"},null,{"$f":"IF('Screening Questions (Step 1)'!D16=\"Addressed\",\"Low\",(IF('Screening Questions (Step 1)'!D16=\"Partially Addressed\",\"Medium\",IF('Screening Questions (Step 1)'!D16=\"Not Addressed\",\"High\",\" \"))))","v":" "},"Likely",2,"High",3,6,"Medium"]
["Risk Management & Compliance ",{"$f":"'Screening Questions (Step 1)'!E21","v":"Legislative, statutory, regulatory or contractual obligations related to security are violated due to lack of controls. [TVS005]"},"Controls, which are applicable to each situation, have been applied to avoid violations of any legal obligations (e.g. statutory, regulatory, or contractual), and of any security requirements.  Access controls could be door locks or computer passwords, while other controls could be firewalls and anti-virus software. [RCM005]\n - It is recommended to continue follow any legal obligations by signing up with regular email newsletters, i.e. Healthcare IT, HIPAA Weekly Advisory, HIMSS, etc.\n - Various Webinars and conferences are also great resources.",{"$f":"'Screening Questions (Step 1)'!F21","v":" - Working with the REC helps to identify new laws and regulations due to the training and guidance with the REC team\n - State breach guidance also available through the REC within the privacy and security toolkit"},null,{"$f":"IF('Screening Questions (Step 1)'!D17=\"Addressed\",\"Low\",(IF('Screening Questions (Step 1)'!D17=\"Partially Addressed\",\"Medium\",IF('Screening Questions (Step 1)'!D17=\"Not Addressed\",\"High\",\" \"))))","v":" "},"Not Likely","1","High",3,3,"Low"]
["Training & Awareness",{"$f":"'Screening Questions (Step 1)'!E23","v":"Applications and technology solutions are not correctly and securely used since a training curriculum for employees has not been established or regularly updated. [TVS006]"},"A training curriculum for employees has been established to educate and train users for correct and secure use of applications and technology solutions. [RCM006]\n - The REC has provided a privacy and security toolkit which includes PowerPoint training that could be utilized for regular training.\n - Training could include new employee orientation for all new personnel and contractors as well as weekly or monthly email security reminders.\n - Security reminders could also be posted in public areas (kitchen, hallways, etc.) to help train employees.",{"$f":"'Screening Questions (Step 1)'!F23","v":" - No formal information security training but periodic HIPAA training (random). \n - No one dedicated to the role of training. \n - No IT orientation"},null,{"$f":"IF('Screening Questions (Step 1)'!D19=\"Addressed\",\"Low\",(IF('Screening Questions (Step 1)'!D19=\"Partially Addressed\",\"Medium\",IF('Screening Questions (Step 1)'!D19=\"Not Addressed\",\"High\",\" \"))))","v":" "},null,0,"High",3,0," "]
["Personnel Security",{"$f":"'Screening Questions (Step 1)'!E25","v":"Background verification checks are not carried out and management is not aware of academic, professional, credit or criminal backgrounds of employees. [TVS007]"},"Background verification checks on all candidates for employment, contractors and third party computer system users are carried out in accordance with relevant laws, regulations and ethics, and relevant to the business requirements, the classification of the information to be accessed, and the perceived risks. [RCM007]\n - Verifying credentials and even background verification checks may be beneficial to your facility.\n - In addition to any verification checks performed for potential employees, it is also important to ensure that some, or all, of these checks are performed for contractors and third parties.\n - The Information Security Policy template provided by the REC can also help in this area with the Background Check Authorization in Appendix F.",{"$f":"'Screening Questions (Step 1)'!F25","v":" - References are verified\n - Credential verification is also performed\n - No criminal background checks are performed at this time"},null,{"$f":"IF('Screening Questions (Step 1)'!D21=\"Addressed\",\"Low\",(IF('Screening Questions (Step 1)'!D21=\"Partially Addressed\",\"Medium\",IF('Screening Questions (Step 1)'!D21=\"Not Addressed\",\"High\",\" \"))))","v":" "},"Not Likely","1","High",3,3,"Low"]
["Personnel Security",{"$f":"'Screening Questions (Step 1)'!E26","v":"Employees or contractors do not agree or sign terms or conditions of employment. [TVS008]"},"As part of their terms of employment or contractual agreements, employees, contractors and third party users agree and sign the terms and conditions of their employment contract, which should state their responsibilities and the organizations responsibilities for information security. [RCM008]",{"$f":"'Screening Questions (Step 1)'!F26","v":" - Non disclosure Agreements required prior to employment"},null,{"$f":"IF('Screening Questions (Step 1)'!D22=\"Addressed\",\"Low\",(IF('Screening Questions (Step 1)'!D22=\"Partially Addressed\",\"Medium\",IF('Screening Questions (Step 1)'!D22=\"Not Addressed\",\"High\",\" \"))))","v":" "},null,0,"High",3,0," "]
["Personnel Security",{"$f":"'Screening Questions (Step 1)'!E27","v":"Employee, contractor or third party user terminations or change of responsibilities could result in a security breach due to lack of a defined management process for terminations or changes in responsibilities. [TVS009]"},"Procedures are in place to ensure the properly managed exit from the organization of employees, contractors or third parties and that all equipment is returned and the removal of all access rights are completed. [RCM009]\n - The Information Security Policy template provided by the REC can help be a starting point for creating termination procedures. The policy does include a section about terminations and procedures can be created based on the policy, if adopted within your facility.\n - The template also includes a hiring and termination checklist (Appendix H).",{"$f":"'Screening Questions (Step 1)'!F27","v":" - No known procedures in place for terminations or changes of responsibilities.\n - Disabling of access within the EHR as well as retrieval of keys and equipment is performed."},null,{"$f":"IF('Screening Questions (Step 1)'!D23=\"Addressed\",\"Low\",(IF('Screening Questions (Step 1)'!D23=\"Partially Addressed\",\"Medium\",IF('Screening Questions (Step 1)'!D23=\"Not Addressed\",\"High\",\" \"))))","v":" "},null,0,"High",3,0," "]
["Physical Security",{"$f":"'Screening Questions (Step 1)'!E29","v":"Unauthorized parties gain physical access to facilities due to insufficient physical entry/exit controls. [TVS010]"},"A facility security plan is implemented, which protects the facility with appropriate entry/exit controls to ensure that only authorized personnel are allowed access, removal of equipment from the facility is restricted to authorized individuals, and repair/modification of physical components of the facility are documented and monitored. Workstations are protected from removal by unauthorized individuals.  A contingency plan is implemented for permitting and enabling physical access to alternate authorized individuals (e.g. in the event primary authorized individuals are sick or not available). [RCM010]\n - A facility security plan should be implemented which outline how personnel and patients are authorized access to all or parts of the facility.\n - The control of physical components (equipment) should also be part of a facility security plan.\n - The Information Security Policy template provided by the REC contains a section on Building Security which can be a good starting point for formalizing a policy / facility plan. Refer to section IS-1.6.\n - It's a good practice to ensure that all visitors are escorted at all times.",{"$f":"'Screening Questions (Step 1)'!F29","v":" - No facility security plan is currently in place at the practice\n - Fire escape plans are posted throughout the building\n - Alarm system is currently in place and monitored 24/7\n\n - Front Desk\nWaiting room securely separated?\nAll patients must sign in?\nAll visitors must sign in?\nAll visitors & patients escorted?\nSign-in sheet secured and maintained?"},null,{"$f":"IF('Screening Questions (Step 1)'!D25=\"Addressed\",\"Low\",(IF('Screening Questions (Step 1)'!D25=\"Partially Addressed\",\"Medium\",IF('Screening Questions (Step 1)'!D25=\"Not Addressed\",\"High\",\" \"))))","v":" "},null,0,"High",3,0," "]
["Network Security",{"$f":"'Screening Questions (Step 1)'!E31","v":"Sensitive systems co-located with less sensitive systems are accessed by unauthorized parties. [TVS011]"},"If possible sensitive systems have a dedicated, and isolated, computing environment. [RCM011]\n - A complete network diagram that outlines the boundaries of the network is recommended to help gain an overview of the computing environment(s) being protected.",{"$f":"'Screening Questions (Step 1)'!F31","v":" - No network diagram or details regarding the configurations being used are currently available."},null,{"$f":"IF('Screening Questions (Step 1)'!D27=\"Addressed\",\"Low\",(IF('Screening Questions (Step 1)'!D27=\"Partially Addressed\",\"Medium\",IF('Screening Questions (Step 1)'!D27=\"Not Addressed\",\"High\",\" \"))))","v":" "},null,0,"High",3,0," "]
["Network Security",{"$f":"'Screening Questions (Step 1)'!E32","v":"Information involved in electronic messaging is compromised. [TVS012]"},"Information involved in electronic messaging is appropriately protected. [RCM012]\n - The protection of electronic messaging should be outlines within the Information Security Policy\n - The Information Security Policy template provided by the REC could help outline the protection of electronic messaging as it relates to the facility; even if the policy prohibits the use of electronic messaging of sensitive information. Refer to section IS-1.14.\n - Any texting of PHI should include a policy and procedures surrounding this process and the safeguards being utilized.",{"$f":"'Screening Questions (Step 1)'!F32","v":" - No policies or procedures around the protection of electronic messaging.\n - No PHI is electronically sent via email or other electronic means except through fax."},null,{"$f":"IF('Screening Questions (Step 1)'!D28=\"Addressed\",\"Low\",(IF('Screening Questions (Step 1)'!D28=\"Partially Addressed\",\"Medium\",IF('Screening Questions (Step 1)'!D28=\"Not Addressed\",\"High\",\" \"))))","v":" "},null,0,"High",3,0," "]
["Network Security",{"$f":"'Screening Questions (Step 1)'!E33","v":"Technical vulnerabilities are exploited to gain inappropriate or unauthorized access to information systems due to lack of controls for those vulnerabilities. [TVS013]"},"Timely information about technical vulnerabilities of information systems being used is obtained, the organization's exposure to the vulnerabilities is evaluated and appropriate measures are taken to address the associated risk. [RCM013]\n - Vulnerability testing should be performed regularly to obtain information bout technical vulnerabilities to the systems.\n - A policy and procedure surrounding this process should be in place and should include the steps taken, where necessary, once vulnerabilities are found.",{"$f":"'Screening Questions (Step 1)'!F33","v":" - No vulnerability testing has been completed."},null,{"$f":"IF('Screening Questions (Step 1)'!D29=\"Addressed\",\"Low\",(IF('Screening Questions (Step 1)'!D29=\"Partially Addressed\",\"Medium\",IF('Screening Questions (Step 1)'!D29=\"Not Addressed\",\"High\",\" \"))))","v":" "},"Very Likely",3,"High",3,9,"High"]
["Network Security",{"$f":"'Screening Questions (Step 1)'!E34","v":"Unauthorized access is given to information over third party connections. [TVS014]"},"A formal process is in place to control all external third party network connections. [RCM014]\n - A process should be put in place to ensure all external third party connections are made, including those of the EHR vendor.\n - The process could include the automated or manual review (regular intervals) of VPN logs, EHR logs, server logs, etc.",{"$f":"'Screening Questions (Step 1)'!F34","v":0},null,{"$f":"IF('Screening Questions (Step 1)'!D30=\"Addressed\",\"Low\",(IF('Screening Questions (Step 1)'!D30=\"Partially Addressed\",\"Medium\",IF('Screening Questions (Step 1)'!D30=\"Not Addressed\",\"High\",\" \"))))","v":" "},null,0,"High",3,0," "]
["Logical Access",{"$f":"'Screening Questions (Step 1)'!E36","v":"Unauthorized access is gained to information systems. [TVS015]"},"Formal procedures should be in place to control the allocation of access rights to information systems and services. [RCM015]\n - The Information Security Policy template provided by the REC contains a network access request form that could be adopted by the facility as a formal process for controlling the allocation of access rights to the systems. Refer to section IS-1.2.\n - The policy also outlines the formalized password policy required for unique user ID's.",{"$f":"'Screening Questions (Step 1)'!F36","v":" - Access rights to the EHR are allocated based on the employees role within the facility but no procedures are in place."},null,{"$f":"IF('Screening Questions (Step 1)'!D32=\"Addressed\",\"Low\",(IF('Screening Questions (Step 1)'!D32=\"Partially Addressed\",\"Medium\",IF('Screening Questions (Step 1)'!D32=\"Not Addressed\",\"High\",\" \"))))","v":" "},null,0,"High",3,0," "]
["Logical Access",{"$f":"'Screening Questions (Step 1)'!E37","v":"Unauthorized users are able to gain access to operating systems by claiming to be an authorized user. [TVS016]"},"All users are assigned a unique identifier (user ID) for their business use.  This unique ID shall be used exclusively on computing systems within the medical practice which process EPHI, and a suitable authentication technique is chosen to validate the identity of a user. [RCM016]\n - The Information Security Policy template provided by the REC contains a section on the use of unique user ID's, if adopted. Refer to section IS-1.2.\n - Unique user ID's should extend beyond the EHR and include other systems, i.e. workstations and servers.",{"$f":"'Screening Questions (Step 1)'!F37","v":" - No policy or procedure around the use of unique user ID's"},null,{"$f":"IF('Screening Questions (Step 1)'!D33=\"Addressed\",\"Low\",(IF('Screening Questions (Step 1)'!D33=\"Partially Addressed\",\"Medium\",IF('Screening Questions (Step 1)'!D33=\"Not Addressed\",\"High\",\" \"))))","v":" "},null,0,"High",3,0," "]
