THE IT&S 2015 ANNUAL REPORT

Protection of Our Assets
It’s absolutely crucial that we ensure the confidentiality, integrity,
and availability of all our data. The goal of the Information
Protection team is to implement safeguards that focus on strong
user access controls, awareness and training of the workforce,
data security, processes and procedures, and protective
technology.
Key accomplishments in 2015 included:
Detection of Threats, Data Loss, and
Inappropriate Access to Sensitive
Information
HCA is, unfortunately, the target of innumerable external threats
such as nation states, cyber criminals, and hacktivists. We also
face internal threats, like dishonest insiders, and even honest
staff members who make errors or decisions out of urgency or
ignorance. This all means that the Information Protection team
has to be constantly on guard and on the lookout for potential
threats to our company.
• REENGINEERING BUSINESS
• IMPROVING DATA QUALITY
• INTRODUCING MONTHLY
PROCESSES AND SYSTEMS TO
REDUCE THE USE OF SOCIAL
SECURITY NUMBERS
WITH PROVIDER DICTIONARY
STANDARDIZATION EFFORTS
AND COLLABORATION WITH
iPROTECT SESSIONS AIMED
AT CORPORATE IT&S PROJECT
MANAGERS AND BUSINESS
Key accomplishments in 2015 included:
• PARTNERING WITH
ENTERPRISE DATA
WAREHOUSE BUSINESS
OWNERS TO IMPLEMENT
AN IMPROVED USER ACCESS
REQUEST PROCESS, DEVELOP
TRAINING, AND CREATE
OPERATING PROCEDURES
• PARTNERING WITH
INFRASTRUCTURE SERVICES
& OPERATIONS TO IMPROVE
NETWORK AND FIREWALL
PROTECTION
CLINICAL SERVICES GROUP,
INFORMATION PROTECTION,
AND IT&S
• ESTABLISHING THE
CORPORATE ACCESS
TEAM, ROLLING OUT ESAF
TO CORPORATE USERS,
IMPROVING ACCESS REQUEST
PROCESSES FOR USERS
IN MULTIPLE DIVISIONS,
AND TURNING ON NON-
EMPLOYEE CONTRACT END
DATE NOTIFICATIONS
ANALYSTS TO PROVIDE
AWARENESS ON KEY
PROJECT DELIVERABLES AND
TOPICS INCLUDING SARC, ISA,
ISAM, RECORD RETENTION
REQUIREMENTS, AND IT&S
POLICIES AND STANDARDS
• 70% OF OUR WORKFORCE
COMPLETED “BE THE HERO:
YOUR IDENTITY DEPENDS ON
IT” TRAINING AS WELL AS AN
ADDITIONAL COURSE FOR
MANAGERS
• DEPLOYING DATA LOSS
PREVENTION (DLP) ACROSS
THE ENTERPRISE, WHICH
PROVIDED EDUCATION
TO CFOS, DEPARTMENT
MANAGERS, AND
WORKFORCE MEMBERS
ABOUT PROTECTING FILES
THAT CONTAIN SOCIAL
SECURITY NUMBERS WHEN
SAVING, EMAILING, AND
PRINTING
• IMPLEMENTING THE
ACCESS REVIEW TOOL (ART)
SOLUTION THAT AUTOMATED
MONITORING OF USER
ACTIVITY IN MEDITECH,
HCARE PORTAL, AND HPF
TO IDENTIFY AND TRIGGER
REVIEW OF POTENTIALLY
INAPPROPRIATE ACCESS
EVENTS
• BLOCKING MORE THAN 1,300
MALICIOUS WEB EVENTS
AND 6,000 MALICIOUS EMAIL
ATTACHMENTS
80
81