["Logical Access",{"$f":"'Screening Questions (Step 1)'!E38","v":"Users that no longer have a business need for information systems access still have access to the information. [TVS017]"},"Management reviews and makes the appropriate corrections to the access right(s) of individual users at regular intervals using a formal process¹. [RCM017]\n - User accounts should be regularly reviewed to ensure that terminated employees or contractors that no longer work on the systems do not have access.\n - A process should be in place that outlines the regular review of user accounts within all systems, how often, and what actions to perform if discrepancies are found.\n - The information security policy template provided by the REC helps to formalize this area, if adopted. Audit controls is outlined in section IS-1.13 of the policy template.\n",{"$f":"'Screening Questions (Step 1)'!F38","v":" - User accounts are not currently reviewed on a regular basis"},null,{"$f":"IF('Screening Questions (Step 1)'!D34=\"Addressed\",\"Low\",(IF('Screening Questions (Step 1)'!D34=\"Partially Addressed\",\"Medium\",IF('Screening Questions (Step 1)'!D34=\"Not Addressed\",\"High\",\" \"))))","v":" "},null,0,"High",3,0," "]
["Operations Management",{"$f":"'Screening Questions (Step 1)'!E40","v":"Systems and data are exposed to malicious software and/or unauthorized use. [TVS018]"},"Policies and procedures are implemented that address the prevention, detection and removal of malicious code in the computer operating environment. This would cover all computers or devices, such as printers and thumb drives, which connect to computers. [RCM018]\n - The Information Security Policy template provided by the REC can help with the policy needed regarding antivirus protection. This is outlined in section IS-1.4 of the policy.\n - Procedures regarding the administration, whether centrally or locally managed, should also be in place and include what actions to take whenever any detections occur",{"$f":"'Screening Questions (Step 1)'!F40","v":" - No current policies and procedures surrounding the use and updating of antivirus software"},null,{"$f":"IF('Screening Questions (Step 1)'!D36=\"Addressed\",\"Low\",(IF('Screening Questions (Step 1)'!D36=\"Partially Addressed\",\"Medium\",IF('Screening Questions (Step 1)'!D36=\"Not Addressed\",\"High\",\" \"))))","v":" "},null,0,"High",3,0," "]
["Operations Management",{"$f":"'Screening Questions (Step 1)'!E41","v":"Unauthorized information processing activities occur undetected due to lack of consistent logging and monitoring activities. [TVS019]"},"Policies and procedures for information system monitoring have been established and implemented.  This is done to institute consistency and standards in computer activity logging, computer activity monitoring and reporting of any system events. [RCM019]\n - A process should be put in place to ensure that all systems are actively monitored. The systems include the EHR, servers, networking devices (firewall, switches, and routers), etc..\n - The process could include the automated or manual review (regular intervals) of VPN logs, EHR logs, server logs, etc.\n - The information security policy template provided by the REC helps to formalize this area, if adopted. Audit controls is outlined in sections IS-1.12 and IS-1.13 of the policy template.",{"$f":"'Screening Questions (Step 1)'!F41","v":0},null,{"$f":"IF('Screening Questions (Step 1)'!D37=\"Addressed\",\"Low\",(IF('Screening Questions (Step 1)'!D37=\"Partially Addressed\",\"Medium\",IF('Screening Questions (Step 1)'!D37=\"Not Addressed\",\"High\",\" \"))))","v":" "},null,0,"High",3,0," "]
["Operations Management",{"$f":"'Screening Questions (Step 1)'!E42","v":"Media (e.g., documents, computer media (e.g. tapes, disks), input/output data, system documentation) is compromised by unauthorized parties due to ineffective handling procedures. [TVS020]"},"Operating procedures are established to protect documents, computer media (e.g., tapes, disks), input/output data and system documentation.  This is done to protect sensitive information from unauthorized disclosure, modification, removal, and destruction. [RCM020]\n - The Information Security Policy template provided by the REC can be a good starting point for how media is handled within the facility. Refer to sections IS-1.9 and IS-1.10 of the Information Security Policy template.\n - Handling of media should include expectations of employees, use of encryption, wiping and destruction, storage, etc.",{"$f":"'Screening Questions (Step 1)'!F42","v":" - No procedures in place surrounding the handling of media."},null,{"$f":"IF('Screening Questions (Step 1)'!D38=\"Addressed\",\"Low\",(IF('Screening Questions (Step 1)'!D38=\"Partially Addressed\",\"Medium\",IF('Screening Questions (Step 1)'!D38=\"Not Addressed\",\"High\",\" \"))))","v":" "},null,0,"High",3,0," "]
["Operations Management",{"$f":"'Screening Questions (Step 1)'!E43","v":"Unauthorized parties access data from discarded media. [TVS021]"},"Equipment containing storage media (e.g. fixed hard disks, CD-ROMs, thumb drives) is checked to ensure that any sensitive data and licensed software has been removed or overwritten prior to disposal. [RCM021]\n - Destruction policy should be in place surrounding the disposal and reuse methods accepted within the facility for all equipment containing storage media.\n - The Information Security Policy template can be a good starting point to help create a destruction policy and work towards procedures. Refer to sections IS-1.9 and IS-10 of the Information Security Policy template.",{"$f":"'Screening Questions (Step 1)'!F43","v":0},null,{"$f":"IF('Screening Questions (Step 1)'!D39=\"Addressed\",\"Low\",(IF('Screening Questions (Step 1)'!D39=\"Partially Addressed\",\"Medium\",IF('Screening Questions (Step 1)'!D39=\"Not Addressed\",\"High\",\" \"))))","v":" "},null,0,"High",3,0," "]
["Operations Management",{"$f":"'Screening Questions (Step 1)'!E44","v":"The production environment is impacted due to the lack of separation of development and production environments. [TVS022]"},"Development, test, and operational facilities are separated from one another.  This is done to reduce the risks of unauthorized access or unauthorized changes to the computer operational system or to any software applications running upon the operating system. [RCM022]",{"$f":"'Screening Questions (Step 1)'!F44","v":" - Testing that relates to the EHR occurs though the EHR vendor and not performed internally."},null,{"$f":"IF('Screening Questions (Step 1)'!D40=\"Addressed\",\"Low\",(IF('Screening Questions (Step 1)'!D40=\"Partially Addressed\",\"Medium\",IF('Screening Questions (Step 1)'!D40=\"Not Addressed\",\"High\",\" \"))))","v":" "},null,0,"High",3,0," "]
["Operations Management",{"$f":"'Screening Questions (Step 1)'!E45","v":"The integrity of a business process is compromised due to the lack of segregation of duties (e.g., maker & checker). [TVS023]"},"Employee duties and employees 'areas of responsibility' are separated; this is to reduce potential opportunities for unauthorized or unintentional modification or misuse of the organization's computing systems or assets. [RCM023]\n - The Information Security Policy template can be a good start to help address the segregation of duties within the facility but should be updated as needed as well as adopted as a formal policy. Refer to section IS-1.2 of the information security policy template.\n - Appropriate and detailed job descriptions can also help outline the areas of responsibility between employees.",{"$f":"'Screening Questions (Step 1)'!F45","v":" - Job duties are separated within the EHR based on their job roles but not formally outlined within any policy or procedure."},null,{"$f":"IF('Screening Questions (Step 1)'!D41=\"Addressed\",\"Low\",(IF('Screening Questions (Step 1)'!D41=\"Partially Addressed\",\"Medium\",IF('Screening Questions (Step 1)'!D41=\"Not Addressed\",\"High\",\" \"))))","v":" "},null,0,"High",3,0," "]
["Operations Management",{"$f":"'Screening Questions (Step 1)'!E46","v":"The change management process in place does not adequately protect the environment from disruptive changes in production. [TVS024]"},"Formal 'change policies and procedures'  have been established to manage the implementation of changes to assure the adherence to standards and security practices. [RCM024]\n - Change management policies and procedures should be in place to help address the changes that occur to any system, including the EHR, server, workstations, routers, switches, etc. Section IS-1.11 of the information security policy template provided by the REC can be a great starting point for formalizing change management.\n - Change management procedures could include how changes are known, reviewed, tested, approved, and verified.",{"$f":"'Screening Questions (Step 1)'!F46","v":" - No formal change management procedures currently in place.\n - The existing process for EHR updating involves being contacted by the vendor and then scheduling a time for installation."},null,{"$f":"IF('Screening Questions (Step 1)'!D42=\"Addressed\",\"Low\",(IF('Screening Questions (Step 1)'!D42=\"Partially Addressed\",\"Medium\",IF('Screening Questions (Step 1)'!D42=\"Not Addressed\",\"High\",\" \"))))","v":" "},null,0,"High",3,0," "]
["Incident Management",{"$f":"'Screening Questions (Step 1)'!E48","v":"Security incidents are not managed with a consistent and effective approach. [TVS025]"},"A consistent approach to managing information security incidents, consistent with applicable law, is in place to handle information security events and weaknesses once they are reported. Activities such as incident reporting, organizational response, relocation of operations, evidence collection and system recovery are all components of incident response. [RCM025]\n - An incident response plan should also be in place to address how incidents are to be responded to and outlines the escalation steps necessary.\n - The Information Security Policy template provided by the REC can be a good starting point for addressing a breach which does contain a breach assessment tool that could be part of an incident response plan. Appendix E of the template contains the following items:\n     Security Incident Report\n     Security Incident Investigation form\n     Security Incident Log\n     Security Breach Assessment Tool",{"$f":"'Screening Questions (Step 1)'!F48","v":" - Incidents are reported but not consistent in the approach and no formalized incident response plan is currently in place."},null,{"$f":"IF('Screening Questions (Step 1)'!D44=\"Addressed\",\"Low\",(IF('Screening Questions (Step 1)'!D44=\"Partially Addressed\",\"Medium\",IF('Screening Questions (Step 1)'!D44=\"Not Addressed\",\"High\",\" \"))))","v":" "},null,0,"High",3,0," "]
["Business Continuity Management",{"$f":"'Screening Questions (Step 1)'!E50","v":"Information systems cannot be recovered due to a lack of written disaster recovery plans. [TVS026]"},"Backup and Recovery plans are documented, distributed through the organization and easily obtained by office personnel in the event that an event occurs. The DR Plan must identify the required actions to undertake following interruption to, or failure of, critical IT systems. [RCM026]\n - A complete disaster recovery plan and/or documented emergency operations plan should be in place in the event that there's an interruption or failure of critical IT systems. The plan should also include the specific actions employee roles/jobs are to take in the event of a disaster.\n - The information security policy provided by the REC has a great starting point in this area, if adopted, as outlined in section IS-1.15 (Contingency Plan).\n - The use of backups, rotation type, encryption, and offsite storage should all be documented appropriately.\n",{"$f":"'Screening Questions (Step 1)'!F50","v":" - No Disaster Recovery Plan or Emergency Operations Plan currently in place at the facility"},null,{"$f":"IF('Screening Questions (Step 1)'!D46=\"Addressed\",\"Low\",(IF('Screening Questions (Step 1)'!D46=\"Partially Addressed\",\"Medium\",IF('Screening Questions (Step 1)'!D46=\"Not Addressed\",\"High\",\" \"))))","v":" "},null,0,"High",3,0," "]
["Category","New Threat 1 (TVS027)","Recommended Control Measures",null,null,null,null,{"$f":"IF(G83=\"Not Likely\",\"1\",(IF(G83=\"Likely\",2,IF(G83=\"Very Likely\",3,0))))","v":0},null,{"$f":"IF(I83=\"Low\",\"1\",(IF(I83=\"Medium\",2,IF(I83=\"High\",3,0))))","v":0},{"$f":"H83*J83","v":0}," "]
["Category","New Threat 2 (TVS028)","Recommended Control Measures",null,null,null,null,{"$f":"IF(G84=\"Not Likely\",\"1\",(IF(G84=\"Likely\",2,IF(G84=\"Very Likely\",3,0))))","v":0},null,{"$f":"IF(I84=\"Low\",\"1\",(IF(I84=\"Medium\",2,IF(I84=\"High\",3,0))))","v":0},{"$f":"H84*J84","v":0},{"$f":"IF(AND(K84>=4,K84<7),\"Medium\",IF(AND(K84<4,K84>=1),\"Low\",IF(K84>7,\"High\",IF(K84=0,\" \"))))","v":" "}]
["Category","New Threat 3 (TVS029)","Recommended Control Measures",null,null,null,null,{"$f":"IF(G85=\"Not Likely\",\"1\",(IF(G85=\"Likely\",2,IF(G85=\"Very Likely\",3,0))))","v":0},null,{"$f":"IF(I85=\"Low\",\"1\",(IF(I85=\"Medium\",2,IF(I85=\"High\",3,0))))","v":0},{"$f":"H85*J85","v":0},{"$f":"IF(AND(K85>=4,K85<7),\"Medium\",IF(AND(K85<4,K85>=1),\"Low\",IF(K85>7,\"High\",IF(K85=0,\" \"))))","v":" "}]
["Category","New Threat 4 (TVS030)","Recommended Control Measures",null,null,null,null,{"$f":"IF(G86=\"Not Likely\",\"1\",(IF(G86=\"Likely\",2,IF(G86=\"Very Likely\",3,0))))","v":0},null,{"$f":"IF(I86=\"Low\",\"1\",(IF(I86=\"Medium\",2,IF(I86=\"High\",3,0))))","v":0},{"$f":"H86*J86","v":0},{"$f":"IF(AND(K86>=4,K86<7),\"Medium\",IF(AND(K86<4,K86>=1),\"Low\",IF(K86>7,\"High\",IF(K86=0,\" \"))))","v":" "}]
["Category","New Threat 5 (TVS031)","Recommended Control Measures",null,null,null,null,{"$f":"IF(G87=\"Not Likely\",\"1\",(IF(G87=\"Likely\",2,IF(G87=\"Very Likely\",3,0))))","v":0},null,{"$f":"IF(I87=\"Low\",\"1\",(IF(I87=\"Medium\",2,IF(I87=\"High\",3,0))))","v":0},{"$f":"H87*J87","v":0},{"$f":"IF(AND(K87>=4,K87<7),\"Medium\",IF(AND(K87<4,K87>=1),\"Low\",IF(K87>7,\"High\",IF(K87=0,\" \"))))","v":" "}]

{"sheet":"Technology (Step 2b)","index":7,"n_rows":59,"n_cols":12,"rows_kept":59,"cut":false,"hidden":false,"merged":[[1,0,1,11],[32,1,32,2],[32,3,32,4],[32,6,32,11]]}
[]
["Technology (Step 2b)"]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[null,null,null,"Perform Control Analysis",null,"Exposure","Assess Risk"]
["Asset Management Category","Threat-Vulnerability Statement","Recommended Control Measures","Perform Control Analysis\nExisting Control","Perform Control Analysis\nExisting Control Effectiveness","Exposure Potential","Assess Risk\nLikelihood","Hidden Likelihood \nScore","Assess Risk\nImpact","Hidden Impact \nScore","Hidden Risk Rating \nScore","Assess Risk\nRisk Rating"]
["Security Program",{"$f":"'Screening Questions (Step 1)'!E16","v":"Security breaches occur when dealing with third parties due to a lack of security considerations in the related third party agreement. [TVS002]"},"Agreements with third parties, such as IT vendors,  which involve accessing, processing, communicating with or managing the organization's information or information processing facilities, or adding products or services to information processing facilities cover all relevant security requirements.\nContracts between business associates and covered entities address administrative, physical, and technical safeguards that reasonably and appropriately protect the confidentiality, integrity, and availability of information. [RCM002]\n - Controls should be in place to help monitor any access by third parties. This can include the regular review of VPN logs, EHR logs, server logs, etc. \n - Automated alerts when certain criteria is met within a system can greatly help monitor third party connections to internal systems.",{"$f":"'Screening Questions (Step 1)'!G16","v":0},"Not Effective",{"$f":"IF('Screening Questions (Step 1)'!D16=\"Addressed\",\"Low\",(IF('Screening Questions (Step 1)'!D16=\"Partially Addressed\",\"Medium\",IF('Screening Questions (Step 1)'!D16=\"Not Addressed\",\"High\",\" \"))))","v":" "},"Likely",{"$f":"IF(G35=\"Not Likely\",\"1\",(IF(G35=\"Likely\",2,IF(G35=\"Very Likely\",3,0))))","v":2},"High",{"$f":"IF(I35=\"Low\",\"1\",(IF(I35=\"Medium\",2,IF(I35=\"High\",3,0))))","v":3},{"$f":"H35*J35","v":6},{"$f":"IF(AND(K35>=4,K35<7),\"Medium\",IF(AND(K35<4,K35>=1),\"Low\",IF(K35>7,\"High\",IF(K35=0,\" \"))))","v":"Medium"}]
["Risk Management & Compliance",{"$f":"'Screening Questions (Step 1)'!E20","v":"Information around risks and related control options are not presented to management before management decisions are made. [TVS004]"},"Risk assessments are conducted to identify, quantify, prioritize and manage risks.  The prioritization is accomplished by creating and using criteria for risk acceptance and objectives which are important to the organization. [RCM004]\n - It is important to expand upon this risk assessment by assessing the risk of each asset itself.",{"$f":"'Screening Questions (Step 1)'!G20","v":" - No regular assessments of technology is performed; including vulnerability testing, patch management, or other review of systems to help determine risks associated with them so appropriate action(s) can be taken."},"Not Effective",{"$f":"IF('Screening Questions (Step 1)'!D20=\"Addressed\",\"Low\",(IF('Screening Questions (Step 1)'!D20=\"Partially Addressed\",\"Medium\",IF('Screening Questions (Step 1)'!D20=\"Not Addressed\",\"High\",\" \"))))","v":" "},"Likely",2,"High",3,6,"Medium"]
["Training & Awareness",{"$f":"'Screening Questions (Step 1)'!E23","v":"Applications and technology solutions are not correctly and securely used since a training curriculum for employees has not been established or regularly updated. [TVS006]"},"A training curriculum for employees has been established to educate and train users for correct and secure use of applications and technology solutions. [RCM006]\n - Technology use for a training curriculum could include the use of regular email newsletters that include security reminders, an Intranet site, or a training service provided over the Internet.",{"$f":"'Screening Questions (Step 1)'!G23","v":" - The use of technology regarding a training curriculum is not currently being utilized."},"Not Effective",{"$f":"IF('Screening Questions (Step 1)'!D23=\"Addressed\",\"Low\",(IF('Screening Questions (Step 1)'!D23=\"Partially Addressed\",\"Medium\",IF('Screening Questions (Step 1)'!D23=\"Not Addressed\",\"High\",\" \"))))","v":" "},null,0,"High",3,0," "]
["Personnel Security",{"$f":"'Screening Questions (Step 1)'!E26","v":"Employees or contractors do not agree or sign terms or conditions of employment. [TVS008]"},"As part of their terms of employment or contractual agreements, employees, contractors and third party users agree and sign the terms and conditions of their employment contract, which should state their responsibilities and the organizations responsibilities for information security. [RCM008]\n  - Technology in this area is to prohibit employee or contractor access to systems until such Agreements are signed. For example, no Active Directory accounts, VPN access, or application access is created/activated prior to the Agreement of terms.",{"$f":"'Screening Questions (Step 1)'!G26","v":" - Accounts are not created within the EHR until appropriate Agreements are signed"},"Effective",{"$f":"IF('Screening Questions (Step 1)'!D26=\"Addressed\",\"Low\",(IF('Screening Questions (Step 1)'!D26=\"Partially Addressed\",\"Medium\",IF('Screening Questions (Step 1)'!D26=\"Not Addressed\",\"High\",\" \"))))","v":" "},"Not Likely","1","High",3,3,"Low"]
["Personnel Security",{"$f":"'Screening Questions (Step 1)'!E27","v":"Employee, contractor or third party user terminations or change of responsibilities could result in a security breach due to lack of a defined management process for terminations or changes in responsibilities. [TVS009]"},"Procedures are in place to ensure the properly managed exit from the organization of employees, contractors or third parties and that all equipment is returned and the removal of all access rights are completed. [RCM009]\n - Accounts/access to all systems should be properly managed for employees and contractors. This includes local workstation access, server access, etc. in addition to the user accounts within the EHR.",{"$f":"'Screening Questions (Step 1)'!G27","v":" - User accounts are disabled within the EHR"},"Partially Effective",{"$f":"IF('Screening Questions (Step 1)'!D27=\"Addressed\",\"Low\",(IF('Screening Questions (Step 1)'!D27=\"Partially Addressed\",\"Medium\",IF('Screening Questions (Step 1)'!D27=\"Not Addressed\",\"High\",\" \"))))","v":" "},"Not Likely","1","High",3,3,"Low"]
["Physical Security",{"$f":"'Screening Questions (Step 1)'!E29","v":"Unauthorized parties gain physical access to facilities due to insufficient physical entry/exit controls. [TVS010]"},"A facility security plan is implemented, which protects the facility with appropriate entry/exit controls to ensure that only authorized personnel are allowed access, removal of equipment from the facility is restricted to authorized individuals, and repair/modification of physical components of the facility are documented and monitored. Workstations are protected from removal by unauthorized individuals.  A contingency plan is implemented for permitting and enabling physical access to alternate authorized individuals (e.g. in the event primary authorized individuals are sick or not available). [RCM010]\n - The server room should be secured to ensure physical access is available for only authorized individuals. This can include all doors to the servers to be locked at all time and any windows secured/monitored.\n - Best practice to ensure proper temperature and humidity for both server and wiring rooms.\n - Wiring closets that contain switches, routers, and other networking equipment should also remain locked and accessible by only authorized individuals.\n - The use of cable locks can help prevent theft of mobile devices (laptops) and privacy screens can help prevent unauthorized viewing of computer screens/monitors",{"$f":"'Screening Questions (Step 1)'!G29","v":" - Workstations/Laptops/Tablets\nPositioning?\nPrivacy screens used?\nCable locks used?\n\n - Server Room\nServer room location?\nLocked at all times?\nProper cooling?\nBattery backup?\nFire suppression?\n\n - Network Closet\nLocked at all times?\nProper cooling?\nBattery backup?\n\n - Building\nEmergency lighting?\nFire detection?\nFire suppression?\nBack door remains locked?\nOther doors remain locked? \nWater shut-off valves?\nEmergency power shut-off?\nBuilding alarm system?"},"Partially Effective",{"$f":"IF('Screening Questions (Step 1)'!D29=\"Addressed\",\"Low\",(IF('Screening Questions (Step 1)'!D29=\"Partially Addressed\",\"Medium\",IF('Screening Questions (Step 1)'!D29=\"Not Addressed\",\"High\",\" \"))))","v":" "},"Very Likely",3,"High",3,9,"High"]
["Network Security",{"$f":"'Screening Questions (Step 1)'!E31","v":"Sensitive systems co-located with less sensitive systems are accessed by unauthorized parties. [TVS011]"},"If possible sensitive systems have a dedicated, and isolated, computing environment. [RCM011]\n - Verify and ensure firewall capabilities exist between the public Internet and internal network beyond the basic port blocking and NATing functions of the Cisco router.\n",{"$f":"'Screening Questions (Step 1)'!G31","v":" - Network Configuration\nFirewall in place?\nWireless encryption?\nRemote access type?\nRemote access encryption?"},"Partially Effective",{"$f":"IF('Screening Questions (Step 1)'!D31=\"Addressed\",\"Low\",(IF('Screening Questions (Step 1)'!D31=\"Partially Addressed\",\"Medium\",IF('Screening Questions (Step 1)'!D31=\"Not Addressed\",\"High\",\" \"))))","v":" "},"Likely",2,"High",3,6,"Medium"]
["Network Security",{"$f":"'Screening Questions (Step 1)'!E32","v":"Information involved in electronic messaging is compromised. [TVS012]"},"Information involved in electronic messaging is appropriately protected. [RCM012]\n - The use of email encryption (via certificate authority or encryption software) can help protect information involved in electronic messaging\n - For any texting, or email-to-texting, of PHI, the use of encryption is important as well as:\n     - Including only the minimum necessary information\n     - Phones lock after inactivity\n     - Phones (smartphone) encryption\n     - Central management of the phones\n     - Regular removing (retention) of all previous texts\n - Also, working with the phone company to determine their methods of retention of any texts being sent or is the phone company just a conduit without any capturing of plaintext messages being sent/received.",{"$f":"'Screening Questions (Step 1)'!G32","v":0},"Effective",{"$f":"IF('Screening Questions (Step 1)'!D32=\"Addressed\",\"Low\",(IF('Screening Questions (Step 1)'!D32=\"Partially Addressed\",\"Medium\",IF('Screening Questions (Step 1)'!D32=\"Not Addressed\",\"High\",\" \"))))","v":" "},"Not Likely","1","High",3,3,"Low"]
["Network Security",{"$f":"'Screening Questions (Step 1)'!E33","v":"Technical vulnerabilities are exploited to gain inappropriate or unauthorized access to information systems due to lack of controls for those vulnerabilities. [TVS013]"},"Timely information about technical vulnerabilities of information systems being used is obtained, the organization's exposure to the vulnerabilities is evaluated and appropriate measures are taken to address the associated risk. [RCM013]\n - Regular vulnerability testing can be performed using free or commercial scanning tools. The results provide information about technical vulnerabilities that may need to be addressed within the systems.\nExample tools include: Microsoft Baseline Security Analyzer, Nessus, and nmap.\n - Vulnerability assessments should include servers, workstations, switches, firewalls, routers, etc. to ensure all entry points within the systems are assessed for vulnerabilities.",{"$f":"'Screening Questions (Step 1)'!G33","v":" - No vulnerability testing currently being performed internally or from a third party"},"Not Effective",{"$f":"IF('Screening Questions (Step 1)'!D33=\"Addressed\",\"Low\",(IF('Screening Questions (Step 1)'!D33=\"Partially Addressed\",\"Medium\",IF('Screening Questions (Step 1)'!D33=\"Not Addressed\",\"High\",\" \"))))","v":" "},"Very Likely",3,"High",3,9,"High"]
["Network Security",{"$f":"'Screening Questions (Step 1)'!E34","v":"Unauthorized access is given to information over third party connections. [TVS014]"},"A formal process is in place to control all external third party network connections. [RCM014]\n - Reviewing of logs from the EHR, servers, networking systems, etc. should be reviewed on a regular basis whether automated or reviewed manually. \n - Network connections from third party could also be restricted to business hours or activated upon request to help control the connections.",{"$f":"'Screening Questions (Step 1)'!G34","v":0},"Not Effective",{"$f":"IF('Screening Questions (Step 1)'!D34=\"Addressed\",\"Low\",(IF('Screening Questions (Step 1)'!D34=\"Partially Addressed\",\"Medium\",IF('Screening Questions (Step 1)'!D34=\"Not Addressed\",\"High\",\" \"))))","v":" "},"Very Likely",3,"High",3,9,"High"]
["Logical Access",{"$f":"'Screening Questions (Step 1)'!E36","v":"Unauthorized access is gained to information systems. [TVS015]"},"Formal procedures should be in place to control the allocation of access rights to information systems and services. [RCM015]\n - It's good practice to limit access rights to local workstations by using Restricted User access rights for each authorized user to help control the installation of software as well as to help minimize the impact of malware\n - Passwords should be changed regularly, i.e. 30, 60, or 90 days\n - Minimum password length should be enforced, i.e. 8 characters long\n - Password complexity and history of previously used passwords should also be enforced, i.e. passwords to contain uppercase and lowercase letters and numbers as well as not being able to reuse the last x amount of passwords\n - Auto logoff should be enforced within the EHR to help prevent unauthorized access if the user walks away from the system, i.e. 15 minutes of inactivity\n - Auto screenlock should also be enforced on the workstations and servers to help prevent unauthorized access if the user walks away from the system, i.e. 15 minutes of inactivity\n - Remote connectivity should be accomplished through secure connections including, SSL/TLS, IPSec VPN tunnels, or other secure methods. The use of Remote Desktop external from the network through port forwarding can introduce various vulnerabilities.",{"$f":"'Screening Questions (Step 1)'!G36","v":" - EHR Password Security\nPassword Change?\nMinimum Length?\nComplexity?\nPassword History?\nLockout?\n\n - Windows Password Security\nPassword Change?\nMinimum Length?\nComplexity?\nPassword History?\nLockout?\n\n - Auto Logoff\nEHR?\nWindows?\n\n- Servers/Network Devices\nDefault Admin passwords have been changed?"},"Partially Effective",{"$f":"IF('Screening Questions (Step 1)'!D36=\"Addressed\",\"Low\",(IF('Screening Questions (Step 1)'!D36=\"Partially Addressed\",\"Medium\",IF('Screening Questions (Step 1)'!D36=\"Not Addressed\",\"High\",\" \"))))","v":" "},"Very Likely",3,"High",3,9,"High"]
["Logical Access",{"$f":"'Screening Questions (Step 1)'!E37","v":"Unauthorized users are able to gain access to operating systems by claiming to be an authorized user. [TVS016]"},"All users are assigned a unique identifier (user ID) for their business use.  This unique ID shall be used exclusively on computing systems within the medical practice which process EPHI, and a suitable authentication technique is chosen to validate the identity of a user. [RCM016]\n - Access to local workstations and other systems should also have unique user ID's and passwords in addition to the EHR itself",{"$f":"'Screening Questions (Step 1)'!G37","v":" - Unique user ID's are utilized within the EHR.\n - However, user ID's are NOT unique for workstation access"},"Partially Effective",{"$f":"IF('Screening Questions (Step 1)'!D37=\"Addressed\",\"Low\",(IF('Screening Questions (Step 1)'!D37=\"Partially Addressed\",\"Medium\",IF('Screening Questions (Step 1)'!D37=\"Not Addressed\",\"High\",\" \"))))","v":" "},"Very Likely",3,"High",3,9,"High"]
["Logical Access",{"$f":"'Screening Questions (Step 1)'!E38","v":"Users that no longer have a business need for information systems access still have access to the information. [TVS017]"},"Management reviews and makes the appropriate corrections to the access right(s) of individual users at regular intervals using a formal process¹. [RCM017]\n - Reviewing of user accounts could be accomplished on a regular basis by comparing HR active employee lists to the lists within the EHR and other systems.",{"$f":"'Screening Questions (Step 1)'!G38","v":" - No regular review of accounts currently being performed within the EHR, servers, and other systems."},"Not Effective",{"$f":"IF('Screening Questions (Step 1)'!D38=\"Addressed\",\"Low\",(IF('Screening Questions (Step 1)'!D38=\"Partially Addressed\",\"Medium\",IF('Screening Questions (Step 1)'!D38=\"Not Addressed\",\"High\",\" \"))))","v":" "},"Likely",2,"High",3,6,"Medium"]
["Operations Management",{"$f":"'Screening Questions (Step 1)'!E40","v":"Systems and data are exposed to malicious software and/or unauthorized use. [TVS018]"},"Policies and procedures are implemented that address the prevention, detection and removal of malicious code in the computer operating environment. This would cover all computers or devices, such as printers and thumb drives, which connect to computers. [RCM018]\n - All workstations and servers should have protection from malicious software. This should include at least antivirus protection but could also include full security suites or Endpoint Security packages\n - Antivirus software should be updated at least daily and full scans ran on a regular basis",{"$f":"'Screening Questions (Step 1)'!G40","v":0},"Not Effective",{"$f":"IF('Screening Questions (Step 1)'!D40=\"Addressed\",\"Low\",(IF('Screening Questions (Step 1)'!D40=\"Partially Addressed\",\"Medium\",IF('Screening Questions (Step 1)'!D40=\"Not Addressed\",\"High\",\" \"))))","v":" "},"Not Likely","1","High",3,3,"Low"]
["Operations Management",{"$f":"'Screening Questions (Step 1)'!E41","v":"Unauthorized information processing activities occur undetected due to lack of consistent logging and monitoring activities. [TVS019]"},"Policies and procedures for information system monitoring have been established and implemented.  This is done to institute consistency and standards in computer activity logging, computer activity monitoring and reporting of any system events. [RCM019]\n - Reviewing of logs from the EHR, servers, networking systems, etc. should be reviewed on a regular basis whether automated or reviewed manually. \n - Network connections from third party could also be restricted to business hours or activated upon request to help control the connections.",{"$f":"'Screening Questions (Step 1)'!G41","v":0},"Not Effective",{"$f":"IF('Screening Questions (Step 1)'!D41=\"Addressed\",\"Low\",(IF('Screening Questions (Step 1)'!D41=\"Partially Addressed\",\"Medium\",IF('Screening Questions (Step 1)'!D41=\"Not Addressed\",\"High\",\" \"))))","v":" "},"Very Likely",3,"High",3,9,"High"]
["Operations Management",{"$f":"'Screening Questions (Step 1)'!E42","v":"Media (e.g., documents, computer media (e.g. tapes, disks), input/output data, system documentation) is compromised by unauthorized parties due to ineffective handling procedures. [TVS020]"},"Operating procedures are established to protect documents, computer media (e.g., tapes, disks), input/output data and system documentation.  This is done to protect sensitive information from unauthorized disclosure, modification, removal, and destruction. [RCM020]\n - The use of encryption that follows NIST 800-11 is recommended\n - Encryption of the EHR database should be considered as well as any file servers that contain ePHI\n - Utilizing full disk encryption on all desktops, laptops, USB drives, backup tapes, and/or other mobile devices can also help prevent unauthorized access to data if lost or stolen.\n - The use of encryption can help give \"safe harbor\" from breach notification the encrypted media becomes lost or stolen",{"$f":"'Screening Questions (Step 1)'!G42","v":" - Backups\nAre backups encrypted?"},"Partially Effective",{"$f":"IF('Screening Questions (Step 1)'!D42=\"Addressed\",\"Low\",(IF('Screening Questions (Step 1)'!D42=\"Partially Addressed\",\"Medium\",IF('Screening Questions (Step 1)'!D42=\"Not Addressed\",\"High\",\" \"))))","v":" "},"Very Likely",3,"High",3,9,"High"]
["Operations Management",{"$f":"'Screening Questions (Step 1)'!E44","v":"The production environment is impacted due to the lack of separation of development and production environments. [TVS022]"},"Development, test, and operational facilities are separated from one another.  This is done to reduce the risks of unauthorized access or unauthorized changes to the computer operational system or to any software applications running upon the operating system. [RCM022]",{"$f":"'Screening Questions (Step 1)'!G44","v":" - No test systems\n - EHR vendor tests their updates and then notifies the Practice for installation into production"},"Partially Effective",{"$f":"IF('Screening Questions (Step 1)'!D44=\"Addressed\",\"Low\",(IF('Screening Questions (Step 1)'!D44=\"Partially Addressed\",\"Medium\",IF('Screening Questions (Step 1)'!D44=\"Not Addressed\",\"High\",\" \"))))","v":" "},"Not Likely","1","High",3,3,"Low"]
["Operations Management",{"$f":"'Screening Questions (Step 1)'!E46","v":"The change management process in place does not adequately protect the environment from disruptive changes in production. [TVS024]"},"Formal 'change policies and procedures'  have been established to manage the implementation of changes to assure the adherence to standards and security practices. [RCM024]\n - It is recommended to have all changes recorded and tracked. This is usually accomplished through a helpdesk ticket system or even through the use of a database or Excel spreadsheet in some cases. Appendix G of the information security policy template provided by the REC contains a Change Management Tracking Log that can help in this area.",{"$f":"'Screening Questions (Step 1)'!G46","v":" - No internal tracking or reporting of changes to the systems\n - EHR vendor does keep records of any changes performed through the use of their ticketing system\n\n - Windows Updates\nWorkstations update automatically?\nServers are updated regularly?"},"Partially Effective",{"$f":"IF('Screening Questions (Step 1)'!D46=\"Addressed\",\"Low\",(IF('Screening Questions (Step 1)'!D46=\"Partially Addressed\",\"Medium\",IF('Screening Questions (Step 1)'!D46=\"Not Addressed\",\"High\",\" \"))))","v":" "},"Likely",2,"Medium",2,4,"Medium"]
["Incident Management",{"$f":"'Screening Questions (Step 1)'!E48","v":"Security incidents are not managed with a consistent and effective approach. [TVS025]"},"A consistent approach to managing information security incidents, consistent with applicable law, is in place to handle information security events and weaknesses once they are reported. Activities such as incident reporting, organizational response, relocation of operations, evidence collection and system recovery are all components of incident response. [RCM025]\n - An incident response plan should include how evidence is collected, whether performed internally or from a third party.\n - The ability to track and report on incidents is recommended\n - Incident response plans should be tested regularly (i.e. annually).\n - The Information Security Policy template provided by the REC contains a Security Incident Log in Appendix E that can help in this area.",{"$f":"'Screening Questions (Step 1)'!G48","v":"\n - No incident management tracking / reporting software is being utilized"},"Not Effective",{"$f":"IF('Screening Questions (Step 1)'!D48=\"Addressed\",\"Low\",(IF('Screening Questions (Step 1)'!D48=\"Partially Addressed\",\"Medium\",IF('Screening Questions (Step 1)'!D48=\"Not Addressed\",\"High\",\" \"))))","v":" "},"Very Likely",3,"Medium",2,6,"Medium"]
["Business Continuity Management",{"$f":"'Screening Questions (Step 1)'!E50","v":"Information systems cannot be recovered due to a lack of written disaster recovery plans. [TVS026]"},"Backup and Recovery plans are documented, distributed through the organization and easily obtained by office personnel in the event that an event occurs. The DR Plan must identify the required actions to undertake following interruption to, or failure of, critical IT systems. [RCM026]\n - Backups should be tested regularly and is a good practice to document each test\n - A Disaster Recovery Plan (DRP) should also be tested regularly (i.e. annually).\n - It is recommended that all backups be encrypted utilizing NIST 800-111 for guidance\n - Full backups should be taken offsite at least once a week and stored at a secure location",{"$f":"'Screening Questions (Step 1)'!G50","v":" -EHR backup services are utilized for secure offsite backups of the database.\n - Test restore of backups are periodically completed especially as needed but not consistently tested on a regular basis\n - No alternate facility available to recover from a disaster"},"Partially Effective",{"$f":"IF('Screening Questions (Step 1)'!D50=\"Addressed\",\"Low\",(IF('Screening Questions (Step 1)'!D50=\"Partially Addressed\",\"Medium\",IF('Screening Questions (Step 1)'!D50=\"Not Addressed\",\"High\",\" \"))))","v":" "},"Likely",2,"High",3,6,"Medium"]
["Category","New Threat 1 (TVS027)","Recommended Control Measures",null,null,null,null,{"$f":"IF(G55=\"Not Likely\",\"1\",(IF(G55=\"Likely\",2,IF(G55=\"Very Likely\",3,0))))","v":0},null,{"$f":"IF(I55=\"Low\",\"1\",(IF(I55=\"Medium\",2,IF(I55=\"High\",3,0))))","v":0},{"$f":"H55*J55","v":0}," "]
["Category","New Threat 2 (TVS028)","Recommended Control Measures",null,null,null,null,{"$f":"IF(G56=\"Not Likely\",\"1\",(IF(G56=\"Likely\",2,IF(G56=\"Very Likely\",3,0))))","v":0},null,{"$f":"IF(I56=\"Low\",\"1\",(IF(I56=\"Medium\",2,IF(I56=\"High\",3,0))))","v":0},{"$f":"H56*J56","v":0}," "]
["Category","New Threat 3 (TVS029)","Recommended Control Measures",null,null,null,null,{"$f":"IF(G57=\"Not Likely\",\"1\",(IF(G57=\"Likely\",2,IF(G57=\"Very Likely\",3,0))))","v":0},null,{"$f":"IF(I57=\"Low\",\"1\",(IF(I57=\"Medium\",2,IF(I57=\"High\",3,0))))","v":0},{"$f":"H57*J57","v":0}," "]
["Category","New Threat 4 (TVS030)","Recommended Control Measures",null,null,null,null,{"$f":"IF(G58=\"Not Likely\",\"1\",(IF(G58=\"Likely\",2,IF(G58=\"Very Likely\",3,0))))","v":0},null,{"$f":"IF(I58=\"Low\",\"1\",(IF(I58=\"Medium\",2,IF(I58=\"High\",3,0))))","v":0},{"$f":"H58*J58","v":0}," "]
["Category","New Threat 5 (TVS031)","Recommended Control Measures",null,null,null,null,{"$f":"IF(G59=\"Not Likely\",\"1\",(IF(G59=\"Likely\",2,IF(G59=\"Very Likely\",3,0))))","v":0},null,{"$f":"IF(I59=\"Low\",\"1\",(IF(I59=\"Medium\",2,IF(I59=\"High\",3,0))))","v":0},{"$f":"H59*J59","v":0}," "]

{"sheet":"Findings-Remediation (Step 3)","index":8,"n_rows":96,"n_cols":7,"rows_kept":96,"cut":false,"hidden":false,"merged":[[1,0,1,6],[21,0,21,6],[60,0,60,6]]}
[]
["Findings-Remediation (Step 3)"]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
["Number of High Risks",8,"`"]
["Number of Medium Risks",8]
["Total Number of High and Medium Risks",{"$f":"SUM(B19:B20)","v":16}]
["High and Medium Risks Findings and Remediation "]
["Risks Found \n(High and Medium Only) ","Risk Rating ","Existing Control Measures Applied","Recommended Control Measures ","Owner","Remediation Steps","Target Date"]
["People and Processes"]
[{"$f":"IF(OR('People and Processes  (Step 2a)'!$L57=\"Medium\",'People and Processes  (Step 2a)'!$L57=\"High\"),'People and Processes  (Step 2a)'!$B57,\"\")","v":""},{"$f":"IF(OR('People and Processes  (Step 2a)'!$L57=\"Medium\",'People and Processes  (Step 2a)'!$L57=\"High\"),'People and Processes  (Step 2a)'!$L57,\"\")","v":""},{"$f":"IF(OR('People and Processes  (Step 2a)'!$L57=\"Medium\",'People and Processes  (Step 2a)'!$L57=\"High\"),IF(ISBLANK('People and Processes  (Step 2a)'!$D57), \"\", 'People and Processes  (Step 2a)'!$D57),\"\")","v":""},{"$f":"IF(OR('People and Processes  (Step 2a)'!$L57=\"Medium\",'People and Processes  (Step 2a)'!$L57=\"High\"),'People and Processes  (Step 2a)'!$C57,\"\")","v":""}]
[{"$f":"IF(OR('People and Processes  (Step 2a)'!$L58=\"Medium\",'People and Processes  (Step 2a)'!$L58=\"High\"),'People and Processes  (Step 2a)'!$B58,\"\")","v":""},{"$f":"IF(OR('People and Processes  (Step 2a)'!$L58=\"Medium\",'People and Processes  (Step 2a)'!$L58=\"High\"),'People and Processes  (Step 2a)'!$L58,\"\")","v":""},{"$f":"IF(OR('People and Processes  (Step 2a)'!$L58=\"Medium\",'People and Processes  (Step 2a)'!$L58=\"High\"),IF(ISBLANK('People and Processes  (Step 2a)'!$D58), \"\", 'People and Processes  (Step 2a)'!$D58),\"\")","v":""},{"$f":"IF(OR('People and Processes  (Step 2a)'!$L58=\"Medium\",'People and Processes  (Step 2a)'!$L58=\"High\"),'People and Processes  (Step 2a)'!$C58,\"\")","v":""}]
[{"$f":"IF(OR('People and Processes  (Step 2a)'!$L59=\"Medium\",'People and Processes  (Step 2a)'!$L59=\"High\"),'People and Processes  (Step 2a)'!$B59,\"\")","v":""},{"$f":"IF(OR('People and Processes  (Step 2a)'!$L59=\"Medium\",'People and Processes  (Step 2a)'!$L59=\"High\"),'People and Processes  (Step 2a)'!$L59,\"\")","v":""},{"$f":"IF(OR('People and Processes  (Step 2a)'!$L59=\"Medium\",'People and Processes  (Step 2a)'!$L59=\"High\"),IF(ISBLANK('People and Processes  (Step 2a)'!$D59), \"\", 'People and Processes  (Step 2a)'!$D59),\"\")","v":""},{"$f":"IF(OR('People and Processes  (Step 2a)'!$L59=\"Medium\",'People and Processes  (Step 2a)'!$L59=\"High\"),'People and Processes  (Step 2a)'!$C59,\"\")","v":""}]
[{"$f":"IF(OR('People and Processes  (Step 2a)'!$L60=\"Medium\",'People and Processes  (Step 2a)'!$L60=\"High\"),'People and Processes  (Step 2a)'!$B60,\"\")","v":"Information around risks and related control options are not presented to management before management decisions are made. [TVS004]"},{"$f":"IF(OR('People and Processes  (Step 2a)'!$L60=\"Medium\",'People and Processes  (Step 2a)'!$L60=\"High\"),'People and Processes  (Step 2a)'!$L60,\"\")","v":"Medium"},{"$f":"IF(OR('People and Processes  (Step 2a)'!$L60=\"Medium\",'People and Processes  (Step 2a)'!$L60=\"High\"),IF(ISBLANK('People and Processes  (Step 2a)'!$D60), \"\", 'People and Processes  (Step 2a)'!$D60),\"\")","v":" - REC helping to start the risk assessment process by using this spreadsheet as a foundation for the risk assessment as well as risk management plan.\n - No prior risk assessments conducted"},{"$f":"IF(OR('People and Processes  (Step 2a)'!$L60=\"Medium\",'People and Processes  (Step 2a)'!$L60=\"High\"),'People and Processes  (Step 2a)'!$C60,\"\")","v":"Risk assessments are conducted to identify, quantify, prioritize and manage risks.  The prioritization is accomplished by creating and using criteria for risk acceptance and objectives which are important to the organization. [RCM004]\n - Ensure this risk assessment is accurate with all information that has been filled out as well as the risk ratings (likelihood and impact) that have also been completed based on the  information provided.\n - After verifying the accuracy of information, the Medium and High risk items from the Findings-Remediation tab should be addressed by making the necessary business decisions on whether to mitigate, transfer, or accept the risks. It is recommended to mitigate risks that are easy to address.\n - It is important to continue the risk assessment process by assessing additional risks to your facility, systems, and all other assets to ensure a thorough and up-to-date risk assessment is conducted."}]
[{"$f":"IF(OR('People and Processes  (Step 2a)'!$L61=\"Medium\",'People and Processes  (Step 2a)'!$L61=\"High\"),'People and Processes  (Step 2a)'!$B61,\"\")","v":""},{"$f":"IF(OR('People and Processes  (Step 2a)'!$L61=\"Medium\",'People and Processes  (Step 2a)'!$L61=\"High\"),'People and Processes  (Step 2a)'!$L61,\"\")","v":""},{"$f":"IF(OR('People and Processes  (Step 2a)'!$L61=\"Medium\",'People and Processes  (Step 2a)'!$L61=\"High\"),IF(ISBLANK('People and Processes  (Step 2a)'!$D61), \"\", 'People and Processes  (Step 2a)'!$D61),\"\")","v":""},{"$f":"IF(OR('People and Processes  (Step 2a)'!$L61=\"Medium\",'People and Processes  (Step 2a)'!$L61=\"High\"),'People and Processes  (Step 2a)'!$C61,\"\")","v":""}]
[{"$f":"IF(OR('People and Processes  (Step 2a)'!$L62=\"Medium\",'People and Processes  (Step 2a)'!$L62=\"High\"),'People and Processes  (Step 2a)'!$B62,\"\")","v":""},{"$f":"IF(OR('People and Processes  (Step 2a)'!$L62=\"Medium\",'People and Processes  (Step 2a)'!$L62=\"High\"),'People and Processes  (Step 2a)'!$L62,\"\")","v":""},{"$f":"IF(OR('People and Processes  (Step 2a)'!$L62=\"Medium\",'People and Processes  (Step 2a)'!$L62=\"High\"),IF(ISBLANK('People and Processes  (Step 2a)'!$D62), \"\", 'People and Processes  (Step 2a)'!$D62),\"\")","v":""},{"$f":"IF(OR('People and Processes  (Step 2a)'!$L62=\"Medium\",'People and Processes  (Step 2a)'!$L62=\"High\"),'People and Processes  (Step 2a)'!$C62,\"\")","v":""}]
[{"$f":"IF(OR('People and Processes  (Step 2a)'!$L63=\"Medium\",'People and Processes  (Step 2a)'!$L63=\"High\"),'People and Processes  (Step 2a)'!$B63,\"\")","v":""},{"$f":"IF(OR('People and Processes  (Step 2a)'!$L63=\"Medium\",'People and Processes  (Step 2a)'!$L63=\"High\"),'People and Processes  (Step 2a)'!$L63,\"\")","v":""},{"$f":"IF(OR('People and Processes  (Step 2a)'!$L63=\"Medium\",'People and Processes  (Step 2a)'!$L63=\"High\"),IF(ISBLANK('People and Processes  (Step 2a)'!$D63), \"\", 'People and Processes  (Step 2a)'!$D63),\"\")","v":""},{"$f":"IF(OR('People and Processes  (Step 2a)'!$L63=\"Medium\",'People and Processes  (Step 2a)'!$L63=\"High\"),'People and Processes  (Step 2a)'!$C63,\"\")","v":""}]
[{"$f":"IF(OR('People and Processes  (Step 2a)'!$L64=\"Medium\",'People and Processes  (Step 2a)'!$L64=\"High\"),'People and Processes  (Step 2a)'!$B64,\"\")","v":""},{"$f":"IF(OR('People and Processes  (Step 2a)'!$L64=\"Medium\",'People and Processes  (Step 2a)'!$L64=\"High\"),'People and Processes  (Step 2a)'!$L64,\"\")","v":""},{"$f":"IF(OR('People and Processes  (Step 2a)'!$L64=\"Medium\",'People and Processes  (Step 2a)'!$L64=\"High\"),IF(ISBLANK('People and Processes  (Step 2a)'!$D64), \"\", 'People and Processes  (Step 2a)'!$D64),\"\")","v":""},{"$f":"IF(OR('People and Processes  (Step 2a)'!$L64=\"Medium\",'People and Processes  (Step 2a)'!$L64=\"High\"),'People and Processes  (Step 2a)'!$C64,\"\")","v":""}]
[{"$f":"IF(OR('People and Processes  (Step 2a)'!$L65=\"Medium\",'People and Processes  (Step 2a)'!$L65=\"High\"),'People and Processes  (Step 2a)'!$B65,\"\")","v":""},{"$f":"IF(OR('People and Processes  (Step 2a)'!$L65=\"Medium\",'People and Processes  (Step 2a)'!$L65=\"High\"),'People and Processes  (Step 2a)'!$L65,\"\")","v":""},{"$f":"IF(OR('People and Processes  (Step 2a)'!$L65=\"Medium\",'People and Processes  (Step 2a)'!$L65=\"High\"),IF(ISBLANK('People and Processes  (Step 2a)'!$D65), \"\", 'People and Processes  (Step 2a)'!$D65),\"\")","v":""},{"$f":"IF(OR('People and Processes  (Step 2a)'!$L65=\"Medium\",'People and Processes  (Step 2a)'!$L65=\"High\"),'People and Processes  (Step 2a)'!$C65,\"\")","v":""}]
[{"$f":"IF(OR('People and Processes  (Step 2a)'!$L66=\"Medium\",'People and Processes  (Step 2a)'!$L66=\"High\"),'People and Processes  (Step 2a)'!$B66,\"\")","v":""},{"$f":"IF(OR('People and Processes  (Step 2a)'!$L66=\"Medium\",'People and Processes  (Step 2a)'!$L66=\"High\"),'People and Processes  (Step 2a)'!$L66,\"\")","v":""},{"$f":"IF(OR('People and Processes  (Step 2a)'!$L66=\"Medium\",'People and Processes  (Step 2a)'!$L66=\"High\"),IF(ISBLANK('People and Processes  (Step 2a)'!$D66), \"\", 'People and Processes  (Step 2a)'!$D66),\"\")","v":""},{"$f":"IF(OR('People and Processes  (Step 2a)'!$L66=\"Medium\",'People and Processes  (Step 2a)'!$L66=\"High\"),'People and Processes  (Step 2a)'!$C66,\"\")","v":""}]
[{"$f":"IF(OR('People and Processes  (Step 2a)'!$L67=\"Medium\",'People and Processes  (Step 2a)'!$L67=\"High\"),'People and Processes  (Step 2a)'!$B67,\"\")","v":""},{"$f":"IF(OR('People and Processes  (Step 2a)'!$L67=\"Medium\",'People and Processes  (Step 2a)'!$L67=\"High\"),'People and Processes  (Step 2a)'!$L67,\"\")","v":""},{"$f":"IF(OR('People and Processes  (Step 2a)'!$L67=\"Medium\",'People and Processes  (Step 2a)'!$L67=\"High\"),IF(ISBLANK('People and Processes  (Step 2a)'!$D67), \"\", 'People and Processes  (Step 2a)'!$D67),\"\")","v":""},{"$f":"IF(OR('People and Processes  (Step 2a)'!$L67=\"Medium\",'People and Processes  (Step 2a)'!$L67=\"High\"),'People and Processes  (Step 2a)'!$C67,\"\")","v":""}]
[{"$f":"IF(OR('People and Processes  (Step 2a)'!$L68=\"Medium\",'People and Processes  (Step 2a)'!$L68=\"High\"),'People and Processes  (Step 2a)'!$B68,\"\")","v":""},{"$f":"IF(OR('People and Processes  (Step 2a)'!$L68=\"Medium\",'People and Processes  (Step 2a)'!$L68=\"High\"),'People and Processes  (Step 2a)'!$L68,\"\")","v":""},{"$f":"IF(OR('People and Processes  (Step 2a)'!$L68=\"Medium\",'People and Processes  (Step 2a)'!$L68=\"High\"),IF(ISBLANK('People and Processes  (Step 2a)'!$D68), \"\", 'People and Processes  (Step 2a)'!$D68),\"\")","v":""},{"$f":"IF(OR('People and Processes  (Step 2a)'!$L68=\"Medium\",'People and Processes  (Step 2a)'!$L68=\"High\"),'People and Processes  (Step 2a)'!$C68,\"\")","v":""}]
[{"$f":"IF(OR('People and Processes  (Step 2a)'!$L69=\"Medium\",'People and Processes  (Step 2a)'!$L69=\"High\"),'People and Processes  (Step 2a)'!$B69,\"\")","v":"Technical vulnerabilities are exploited to gain inappropriate or unauthorized access to information systems due to lack of controls for those vulnerabilities. [TVS013]"},{"$f":"IF(OR('People and Processes  (Step 2a)'!$L69=\"Medium\",'People and Processes  (Step 2a)'!$L69=\"High\"),'People and Processes  (Step 2a)'!$L69,\"\")","v":"High"},{"$f":"IF(OR('People and Processes  (Step 2a)'!$L69=\"Medium\",'People and Processes  (Step 2a)'!$L69=\"High\"),IF(ISBLANK('People and Processes  (Step 2a)'!$D69), \"\", 'People and Processes  (Step 2a)'!$D69),\"\")","v":" - No vulnerability testing has been completed."},{"$f":"IF(OR('People and Processes  (Step 2a)'!$L69=\"Medium\",'People and Processes  (Step 2a)'!$L69=\"High\"),'People and Processes  (Step 2a)'!$C69,\"\")","v":"Timely information about technical vulnerabilities of information systems being used is obtained, the organization's exposure to the vulnerabilities is evaluated and appropriate measures are taken to address the associated risk. [RCM013]\n - Vulnerability testing should be performed regularly to obtain information bout technical vulnerabilities to the systems.\n - A policy and procedure surrounding this process should be in place and should include the steps taken, where necessary, once vulnerabilities are found."}]
[{"$f":"IF(OR('People and Processes  (Step 2a)'!$L70=\"Medium\",'People and Processes  (Step 2a)'!$L70=\"High\"),'People and Processes  (Step 2a)'!$B70,\"\")","v":""},{"$f":"IF(OR('People and Processes  (Step 2a)'!$L70=\"Medium\",'People and Processes  (Step 2a)'!$L70=\"High\"),'People and Processes  (Step 2a)'!$L70,\"\")","v":""},{"$f":"IF(OR('People and Processes  (Step 2a)'!$L70=\"Medium\",'People and Processes  (Step 2a)'!$L70=\"High\"),IF(ISBLANK('People and Processes  (Step 2a)'!$D70), \"\", 'People and Processes  (Step 2a)'!$D70),\"\")","v":""},{"$f":"IF(OR('People and Processes  (Step 2a)'!$L70=\"Medium\",'People and Processes  (Step 2a)'!$L70=\"High\"),'People and Processes  (Step 2a)'!$C70,\"\")","v":""}]
[{"$f":"IF(OR('People and Processes  (Step 2a)'!$L71=\"Medium\",'People and Processes  (Step 2a)'!$L71=\"High\"),'People and Processes  (Step 2a)'!$B71,\"\")","v":""},{"$f":"IF(OR('People and Processes  (Step 2a)'!$L71=\"Medium\",'People and Processes  (Step 2a)'!$L71=\"High\"),'People and Processes  (Step 2a)'!$L71,\"\")","v":""},{"$f":"IF(OR('People and Processes  (Step 2a)'!$L71=\"Medium\",'People and Processes  (Step 2a)'!$L71=\"High\"),IF(ISBLANK('People and Processes  (Step 2a)'!$D71), \"\", 'People and Processes  (Step 2a)'!$D71),\"\")","v":""},{"$f":"IF(OR('People and Processes  (Step 2a)'!$L71=\"Medium\",'People and Processes  (Step 2a)'!$L71=\"High\"),'People and Processes  (Step 2a)'!$C71,\"\")","v":""}]
[{"$f":"IF(OR('People and Processes  (Step 2a)'!$L72=\"Medium\",'People and Processes  (Step 2a)'!$L72=\"High\"),'People and Processes  (Step 2a)'!$B72,\"\")","v":""},{"$f":"IF(OR('People and Processes  (Step 2a)'!$L72=\"Medium\",'People and Processes  (Step 2a)'!$L72=\"High\"),'People and Processes  (Step 2a)'!$L72,\"\")","v":""},{"$f":"IF(OR('People and Processes  (Step 2a)'!$L72=\"Medium\",'People and Processes  (Step 2a)'!$L72=\"High\"),IF(ISBLANK('People and Processes  (Step 2a)'!$D72), \"\", 'People and Processes  (Step 2a)'!$D72),\"\")","v":""},{"$f":"IF(OR('People and Processes  (Step 2a)'!$L72=\"Medium\",'People and Processes  (Step 2a)'!$L72=\"High\"),'People and Processes  (Step 2a)'!$C72,\"\")","v":""}]
[{"$f":"IF(OR('People and Processes  (Step 2a)'!$L73=\"Medium\",'People and Processes  (Step 2a)'!$L73=\"High\"),'People and Processes  (Step 2a)'!$B73,\"\")","v":""},{"$f":"IF(OR('People and Processes  (Step 2a)'!$L73=\"Medium\",'People and Processes  (Step 2a)'!$L73=\"High\"),'People and Processes  (Step 2a)'!$L73,\"\")","v":""},{"$f":"IF(OR('People and Processes  (Step 2a)'!$L73=\"Medium\",'People and Processes  (Step 2a)'!$L73=\"High\"),IF(ISBLANK('People and Processes  (Step 2a)'!$D73), \"\", 'People and Processes  (Step 2a)'!$D73),\"\")","v":""},{"$f":"IF(OR('People and Processes  (Step 2a)'!$L73=\"Medium\",'People and Processes  (Step 2a)'!$L73=\"High\"),'People and Processes  (Step 2a)'!$C73,\"\")","v":""}]
[{"$f":"IF(OR('People and Processes  (Step 2a)'!$L74=\"Medium\",'People and Processes  (Step 2a)'!$L74=\"High\"),'People and Processes  (Step 2a)'!$B74,\"\")","v":""},{"$f":"IF(OR('People and Processes  (Step 2a)'!$L74=\"Medium\",'People and Processes  (Step 2a)'!$L74=\"High\"),'People and Processes  (Step 2a)'!$L74,\"\")","v":""},{"$f":"IF(OR('People and Processes  (Step 2a)'!$L74=\"Medium\",'People and Processes  (Step 2a)'!$L74=\"High\"),IF(ISBLANK('People and Processes  (Step 2a)'!$D74), \"\", 'People and Processes  (Step 2a)'!$D74),\"\")","v":""},{"$f":"IF(OR('People and Processes  (Step 2a)'!$L74=\"Medium\",'People and Processes  (Step 2a)'!$L74=\"High\"),'People and Processes  (Step 2a)'!$C74,\"\")","v":""}]
[{"$f":"IF(OR('People and Processes  (Step 2a)'!$L75=\"Medium\",'People and Processes  (Step 2a)'!$L75=\"High\"),'People and Processes  (Step 2a)'!$B75,\"\")","v":""},{"$f":"IF(OR('People and Processes  (Step 2a)'!$L75=\"Medium\",'People and Processes  (Step 2a)'!$L75=\"High\"),'People and Processes  (Step 2a)'!$L75,\"\")","v":""},{"$f":"IF(OR('People and Processes  (Step 2a)'!$L75=\"Medium\",'People and Processes  (Step 2a)'!$L75=\"High\"),IF(ISBLANK('People and Processes  (Step 2a)'!$D75), \"\", 'People and Processes  (Step 2a)'!$D75),\"\")","v":""},{"$f":"IF(OR('People and Processes  (Step 2a)'!$L75=\"Medium\",'People and Processes  (Step 2a)'!$L75=\"High\"),'People and Processes  (Step 2a)'!$C75,\"\")","v":""}]
[{"$f":"IF(OR('People and Processes  (Step 2a)'!$L76=\"Medium\",'People and Processes  (Step 2a)'!$L76=\"High\"),'People and Processes  (Step 2a)'!$B76,\"\")","v":""},{"$f":"IF(OR('People and Processes  (Step 2a)'!$L76=\"Medium\",'People and Processes  (Step 2a)'!$L76=\"High\"),'People and Processes  (Step 2a)'!$L76,\"\")","v":""},{"$f":"IF(OR('People and Processes  (Step 2a)'!$L76=\"Medium\",'People and Processes  (Step 2a)'!$L76=\"High\"),IF(ISBLANK('People and Processes  (Step 2a)'!$D76), \"\", 'People and Processes  (Step 2a)'!$D76),\"\")","v":""},{"$f":"IF(OR('People and Processes  (Step 2a)'!$L76=\"Medium\",'People and Processes  (Step 2a)'!$L76=\"High\"),'People and Processes  (Step 2a)'!$C76,\"\")","v":""}]
[{"$f":"IF(OR('People and Processes  (Step 2a)'!$L77=\"Medium\",'People and Processes  (Step 2a)'!$L77=\"High\"),'People and Processes  (Step 2a)'!$B77,\"\")","v":""},{"$f":"IF(OR('People and Processes  (Step 2a)'!$L77=\"Medium\",'People and Processes  (Step 2a)'!$L77=\"High\"),'People and Processes  (Step 2a)'!$L77,\"\")","v":""},{"$f":"IF(OR('People and Processes  (Step 2a)'!$L77=\"Medium\",'People and Processes  (Step 2a)'!$L77=\"High\"),IF(ISBLANK('People and Processes  (Step 2a)'!$D77), \"\", 'People and Processes  (Step 2a)'!$D77),\"\")","v":""},{"$f":"IF(OR('People and Processes  (Step 2a)'!$L77=\"Medium\",'People and Processes  (Step 2a)'!$L77=\"High\"),'People and Processes  (Step 2a)'!$C77,\"\")","v":""}]
[{"$f":"IF(OR('People and Processes  (Step 2a)'!$L78=\"Medium\",'People and Processes  (Step 2a)'!$L78=\"High\"),'People and Processes  (Step 2a)'!$B78,\"\")","v":""},{"$f":"IF(OR('People and Processes  (Step 2a)'!$L78=\"Medium\",'People and Processes  (Step 2a)'!$L78=\"High\"),'People and Processes  (Step 2a)'!$L78,\"\")","v":""},{"$f":"IF(OR('People and Processes  (Step 2a)'!$L78=\"Medium\",'People and Processes  (Step 2a)'!$L78=\"High\"),IF(ISBLANK('People and Processes  (Step 2a)'!$D78), \"\", 'People and Processes  (Step 2a)'!$D78),\"\")","v":""},{"$f":"IF(OR('People and Processes  (Step 2a)'!$L78=\"Medium\",'People and Processes  (Step 2a)'!$L78=\"High\"),'People and Processes  (Step 2a)'!$C78,\"\")","v":""}]
[{"$f":"IF(OR('People and Processes  (Step 2a)'!$L79=\"Medium\",'People and Processes  (Step 2a)'!$L79=\"High\"),'People and Processes  (Step 2a)'!$B79,\"\")","v":""},{"$f":"IF(OR('People and Processes  (Step 2a)'!$L79=\"Medium\",'People and Processes  (Step 2a)'!$L79=\"High\"),'People and Processes  (Step 2a)'!$L79,\"\")","v":""},{"$f":"IF(OR('People and Processes  (Step 2a)'!$L79=\"Medium\",'People and Processes  (Step 2a)'!$L79=\"High\"),IF(ISBLANK('People and Processes  (Step 2a)'!$D79), \"\", 'People and Processes  (Step 2a)'!$D79),\"\")","v":""},{"$f":"IF(OR('People and Processes  (Step 2a)'!$L79=\"Medium\",'People and Processes  (Step 2a)'!$L79=\"High\"),'People and Processes  (Step 2a)'!$C79,\"\")","v":""}]
[{"$f":"IF(OR('People and Processes  (Step 2a)'!$L80=\"Medium\",'People and Processes  (Step 2a)'!$L80=\"High\"),'People and Processes  (Step 2a)'!$B80,\"\")","v":""},{"$f":"IF(OR('People and Processes  (Step 2a)'!$L80=\"Medium\",'People and Processes  (Step 2a)'!$L80=\"High\"),'People and Processes  (Step 2a)'!$L80,\"\")","v":""},{"$f":"IF(OR('People and Processes  (Step 2a)'!$L80=\"Medium\",'People and Processes  (Step 2a)'!$L80=\"High\"),IF(ISBLANK('People and Processes  (Step 2a)'!$D80), \"\", 'People and Processes  (Step 2a)'!$D80),\"\")","v":""},{"$f":"IF(OR('People and Processes  (Step 2a)'!$L80=\"Medium\",'People and Processes  (Step 2a)'!$L80=\"High\"),'People and Processes  (Step 2a)'!$C80,\"\")","v":""}]
[{"$f":"IF(OR('People and Processes  (Step 2a)'!$L81=\"Medium\",'People and Processes  (Step 2a)'!$L81=\"High\"),'People and Processes  (Step 2a)'!$B81,\"\")","v":""},{"$f":"IF(OR('People and Processes  (Step 2a)'!$L81=\"Medium\",'People and Processes  (Step 2a)'!$L81=\"High\"),'People and Processes  (Step 2a)'!$L81,\"\")","v":""},{"$f":"IF(OR('People and Processes  (Step 2a)'!$L81=\"Medium\",'People and Processes  (Step 2a)'!$L81=\"High\"),IF(ISBLANK('People and Processes  (Step 2a)'!$D81), \"\", 'People and Processes  (Step 2a)'!$D81),\"\")","v":""},{"$f":"IF(OR('People and Processes  (Step 2a)'!$L81=\"Medium\",'People and Processes  (Step 2a)'!$L81=\"High\"),'People and Processes  (Step 2a)'!$C81,\"\")","v":""}]
[{"$f":"IF(OR('People and Processes  (Step 2a)'!$L82=\"Medium\",'People and Processes  (Step 2a)'!$L82=\"High\"),'People and Processes  (Step 2a)'!$B82,\"\")","v":""},{"$f":"IF(OR('People and Processes  (Step 2a)'!$L82=\"Medium\",'People and Processes  (Step 2a)'!$L82=\"High\"),'People and Processes  (Step 2a)'!$L82,\"\")","v":""},{"$f":"IF(OR('People and Processes  (Step 2a)'!$L82=\"Medium\",'People and Processes  (Step 2a)'!$L82=\"High\"),IF(ISBLANK('People and Processes  (Step 2a)'!$D82), \"\", 'People and Processes  (Step 2a)'!$D82),\"\")","v":""},{"$f":"IF(OR('People and Processes  (Step 2a)'!$L82=\"Medium\",'People and Processes  (Step 2a)'!$L82=\"High\"),'People and Processes  (Step 2a)'!$C82,\"\")","v":""}]
[{"$f":"IF(OR('People and Processes  (Step 2a)'!$L83=\"Medium\",'People and Processes  (Step 2a)'!$L83=\"High\"),'People and Processes  (Step 2a)'!$B83,\"\")","v":""},{"$f":"IF(OR('People and Processes  (Step 2a)'!$L83=\"Medium\",'People and Processes  (Step 2a)'!$L83=\"High\"),'People and Processes  (Step 2a)'!$L83,\"\")","v":""},{"$f":"IF(OR('People and Processes  (Step 2a)'!$L83=\"Medium\",'People and Processes  (Step 2a)'!$L83=\"High\"),IF(ISBLANK('People and Processes  (Step 2a)'!$D83), \"\", 'People and Processes  (Step 2a)'!$D83),\"\")","v":""},{"$f":"IF(OR('People and Processes  (Step 2a)'!$L83=\"Medium\",'People and Processes  (Step 2a)'!$L83=\"High\"),'People and Processes  (Step 2a)'!$C83,\"\")","v":""}]
[{"$f":"IF(OR('People and Processes  (Step 2a)'!$L84=\"Medium\",'People and Processes  (Step 2a)'!$L84=\"High\"),'People and Processes  (Step 2a)'!$B84,\"\")","v":""},{"$f":"IF(OR('People and Processes  (Step 2a)'!$L84=\"Medium\",'People and Processes  (Step 2a)'!$L84=\"High\"),'People and Processes  (Step 2a)'!$L84,\"\")","v":""},{"$f":"IF(OR('People and Processes  (Step 2a)'!$L84=\"Medium\",'People and Processes  (Step 2a)'!$L84=\"High\"),IF(ISBLANK('People and Processes  (Step 2a)'!$D84), \"\", 'People and Processes  (Step 2a)'!$D84),\"\")","v":""},{"$f":"IF(OR('People and Processes  (Step 2a)'!$L84=\"Medium\",'People and Processes  (Step 2a)'!$L84=\"High\"),'People and Processes  (Step 2a)'!$C84,\"\")","v":""}]
[{"$f":"IF(OR('People and Processes  (Step 2a)'!$L85=\"Medium\",'People and Processes  (Step 2a)'!$L85=\"High\"),'People and Processes  (Step 2a)'!$B85,\"\")","v":""},{"$f":"IF(OR('People and Processes  (Step 2a)'!$L85=\"Medium\",'People and Processes  (Step 2a)'!$L85=\"High\"),'People and Processes  (Step 2a)'!$L85,\"\")","v":""},{"$f":"IF(OR('People and Processes  (Step 2a)'!$L85=\"Medium\",'People and Processes  (Step 2a)'!$L85=\"High\"),IF(ISBLANK('People and Processes  (Step 2a)'!$D85), \"\", 'People and Processes  (Step 2a)'!$D85),\"\")","v":""},{"$f":"IF(OR('People and Processes  (Step 2a)'!$L85=\"Medium\",'People and Processes  (Step 2a)'!$L85=\"High\"),'People and Processes  (Step 2a)'!$C85,\"\")","v":""}]
[{"$f":"IF(OR('People and Processes  (Step 2a)'!$L86=\"Medium\",'People and Processes  (Step 2a)'!$L86=\"High\"),'People and Processes  (Step 2a)'!$B86,\"\")","v":""},{"$f":"IF(OR('People and Processes  (Step 2a)'!$L86=\"Medium\",'People and Processes  (Step 2a)'!$L86=\"High\"),'People and Processes  (Step 2a)'!$L86,\"\")","v":""},{"$f":"IF(OR('People and Processes  (Step 2a)'!$L86=\"Medium\",'People and Processes  (Step 2a)'!$L86=\"High\"),IF(ISBLANK('People and Processes  (Step 2a)'!$D86), \"\", 'People and Processes  (Step 2a)'!$D86),\"\")","v":""},{"$f":"IF(OR('People and Processes  (Step 2a)'!$L86=\"Medium\",'People and Processes  (Step 2a)'!$L86=\"High\"),'People and Processes  (Step 2a)'!$C86,\"\")","v":""}]
[{"$f":"IF(OR('People and Processes  (Step 2a)'!$L87=\"Medium\",'People and Processes  (Step 2a)'!$L87=\"High\"),'People and Processes  (Step 2a)'!$B87,\"\")","v":""},{"$f":"IF(OR('People and Processes  (Step 2a)'!$L87=\"Medium\",'People and Processes  (Step 2a)'!$L87=\"High\"),'People and Processes  (Step 2a)'!$L87,\"\")","v":""},{"$f":"IF(OR('People and Processes  (Step 2a)'!$L87=\"Medium\",'People and Processes  (Step 2a)'!$L87=\"High\"),IF(ISBLANK('People and Processes  (Step 2a)'!$D87), \"\", 'People and Processes  (Step 2a)'!$D87),\"\")","v":""},{"$f":"IF(OR('People and Processes  (Step 2a)'!$L87=\"Medium\",'People and Processes  (Step 2a)'!$L87=\"High\"),'People and Processes  (Step 2a)'!$C87,\"\")","v":""}]
[{"$f":"IF(OR('People and Processes  (Step 2a)'!$L88=\"Medium\",'People and Processes  (Step 2a)'!$L88=\"High\"),'People and Processes  (Step 2a)'!$B88,\"\")","v":""},{"$f":"IF(OR('People and Processes  (Step 2a)'!$L88=\"Medium\",'People and Processes  (Step 2a)'!$L88=\"High\"),'People and Processes  (Step 2a)'!$L88,\"\")","v":""},{"$f":"IF(OR('People and Processes  (Step 2a)'!$L88=\"Medium\",'People and Processes  (Step 2a)'!$L88=\"High\"),IF(ISBLANK('People and Processes  (Step 2a)'!$D88), \"\", 'People and Processes  (Step 2a)'!$D88),\"\")","v":""},{"$f":"IF(OR('People and Processes  (Step 2a)'!$L88=\"Medium\",'People and Processes  (Step 2a)'!$L88=\"High\"),'People and Processes  (Step 2a)'!$C88,\"\")","v":""}]
[{"$f":"IF(OR('People and Processes  (Step 2a)'!$L89=\"Medium\",'People and Processes  (Step 2a)'!$L89=\"High\"),'People and Processes  (Step 2a)'!$B89,\"\")","v":""},{"$f":"IF(OR('People and Processes  (Step 2a)'!$L89=\"Medium\",'People and Processes  (Step 2a)'!$L89=\"High\"),'People and Processes  (Step 2a)'!$L89,\"\")","v":""},{"$f":"IF(OR('People and Processes  (Step 2a)'!$L89=\"Medium\",'People and Processes  (Step 2a)'!$L89=\"High\"),IF(ISBLANK('People and Processes  (Step 2a)'!$D89), \"\", 'People and Processes  (Step 2a)'!$D89),\"\")","v":""},{"$f":"IF(OR('People and Processes  (Step 2a)'!$L89=\"Medium\",'People and Processes  (Step 2a)'!$L89=\"High\"),'People and Processes  (Step 2a)'!$C89,\"\")","v":""}]
[{"$f":"IF(OR('People and Processes  (Step 2a)'!$L90=\"Medium\",'People and Processes  (Step 2a)'!$L90=\"High\"),'People and Processes  (Step 2a)'!$B90,\"\")","v":""},{"$f":"IF(OR('People and Processes  (Step 2a)'!$L90=\"Medium\",'People and Processes  (Step 2a)'!$L90=\"High\"),'People and Processes  (Step 2a)'!$L90,\"\")","v":""},{"$f":"IF(OR('People and Processes  (Step 2a)'!$L90=\"Medium\",'People and Processes  (Step 2a)'!$L90=\"High\"),IF(ISBLANK('People and Processes  (Step 2a)'!$D90), \"\", 'People and Processes  (Step 2a)'!$D90),\"\")","v":""},{"$f":"IF(OR('People and Processes  (Step 2a)'!$L90=\"Medium\",'People and Processes  (Step 2a)'!$L90=\"High\"),'People and Processes  (Step 2a)'!$C90,\"\")","v":""}]
[{"$f":"IF(OR('People and Processes  (Step 2a)'!$L91=\"Medium\",'People and Processes  (Step 2a)'!$L91=\"High\"),'People and Processes  (Step 2a)'!$B91,\"\")","v":""},{"$f":"IF(OR('People and Processes  (Step 2a)'!$L91=\"Medium\",'People and Processes  (Step 2a)'!$L91=\"High\"),'People and Processes  (Step 2a)'!$L91,\"\")","v":""},{"$f":"IF(OR('People and Processes  (Step 2a)'!$L91=\"Medium\",'People and Processes  (Step 2a)'!$L91=\"High\"),IF(ISBLANK('People and Processes  (Step 2a)'!$D91), \"\", 'People and Processes  (Step 2a)'!$D91),\"\")","v":""},{"$f":"IF(OR('People and Processes  (Step 2a)'!$L91=\"Medium\",'People and Processes  (Step 2a)'!$L91=\"High\"),'People and Processes  (Step 2a)'!$C91,\"\")","v":""}]
[null,{"$f":"IF(OR('People and Processes  (Step 2a)'!$L92=\"Medium\",'People and Processes  (Step 2a)'!$L92=\"High\"),'People and Processes  (Step 2a)'!$L92,\"\")","v":""},{"$f":"IF(OR('People and Processes  (Step 2a)'!$L92=\"Medium\",'People and Processes  (Step 2a)'!$L92=\"High\"),IF(ISBLANK('People and Processes  (Step 2a)'!$D92), \"\", 'People and Processes  (Step 2a)'!$D92),\"\")","v":""},{"$f":"IF(OR('People and Processes  (Step 2a)'!$L92=\"Medium\",'People and Processes  (Step 2a)'!$L92=\"High\"),'People and Processes  (Step 2a)'!$C92,\"\")","v":""}]
["Technology"]
[{"$f":"IF(OR('Technology (Step 2b)'!$L35=\"Medium\",'Technology (Step 2b)'!$L35=\"High\"),'Technology (Step 2b)'!$B35,\"\")","v":"Security breaches occur when dealing with third parties due to a lack of security considerations in the related third party agreement. [TVS002]"},{"$f":"IF(OR('Technology (Step 2b)'!$L35=\"Medium\",'Technology (Step 2b)'!$L35=\"High\"),'Technology (Step 2b)'!$L35,\"\")","v":"Medium"},{"$f":"IF(OR('Technology (Step 2b)'!$L35=\"Medium\",'Technology (Step 2b)'!$L35=\"High\"),IF(ISBLANK('Technology (Step 2b)'!$D35), \"\", 'Technology (Step 2b)'!$D35),\"\")","v":0},{"$f":"IF(OR('Technology (Step 2b)'!$L35=\"Medium\",'Technology (Step 2b)'!$L35=\"High\"),'Technology (Step 2b)'!$C35,\"\")","v":"Agreements with third parties, such as IT vendors,  which involve accessing, processing, communicating with or managing the organization's information or information processing facilities, or adding products or services to information processing facilities cover all relevant security requirements.\nContracts between business associates and covered entities address administrative, physical, and technical safeguards that reasonably and appropriately protect the confidentiality, integrity, and availability of information. [RCM002]\n - Controls should be in place to help monitor any access by third parties. This can include the regular review of VPN logs, EHR logs, server logs, etc. \n - Automated alerts when certain criteria is met within a system can greatly help monitor third party connections to internal systems."}]
[{"$f":"IF(OR('Technology (Step 2b)'!$L36=\"Medium\",'Technology (Step 2b)'!$L36=\"High\"),'Technology (Step 2b)'!$B36,\"\")","v":"Information around risks and related control options are not presented to management before management decisions are made. [TVS004]"},{"$f":"IF(OR('Technology (Step 2b)'!$L36=\"Medium\",'Technology (Step 2b)'!$L36=\"High\"),'Technology (Step 2b)'!$L36,\"\")","v":"Medium"},{"$f":"IF(OR('Technology (Step 2b)'!$L36=\"Medium\",'Technology (Step 2b)'!$L36=\"High\"),IF(ISBLANK('Technology (Step 2b)'!$D36), \"\", 'Technology (Step 2b)'!$D36),\"\")","v":" - No regular assessments of technology is performed; including vulnerability testing, patch management, or other review of systems to help determine risks associated with them so appropriate action(s) can be taken."},{"$f":"IF(OR('Technology (Step 2b)'!$L36=\"Medium\",'Technology (Step 2b)'!$L36=\"High\"),'Technology (Step 2b)'!$C36,\"\")","v":"Risk assessments are conducted to identify, quantify, prioritize and manage risks.  The prioritization is accomplished by creating and using criteria for risk acceptance and objectives which are important to the organization. [RCM004]\n - It is important to expand upon this risk assessment by assessing the risk of each asset itself."}]
[{"$f":"IF(OR('Technology (Step 2b)'!$L37=\"Medium\",'Technology (Step 2b)'!$L37=\"High\"),'Technology (Step 2b)'!$B37,\"\")","v":""},{"$f":"IF(OR('Technology (Step 2b)'!$L37=\"Medium\",'Technology (Step 2b)'!$L37=\"High\"),'Technology (Step 2b)'!$L37,\"\")","v":""},{"$f":"IF(OR('Technology (Step 2b)'!$L37=\"Medium\",'Technology (Step 2b)'!$L37=\"High\"),IF(ISBLANK('Technology (Step 2b)'!$D37), \"\", 'Technology (Step 2b)'!$D37),\"\")","v":""},{"$f":"IF(OR('Technology (Step 2b)'!$L37=\"Medium\",'Technology (Step 2b)'!$L37=\"High\"),'Technology (Step 2b)'!$C37,\"\")","v":""}]
[{"$f":"IF(OR('Technology (Step 2b)'!$L38=\"Medium\",'Technology (Step 2b)'!$L38=\"High\"),'Technology (Step 2b)'!$B38,\"\")","v":""},{"$f":"IF(OR('Technology (Step 2b)'!$L38=\"Medium\",'Technology (Step 2b)'!$L38=\"High\"),'Technology (Step 2b)'!$L38,\"\")","v":""},{"$f":"IF(OR('Technology (Step 2b)'!$L38=\"Medium\",'Technology (Step 2b)'!$L38=\"High\"),IF(ISBLANK('Technology (Step 2b)'!$D38), \"\", 'Technology (Step 2b)'!$D38),\"\")","v":""},{"$f":"IF(OR('Technology (Step 2b)'!$L38=\"Medium\",'Technology (Step 2b)'!$L38=\"High\"),'Technology (Step 2b)'!$C38,\"\")","v":""}]
[{"$f":"IF(OR('Technology (Step 2b)'!$L39=\"Medium\",'Technology (Step 2b)'!$L39=\"High\"),'Technology (Step 2b)'!$B39,\"\")","v":""},{"$f":"IF(OR('Technology (Step 2b)'!$L39=\"Medium\",'Technology (Step 2b)'!$L39=\"High\"),'Technology (Step 2b)'!$L39,\"\")","v":""},{"$f":"IF(OR('Technology (Step 2b)'!$L39=\"Medium\",'Technology (Step 2b)'!$L39=\"High\"),IF(ISBLANK('Technology (Step 2b)'!$D39), \"\", 'Technology (Step 2b)'!$D39),\"\")","v":""},{"$f":"IF(OR('Technology (Step 2b)'!$L39=\"Medium\",'Technology (Step 2b)'!$L39=\"High\"),'Technology (Step 2b)'!$C39,\"\")","v":""}]
[{"$f":"IF(OR('Technology (Step 2b)'!$L40=\"Medium\",'Technology (Step 2b)'!$L40=\"High\"),'Technology (Step 2b)'!$B40,\"\")","v":"Unauthorized parties gain physical access to facilities due to insufficient physical entry/exit controls. [TVS010]"},{"$f":"IF(OR('Technology (Step 2b)'!$L40=\"Medium\",'Technology (Step 2b)'!$L40=\"High\"),'Technology (Step 2b)'!$L40,\"\")","v":"High"},{"$f":"IF(OR('Technology (Step 2b)'!$L40=\"Medium\",'Technology (Step 2b)'!$L40=\"High\"),IF(ISBLANK('Technology (Step 2b)'!$D40), \"\", 'Technology (Step 2b)'!$D40),\"\")","v":" - Workstations/Laptops/Tablets\nPositioning?\nPrivacy screens used?\nCable locks used?\n\n - Server Room\nServer room location?\nLocked at all times?\nProper cooling?\nBattery backup?\nFire suppression?\n\n - Network Closet\nLocked at all times?\nProper cooling?\nBattery backup?\n\n - Building\nEmergency lighting?\nFire detection?\nFire suppression?\nBack door remains locked?\nOther doors remain locked? \nWater shut-off valves?\nEmergency power shut-off?\nBuilding alarm system?"},{"$f":"IF(OR('Technology (Step 2b)'!$L40=\"Medium\",'Technology (Step 2b)'!$L40=\"High\"),'Technology (Step 2b)'!$C40,\"\")","v":"A facility security plan is implemented, which protects the facility with appropriate entry/exit controls to ensure that only authorized personnel are allowed access, removal of equipment from the facility is restricted to authorized individuals, and repair/modification of physical components of the facility are documented and monitored. Workstations are protected from removal by unauthorized individuals.  A contingency plan is implemented for permitting and enabling physical access to alternate authorized individuals (e.g. in the event primary authorized individuals are sick or not available). [RCM010]\n - The server room should be secured to ensure physical access is available for only authorized individuals. This can include all doors to the servers to be locked at all time and any windows secured/monitored.\n - Best practice to ensure proper temperature and humidity for both server and wiring rooms.\n - Wiring closets that contain switches, routers, and other networking equipment should also remain locked and accessible by only authorized individuals.\n - The use of cable locks can help prevent theft of mobile devices (laptops) and privacy screens can help prevent unauthorized viewing of computer screens/monitors"}]
[{"$f":"IF(OR('Technology (Step 2b)'!$L41=\"Medium\",'Technology (Step 2b)'!$L41=\"High\"),'Technology (Step 2b)'!$B41,\"\")","v":"Sensitive systems co-located with less sensitive systems are accessed by unauthorized parties. [TVS011]"},{"$f":"IF(OR('Technology (Step 2b)'!$L41=\"Medium\",'Technology (Step 2b)'!$L41=\"High\"),'Technology (Step 2b)'!$L41,\"\")","v":"Medium"},{"$f":"IF(OR('Technology (Step 2b)'!$L41=\"Medium\",'Technology (Step 2b)'!$L41=\"High\"),IF(ISBLANK('Technology (Step 2b)'!$D41), \"\", 'Technology (Step 2b)'!$D41),\"\")","v":" - Network Configuration\nFirewall in place?\nWireless encryption?\nRemote access type?\nRemote access encryption?"},{"$f":"IF(OR('Technology (Step 2b)'!$L41=\"Medium\",'Technology (Step 2b)'!$L41=\"High\"),'Technology (Step 2b)'!$C41,\"\")","v":"If possible sensitive systems have a dedicated, and isolated, computing environment. [RCM011]\n - Verify and ensure firewall capabilities exist between the public Internet and internal network beyond the basic port blocking and NATing functions of the Cisco router.\n"}]
[{"$f":"IF(OR('Technology (Step 2b)'!$L42=\"Medium\",'Technology (Step 2b)'!$L42=\"High\"),'Technology (Step 2b)'!$B42,\"\")","v":""},{"$f":"IF(OR('Technology (Step 2b)'!$L42=\"Medium\",'Technology (Step 2b)'!$L42=\"High\"),'Technology (Step 2b)'!$L42,\"\")","v":""},{"$f":"IF(OR('Technology (Step 2b)'!$L42=\"Medium\",'Technology (Step 2b)'!$L42=\"High\"),IF(ISBLANK('Technology (Step 2b)'!$D42), \"\", 'Technology (Step 2b)'!$D42),\"\")","v":""},{"$f":"IF(OR('Technology (Step 2b)'!$L42=\"Medium\",'Technology (Step 2b)'!$L42=\"High\"),'Technology (Step 2b)'!$C42,\"\")","v":""}]
[{"$f":"IF(OR('Technology (Step 2b)'!$L43=\"Medium\",'Technology (Step 2b)'!$L43=\"High\"),'Technology (Step 2b)'!$B43,\"\")","v":"Technical vulnerabilities are exploited to gain inappropriate or unauthorized access to information systems due to lack of controls for those vulnerabilities. [TVS013]"},{"$f":"IF(OR('Technology (Step 2b)'!$L43=\"Medium\",'Technology (Step 2b)'!$L43=\"High\"),'Technology (Step 2b)'!$L43,\"\")","v":"High"},{"$f":"IF(OR('Technology (Step 2b)'!$L43=\"Medium\",'Technology (Step 2b)'!$L43=\"High\"),IF(ISBLANK('Technology (Step 2b)'!$D43), \"\", 'Technology (Step 2b)'!$D43),\"\")","v":" - No vulnerability testing currently being performed internally or from a third party"},{"$f":"IF(OR('Technology (Step 2b)'!$L43=\"Medium\",'Technology (Step 2b)'!$L43=\"High\"),'Technology (Step 2b)'!$C43,\"\")","v":"Timely information about technical vulnerabilities of information systems being used is obtained, the organization's exposure to the vulnerabilities is evaluated and appropriate measures are taken to address the associated risk. [RCM013]\n - Regular vulnerability testing can be performed using free or commercial scanning tools. The results provide information about technical vulnerabilities that may need to be addressed within the systems.\nExample tools include: Microsoft Baseline Security Analyzer, Nessus, and nmap.\n - Vulnerability assessments should include servers, workstations, switches, firewalls, routers, etc. to ensure all entry points within the systems are assessed for vulnerabilities."}]
[{"$f":"IF(OR('Technology (Step 2b)'!$L44=\"Medium\",'Technology (Step 2b)'!$L44=\"High\"),'Technology (Step 2b)'!$B44,\"\")","v":"Unauthorized access is given to information over third party connections. [TVS014]"},{"$f":"IF(OR('Technology (Step 2b)'!$L44=\"Medium\",'Technology (Step 2b)'!$L44=\"High\"),'Technology (Step 2b)'!$L44,\"\")","v":"High"},{"$f":"IF(OR('Technology (Step 2b)'!$L44=\"Medium\",'Technology (Step 2b)'!$L44=\"High\"),IF(ISBLANK('Technology (Step 2b)'!$D44), \"\", 'Technology (Step 2b)'!$D44),\"\")","v":0},{"$f":"IF(OR('Technology (Step 2b)'!$L44=\"Medium\",'Technology (Step 2b)'!$L44=\"High\"),'Technology (Step 2b)'!$C44,\"\")","v":"A formal process is in place to control all external third party network connections. [RCM014]\n - Reviewing of logs from the EHR, servers, networking systems, etc. should be reviewed on a regular basis whether automated or reviewed manually. \n - Network connections from third party could also be restricted to business hours or activated upon request to help control the connections."}]
[{"$f":"IF(OR('Technology (Step 2b)'!$L45=\"Medium\",'Technology (Step 2b)'!$L45=\"High\"),'Technology (Step 2b)'!$B45,\"\")","v":"Unauthorized access is gained to information systems. [TVS015]"},{"$f":"IF(OR('Technology (Step 2b)'!$L45=\"Medium\",'Technology (Step 2b)'!$L45=\"High\"),'Technology (Step 2b)'!$L45,\"\")","v":"High"},{"$f":"IF(OR('Technology (Step 2b)'!$L45=\"Medium\",'Technology (Step 2b)'!$L45=\"High\"),IF(ISBLANK('Technology (Step 2b)'!$D45), \"\", 'Technology (Step 2b)'!$D45),\"\")","v":" - EHR Password Security\nPassword Change?\nMinimum Length?\nComplexity?\nPassword History?\nLockout?\n\n - Windows Password Security\nPassword Change?\nMinimum Length?\nComplexity?\nPassword History?\nLockout?\n\n - Auto Logoff\nEHR?\nWindows?\n\n- Servers/Network Devices\nDefault Admin passwords have been changed?"},{"$f":"IF(OR('Technology (Step 2b)'!$L45=\"Medium\",'Technology (Step 2b)'!$L45=\"High\"),'Technology (Step 2b)'!$C45,\"\")","v":"Formal procedures should be in place to control the allocation of access rights to information systems and services. [RCM015]\n - It's good practice to limit access rights to local workstations by using Restricted User access rights for each authorized user to help control the installation of software as well as to help minimize the impact of malware\n - Passwords should be changed regularly, i.e. 30, 60, or 90 days\n - Minimum password length should be enforced, i.e. 8 characters long\n - Password complexity and history of previously used passwords should also be enforced, i.e. passwords to contain uppercase and lowercase letters and numbers as well as not being able to reuse the last x amount of passwords\n - Auto logoff should be enforced within the EHR to help prevent unauthorized access if the user walks away from the system, i.e. 15 minutes of inactivity\n - Auto screenlock should also be enforced on the workstations and servers to help prevent unauthorized access if the user walks away from the system, i.e. 15 minutes of inactivity\n - Remote connectivity should be accomplished through secure connections including, SSL/TLS, IPSec VPN tunnels, or other secure methods. The use of Remote Desktop external from the network through port forwarding can introduce various vulnerabilities."}]
[{"$f":"IF(OR('Technology (Step 2b)'!$L46=\"Medium\",'Technology (Step 2b)'!$L46=\"High\"),'Technology (Step 2b)'!$B46,\"\")","v":"Unauthorized users are able to gain access to operating systems by claiming to be an authorized user. [TVS016]"},{"$f":"IF(OR('Technology (Step 2b)'!$L46=\"Medium\",'Technology (Step 2b)'!$L46=\"High\"),'Technology (Step 2b)'!$L46,\"\")","v":"High"},{"$f":"IF(OR('Technology (Step 2b)'!$L46=\"Medium\",'Technology (Step 2b)'!$L46=\"High\"),IF(ISBLANK('Technology (Step 2b)'!$D46), \"\", 'Technology (Step 2b)'!$D46),\"\")","v":" - Unique user ID's are utilized within the EHR.\n - However, user ID's are NOT unique for workstation access"},{"$f":"IF(OR('Technology (Step 2b)'!$L46=\"Medium\",'Technology (Step 2b)'!$L46=\"High\"),'Technology (Step 2b)'!$C46,\"\")","v":"All users are assigned a unique identifier (user ID) for their business use.  This unique ID shall be used exclusively on computing systems within the medical practice which process EPHI, and a suitable authentication technique is chosen to validate the identity of a user. [RCM016]\n - Access to local workstations and other systems should also have unique user ID's and passwords in addition to the EHR itself"}]
[{"$f":"IF(OR('Technology (Step 2b)'!$L47=\"Medium\",'Technology (Step 2b)'!$L47=\"High\"),'Technology (Step 2b)'!$B47,\"\")","v":"Users that no longer have a business need for information systems access still have access to the information. [TVS017]"},{"$f":"IF(OR('Technology (Step 2b)'!$L47=\"Medium\",'Technology (Step 2b)'!$L47=\"High\"),'Technology (Step 2b)'!$L47,\"\")","v":"Medium"},{"$f":"IF(OR('Technology (Step 2b)'!$L47=\"Medium\",'Technology (Step 2b)'!$L47=\"High\"),IF(ISBLANK('Technology (Step 2b)'!$D47), \"\", 'Technology (Step 2b)'!$D47),\"\")","v":" - No regular review of accounts currently being performed within the EHR, servers, and other systems."},{"$f":"IF(OR('Technology (Step 2b)'!$L47=\"Medium\",'Technology (Step 2b)'!$L47=\"High\"),'Technology (Step 2b)'!$C47,\"\")","v":"Management reviews and makes the appropriate corrections to the access right(s) of individual users at regular intervals using a formal process¹. [RCM017]\n - Reviewing of user accounts could be accomplished on a regular basis by comparing HR active employee lists to the lists within the EHR and other systems."}]
[{"$f":"IF(OR('Technology (Step 2b)'!$L48=\"Medium\",'Technology (Step 2b)'!$L48=\"High\"),'Technology (Step 2b)'!$B48,\"\")","v":""},{"$f":"IF(OR('Technology (Step 2b)'!$L48=\"Medium\",'Technology (Step 2b)'!$L48=\"High\"),'Technology (Step 2b)'!$L48,\"\")","v":""},{"$f":"IF(OR('Technology (Step 2b)'!$L48=\"Medium\",'Technology (Step 2b)'!$L48=\"High\"),IF(ISBLANK('Technology (Step 2b)'!$D48), \"\", 'Technology (Step 2b)'!$D48),\"\")","v":""},{"$f":"IF(OR('Technology (Step 2b)'!$L48=\"Medium\",'Technology (Step 2b)'!$L48=\"High\"),'Technology (Step 2b)'!$C48,\"\")","v":""}]
[{"$f":"IF(OR('Technology (Step 2b)'!$L49=\"Medium\",'Technology (Step 2b)'!$L49=\"High\"),'Technology (Step 2b)'!$B49,\"\")","v":"Unauthorized information processing activities occur undetected due to lack of consistent logging and monitoring activities. [TVS019]"},{"$f":"IF(OR('Technology (Step 2b)'!$L49=\"Medium\",'Technology (Step 2b)'!$L49=\"High\"),'Technology (Step 2b)'!$L49,\"\")","v":"High"},{"$f":"IF(OR('Technology (Step 2b)'!$L49=\"Medium\",'Technology (Step 2b)'!$L49=\"High\"),IF(ISBLANK('Technology (Step 2b)'!$D49), \"\", 'Technology (Step 2b)'!$D49),\"\")","v":0},{"$f":"IF(OR('Technology (Step 2b)'!$L49=\"Medium\",'Technology (Step 2b)'!$L49=\"High\"),'Technology (Step 2b)'!$C49,\"\")","v":"Policies and procedures for information system monitoring have been established and implemented.  This is done to institute consistency and standards in computer activity logging, computer activity monitoring and reporting of any system events. [RCM019]\n - Reviewing of logs from the EHR, servers, networking systems, etc. should be reviewed on a regular basis whether automated or reviewed manually. \n - Network connections from third party could also be restricted to business hours or activated upon request to help control the connections."}]
[{"$f":"IF(OR('Technology (Step 2b)'!$L50=\"Medium\",'Technology (Step 2b)'!$L50=\"High\"),'Technology (Step 2b)'!$B50,\"\")","v":"Media (e.g., documents, computer media (e.g. tapes, disks), input/output data, system documentation) is compromised by unauthorized parties due to ineffective handling procedures. [TVS020]"},{"$f":"IF(OR('Technology (Step 2b)'!$L50=\"Medium\",'Technology (Step 2b)'!$L50=\"High\"),'Technology (Step 2b)'!$L50,\"\")","v":"High"},{"$f":"IF(OR('Technology (Step 2b)'!$L50=\"Medium\",'Technology (Step 2b)'!$L50=\"High\"),IF(ISBLANK('Technology (Step 2b)'!$D50), \"\", 'Technology (Step 2b)'!$D50),\"\")","v":" - Backups\nAre backups encrypted?"},{"$f":"IF(OR('Technology (Step 2b)'!$L50=\"Medium\",'Technology (Step 2b)'!$L50=\"High\"),'Technology (Step 2b)'!$C50,\"\")","v":"Operating procedures are established to protect documents, computer media (e.g., tapes, disks), input/output data and system documentation.  This is done to protect sensitive information from unauthorized disclosure, modification, removal, and destruction. [RCM020]\n - The use of encryption that follows NIST 800-11 is recommended\n - Encryption of the EHR database should be considered as well as any file servers that contain ePHI\n - Utilizing full disk encryption on all desktops, laptops, USB drives, backup tapes, and/or other mobile devices can also help prevent unauthorized access to data if lost or stolen.\n - The use of encryption can help give \"safe harbor\" from breach notification the encrypted media becomes lost or stolen"}]
[{"$f":"IF(OR('Technology (Step 2b)'!$L51=\"Medium\",'Technology (Step 2b)'!$L51=\"High\"),'Technology (Step 2b)'!$B51,\"\")","v":""},{"$f":"IF(OR('Technology (Step 2b)'!$L51=\"Medium\",'Technology (Step 2b)'!$L51=\"High\"),'Technology (Step 2b)'!$L51,\"\")","v":""},{"$f":"IF(OR('Technology (Step 2b)'!$L51=\"Medium\",'Technology (Step 2b)'!$L51=\"High\"),IF(ISBLANK('Technology (Step 2b)'!$D51), \"\", 'Technology (Step 2b)'!$D51),\"\")","v":""},{"$f":"IF(OR('Technology (Step 2b)'!$L51=\"Medium\",'Technology (Step 2b)'!$L51=\"High\"),'Technology (Step 2b)'!$C51,\"\")","v":""}]
[{"$f":"IF(OR('Technology (Step 2b)'!$L52=\"Medium\",'Technology (Step 2b)'!$L52=\"High\"),'Technology (Step 2b)'!$B52,\"\")","v":"The change management process in place does not adequately protect the environment from disruptive changes in production. [TVS024]"},{"$f":"IF(OR('Technology (Step 2b)'!$L52=\"Medium\",'Technology (Step 2b)'!$L52=\"High\"),'Technology (Step 2b)'!$L52,\"\")","v":"Medium"},{"$f":"IF(OR('Technology (Step 2b)'!$L52=\"Medium\",'Technology (Step 2b)'!$L52=\"High\"),IF(ISBLANK('Technology (Step 2b)'!$D52), \"\", 'Technology (Step 2b)'!$D52),\"\")","v":" - No internal tracking or reporting of changes to the systems\n - EHR vendor does keep records of any changes performed through the use of their ticketing system\n\n - Windows Updates\nWorkstations update automatically?\nServers are updated regularly?"},{"$f":"IF(OR('Technology (Step 2b)'!$L52=\"Medium\",'Technology (Step 2b)'!$L52=\"High\"),'Technology (Step 2b)'!$C52,\"\")","v":"Formal 'change policies and procedures'  have been established to manage the implementation of changes to assure the adherence to standards and security practices. [RCM024]\n - It is recommended to have all changes recorded and tracked. This is usually accomplished through a helpdesk ticket system or even through the use of a database or Excel spreadsheet in some cases. Appendix G of the information security policy template provided by the REC contains a Change Management Tracking Log that can help in this area."}]
[{"$f":"IF(OR('Technology (Step 2b)'!$L53=\"Medium\",'Technology (Step 2b)'!$L53=\"High\"),'Technology (Step 2b)'!$B53,\"\")","v":"Security incidents are not managed with a consistent and effective approach. [TVS025]"},{"$f":"IF(OR('Technology (Step 2b)'!$L53=\"Medium\",'Technology (Step 2b)'!$L53=\"High\"),'Technology (Step 2b)'!$L53,\"\")","v":"Medium"},{"$f":"IF(OR('Technology (Step 2b)'!$L53=\"Medium\",'Technology (Step 2b)'!$L53=\"High\"),IF(ISBLANK('Technology (Step 2b)'!$D53), \"\", 'Technology (Step 2b)'!$D53),\"\")","v":"\n - No incident management tracking / reporting software is being utilized"},{"$f":"IF(OR('Technology (Step 2b)'!$L53=\"Medium\",'Technology (Step 2b)'!$L53=\"High\"),'Technology (Step 2b)'!$C53,\"\")","v":"A consistent approach to managing information security incidents, consistent with applicable law, is in place to handle information security events and weaknesses once they are reported. Activities such as incident reporting, organizational response, relocation of operations, evidence collection and system recovery are all components of incident response. [RCM025]\n - An incident response plan should include how evidence is collected, whether performed internally or from a third party.\n - The ability to track and report on incidents is recommended\n - Incident response plans should be tested regularly (i.e. annually).\n - The Information Security Policy template provided by the REC contains a Security Incident Log in Appendix E that can help in this area."}]
[{"$f":"IF(OR('Technology (Step 2b)'!$L54=\"Medium\",'Technology (Step 2b)'!$L54=\"High\"),'Technology (Step 2b)'!$B54,\"\")","v":"Information systems cannot be recovered due to a lack of written disaster recovery plans. [TVS026]"},{"$f":"IF(OR('Technology (Step 2b)'!$L54=\"Medium\",'Technology (Step 2b)'!$L54=\"High\"),'Technology (Step 2b)'!$L54,\"\")","v":"Medium"},{"$f":"IF(OR('Technology (Step 2b)'!$L54=\"Medium\",'Technology (Step 2b)'!$L54=\"High\"),IF(ISBLANK('Technology (Step 2b)'!$D54), \"\", 'Technology (Step 2b)'!$D54),\"\")","v":" -EHR backup services are utilized for secure offsite backups of the database.\n - Test restore of backups are periodically completed especially as needed but not consistently tested on a regular basis\n - No alternate facility available to recover from a disaster"},{"$f":"IF(OR('Technology (Step 2b)'!$L54=\"Medium\",'Technology (Step 2b)'!$L54=\"High\"),'Technology (Step 2b)'!$C54,\"\")","v":"Backup and Recovery plans are documented, distributed through the organization and easily obtained by office personnel in the event that an event occurs. The DR Plan must identify the required actions to undertake following interruption to, or failure of, critical IT systems. [RCM026]\n - Backups should be tested regularly and is a good practice to document each test\n - A Disaster Recovery Plan (DRP) should also be tested regularly (i.e. annually).\n - It is recommended that all backups be encrypted utilizing NIST 800-111 for guidance\n - Full backups should be taken offsite at least once a week and stored at a secure location"}]
[{"$f":"IF(OR('Technology (Step 2b)'!$L55=\"Medium\",'Technology (Step 2b)'!$L55=\"High\"),'Technology (Step 2b)'!$B55,\"\")","v":""},{"$f":"IF(OR('Technology (Step 2b)'!$L55=\"Medium\",'Technology (Step 2b)'!$L55=\"High\"),'Technology (Step 2b)'!$L55,\"\")","v":""},{"$f":"IF(OR('Technology (Step 2b)'!$L91=\"Medium\",'Technology (Step 2b)'!$L91=\"High\"),IF(ISBLANK('Technology (Step 2b)'!$D91), \"\", 'Technology (Step 2b)'!$D91),\"\")","v":""},{"$f":"IF(OR('Technology (Step 2b)'!$L91=\"Medium\",'Technology (Step 2b)'!$L91=\"High\"),'Technology (Step 2b)'!$C91,\"\")","v":""}]
[{"$f":"IF(OR('Technology (Step 2b)'!$L56=\"Medium\",'Technology (Step 2b)'!$L56=\"High\"),'Technology (Step 2b)'!$B56,\"\")","v":""},{"$f":"IF(OR('Technology (Step 2b)'!$L56=\"Medium\",'Technology (Step 2b)'!$L56=\"High\"),'Technology (Step 2b)'!$L56,\"\")","v":""},{"$f":"IF(OR('Technology (Step 2b)'!$L92=\"Medium\",'Technology (Step 2b)'!$L92=\"High\"),IF(ISBLANK('Technology (Step 2b)'!$D92), \"\", 'Technology (Step 2b)'!$D92),\"\")","v":""},{"$f":"IF(OR('Technology (Step 2b)'!$L92=\"Medium\",'Technology (Step 2b)'!$L92=\"High\"),'Technology (Step 2b)'!$C92,\"\")","v":""}]
[{"$f":"IF(OR('Technology (Step 2b)'!$L57=\"Medium\",'Technology (Step 2b)'!$L57=\"High\"),'Technology (Step 2b)'!$B57,\"\")","v":""},{"$f":"IF(OR('Technology (Step 2b)'!$L57=\"Medium\",'Technology (Step 2b)'!$L57=\"High\"),'Technology (Step 2b)'!$L57,\"\")","v":""},{"$f":"IF(OR('Technology (Step 2b)'!$L93=\"Medium\",'Technology (Step 2b)'!$L93=\"High\"),IF(ISBLANK('Technology (Step 2b)'!$D93), \"\", 'Technology (Step 2b)'!$D93),\"\")","v":""},{"$f":"IF(OR('Technology (Step 2b)'!$L93=\"Medium\",'Technology (Step 2b)'!$L93=\"High\"),'Technology (Step 2b)'!$C93,\"\")","v":""}]
[{"$f":"IF(OR('Technology (Step 2b)'!$L59=\"Medium\",'Technology (Step 2b)'!$L59=\"High\"),'Technology (Step 2b)'!$B59,\"\")","v":""},{"$f":"IF(OR('Technology (Step 2b)'!$L59=\"Medium\",'Technology (Step 2b)'!$L59=\"High\"),'Technology (Step 2b)'!$L59,\"\")","v":""},{"$f":"IF(OR('Technology (Step 2b)'!$L94=\"Medium\",'Technology (Step 2b)'!$L94=\"High\"),IF(ISBLANK('Technology (Step 2b)'!$D94), \"\", 'Technology (Step 2b)'!$D94),\"\")","v":""},{"$f":"IF(OR('Technology (Step 2b)'!$L94=\"Medium\",'Technology (Step 2b)'!$L94=\"High\"),'Technology (Step 2b)'!$C94,\"\")","v":""}]
[{"$f":"IF(OR('Technology (Step 2b)'!$L60=\"Medium\",'Technology (Step 2b)'!$L60=\"High\"),'Technology (Step 2b)'!$B60,\"\")","v":""},{"$f":"IF(OR('Technology (Step 2b)'!$L60=\"Medium\",'Technology (Step 2b)'!$L60=\"High\"),'Technology (Step 2b)'!$L60,\"\")","v":""},{"$f":"IF(OR('Technology (Step 2b)'!$L98=\"Medium\",'Technology (Step 2b)'!$L98=\"High\"),IF(ISBLANK('Technology (Step 2b)'!$D98), \"\", 'Technology (Step 2b)'!$D98),\"\")","v":""},{"$f":"IF(OR('Technology (Step 2b)'!$L98=\"Medium\",'Technology (Step 2b)'!$L98=\"High\"),'Technology (Step 2b)'!$C98,\"\")","v":""}]
[{"$f":"IF(OR('Technology (Step 2b)'!$L61=\"Medium\",'Technology (Step 2b)'!$L61=\"High\"),'Technology (Step 2b)'!$B61,\"\")","v":""},{"$f":"IF(OR('Technology (Step 2b)'!$L61=\"Medium\",'Technology (Step 2b)'!$L61=\"High\"),'Technology (Step 2b)'!$L61,\"\")","v":""},{"$f":"IF(OR('Technology (Step 2b)'!$L99=\"Medium\",'Technology (Step 2b)'!$L99=\"High\"),IF(ISBLANK('Technology (Step 2b)'!$D99), \"\", 'Technology (Step 2b)'!$D99),\"\")","v":""},{"$f":"IF(OR('Technology (Step 2b)'!$L99=\"Medium\",'Technology (Step 2b)'!$L99=\"High\"),'Technology (Step 2b)'!$C99,\"\")","v":""}]
[{"$f":"IF(OR('Technology (Step 2b)'!$L62=\"Medium\",'Technology (Step 2b)'!$L62=\"High\"),'Technology (Step 2b)'!$B62,\"\")","v":""},{"$f":"IF(OR('Technology (Step 2b)'!$L62=\"Medium\",'Technology (Step 2b)'!$L62=\"High\"),'Technology (Step 2b)'!$L62,\"\")","v":""},{"$f":"IF(OR('Technology (Step 2b)'!$L100=\"Medium\",'Technology (Step 2b)'!$L100=\"High\"),IF(ISBLANK('Technology (Step 2b)'!$D100), \"\", 'Technology (Step 2b)'!$D100),\"\")","v":""},{"$f":"IF(OR('Technology (Step 2b)'!$L100=\"Medium\",'Technology (Step 2b)'!$L100=\"High\"),'Technology (Step 2b)'!$C100,\"\")","v":""}]
[{"$f":"IF(OR('Technology (Step 2b)'!$L63=\"Medium\",'Technology (Step 2b)'!$L63=\"High\"),'Technology (Step 2b)'!$B63,\"\")","v":""},{"$f":"IF(OR('Technology (Step 2b)'!$L63=\"Medium\",'Technology (Step 2b)'!$L63=\"High\"),'Technology (Step 2b)'!$L63,\"\")","v":""},{"$f":"IF(OR('Technology (Step 2b)'!$L101=\"Medium\",'Technology (Step 2b)'!$L101=\"High\"),IF(ISBLANK('Technology (Step 2b)'!$D101), \"\", 'Technology (Step 2b)'!$D101),\"\")","v":""},{"$f":"IF(OR('Technology (Step 2b)'!$L101=\"Medium\",'Technology (Step 2b)'!$L101=\"High\"),'Technology (Step 2b)'!$C101,\"\")","v":""}]
[{"$f":"IF(OR('Technology (Step 2b)'!$L64=\"Medium\",'Technology (Step 2b)'!$L64=\"High\"),'Technology (Step 2b)'!$B64,\"\")","v":""},{"$f":"IF(OR('Technology (Step 2b)'!$L64=\"Medium\",'Technology (Step 2b)'!$L64=\"High\"),'Technology (Step 2b)'!$L64,\"\")","v":""},{"$f":"IF(OR('Technology (Step 2b)'!$L102=\"Medium\",'Technology (Step 2b)'!$L102=\"High\"),IF(ISBLANK('Technology (Step 2b)'!$D102), \"\", 'Technology (Step 2b)'!$D102),\"\")","v":""},{"$f":"IF(OR('Technology (Step 2b)'!$L102=\"Medium\",'Technology (Step 2b)'!$L102=\"High\"),'Technology (Step 2b)'!$C102,\"\")","v":""}]
[{"$f":"IF(OR('Technology (Step 2b)'!$L65=\"Medium\",'Technology (Step 2b)'!$L65=\"High\"),'Technology (Step 2b)'!$B65,\"\")","v":""},{"$f":"IF(OR('Technology (Step 2b)'!$L65=\"Medium\",'Technology (Step 2b)'!$L65=\"High\"),'Technology (Step 2b)'!$L65,\"\")","v":""},{"$f":"IF(OR('Technology (Step 2b)'!$L103=\"Medium\",'Technology (Step 2b)'!$L103=\"High\"),IF(ISBLANK('Technology (Step 2b)'!$D103), \"\", 'Technology (Step 2b)'!$D103),\"\")","v":""},{"$f":"IF(OR('Technology (Step 2b)'!$L103=\"Medium\",'Technology (Step 2b)'!$L103=\"High\"),'Technology (Step 2b)'!$C103,\"\")","v":""}]
[{"$f":"IF(OR('Technology (Step 2b)'!$L66=\"Medium\",'Technology (Step 2b)'!$L66=\"High\"),'Technology (Step 2b)'!$B66,\"\")","v":""},{"$f":"IF(OR('Technology (Step 2b)'!$L66=\"Medium\",'Technology (Step 2b)'!$L66=\"High\"),'Technology (Step 2b)'!$L66,\"\")","v":""},{"$f":"IF(OR('Technology (Step 2b)'!$L104=\"Medium\",'Technology (Step 2b)'!$L104=\"High\"),IF(ISBLANK('Technology (Step 2b)'!$D104), \"\", 'Technology (Step 2b)'!$D104),\"\")","v":""},{"$f":"IF(OR('Technology (Step 2b)'!$L104=\"Medium\",'Technology (Step 2b)'!$L104=\"High\"),'Technology (Step 2b)'!$C104,\"\")","v":""}]
[{"$f":"IF(OR('Technology (Step 2b)'!$L67=\"Medium\",'Technology (Step 2b)'!$L67=\"High\"),'Technology (Step 2b)'!$B67,\"\")","v":""},{"$f":"IF(OR('Technology (Step 2b)'!$L67=\"Medium\",'Technology (Step 2b)'!$L67=\"High\"),'Technology (Step 2b)'!$L67,\"\")","v":""},{"$f":"IF(OR('Technology (Step 2b)'!$L105=\"Medium\",'Technology (Step 2b)'!$L105=\"High\"),IF(ISBLANK('Technology (Step 2b)'!$D105), \"\", 'Technology (Step 2b)'!$D105),\"\")","v":""},{"$f":"IF(OR('Technology (Step 2b)'!$L105=\"Medium\",'Technology (Step 2b)'!$L105=\"High\"),'Technology (Step 2b)'!$C105,\"\")","v":""}]
[{"$f":"IF(OR('Technology (Step 2b)'!$L68=\"Medium\",'Technology (Step 2b)'!$L68=\"High\"),'Technology (Step 2b)'!$B68,\"\")","v":""},{"$f":"IF(OR('Technology (Step 2b)'!$L68=\"Medium\",'Technology (Step 2b)'!$L68=\"High\"),'Technology (Step 2b)'!$L68,\"\")","v":""},{"$f":"IF(OR('Technology (Step 2b)'!$L106=\"Medium\",'Technology (Step 2b)'!$L106=\"High\"),IF(ISBLANK('Technology (Step 2b)'!$D106), \"\", 'Technology (Step 2b)'!$D106),\"\")","v":""},{"$f":"IF(OR('Technology (Step 2b)'!$L106=\"Medium\",'Technology (Step 2b)'!$L106=\"High\"),'Technology (Step 2b)'!$C106,\"\")","v":""}]
[{"$f":"IF(OR('Technology (Step 2b)'!$L69=\"Medium\",'Technology (Step 2b)'!$L69=\"High\"),'Technology (Step 2b)'!$B69,\"\")","v":""},{"$f":"IF(OR('Technology (Step 2b)'!$L69=\"Medium\",'Technology (Step 2b)'!$L69=\"High\"),'Technology (Step 2b)'!$L69,\"\")","v":""},{"$f":"IF(OR('Technology (Step 2b)'!$L107=\"Medium\",'Technology (Step 2b)'!$L107=\"High\"),IF(ISBLANK('Technology (Step 2b)'!$D107), \"\", 'Technology (Step 2b)'!$D107),\"\")","v":""},{"$f":"IF(OR('Technology (Step 2b)'!$L107=\"Medium\",'Technology (Step 2b)'!$L107=\"High\"),'Technology (Step 2b)'!$C107,\"\")","v":""}]
[{"$f":"IF(OR('Technology (Step 2b)'!$L70=\"Medium\",'Technology (Step 2b)'!$L70=\"High\"),'Technology (Step 2b)'!$B70,\"\")","v":""},{"$f":"IF(OR('Technology (Step 2b)'!$L70=\"Medium\",'Technology (Step 2b)'!$L70=\"High\"),'Technology (Step 2b)'!$L70,\"\")","v":""},{"$f":"IF(OR('Technology (Step 2b)'!$L108=\"Medium\",'Technology (Step 2b)'!$L108=\"High\"),IF(ISBLANK('Technology (Step 2b)'!$D108), \"\", 'Technology (Step 2b)'!$D108),\"\")","v":""},{"$f":"IF(OR('Technology (Step 2b)'!$L108=\"Medium\",'Technology (Step 2b)'!$L108=\"High\"),'Technology (Step 2b)'!$C108,\"\")","v":""}]