Part 4 - Iowa Medicaid Enterprise

RFP MED-12-001 | Technical ProposalIowa Medicaid Enterprise System Service Procurement | MMIS and Core MMIS OperationsSecurity and confidentiality training for staff will be accomplished by a combination of mandatoryorientation classes, annual security and confidentiality training by management, and annual compliancetraining by the compliance department.Each year, the corporate systems security unit carries out a number of tasks, functions, meetings, andcommunications related to orientation and training. Examples of this include:• Periodic e-mail reminders to all Team Noridian employees on security and privacy topics• Routine reminders on the Team Noridian intranet site• Assisting departments in the review of their policies and procedures• Customized security and compliance training sessions administered for all new employees andannually for all staffEmployees attend orientation on their first day of employment. They are educated on the importance ofbuilding access security. In addition, they receive a separate presentation for privacy and securityawareness, including confidentiality of information, user education concerning virus protection,importance of monitoring login success/failure, password management, where to report problems, andbuilding security.Management is required to provide customized security and confidentiality training to their employees.New hires receive customized training prior to being allowed access to sensitive information. Annualsecurity and confidentiality awareness training is given to all employees. This customized trainingincludes reviews of existing policies and review of new policies. The corporate systems security unittracks the various rosters to ensure all employees receive training.7.8.3 Incident ResponseRFP Section 5.8, Requirement c.3Team Noridian believes it is an employee’s responsibility to promote and ensure the integrity of privacyrequirements. To provide Team Noridian employees a forum for voicing concerns, Team Noridian hasestablished incident reporting policies and procedures. The procedures identify the types of privacyincidents that must be reported and the individual to whom reports should be made. The procedures allowfor multiple methods of reporting incidents, including by telephone, in writing, electronically, in-person,or anonymously.Team Noridian believes that all incidents require investigation. The outcome of the investigation oftenconcludes that employees have been overly cautious and no PHI was divulged. In these cases, we educatethe reporting party and advise the individual or individuals about whom the incident was reported. In theevent the investigation identifies PHI or confidential information that was disclosed improperly,immediate action is taken to educate employees, determine the root cause of the breech, assess anypotential process or system failure, and determine appropriate disciplinary action. Team Noridian willimmediately notify the Department of any incidents that are reported and will provide regular updates onthe status of the resulting investigation.We will use our established Incident Response Plan for handling suspected system intrusions, systemmisuse, or any situations where unauthorized access to confidential information is suspected. The IncidentResponse Plan defines the procedure for identifying and handling a computer-related security incident,including the members of the incident response team, the stages of response, and escalation procedures.All incidents are reported, logged, and investigated to determine if it is a genuine incident. Once it isdetermined that it is an incident, it is given a severity level based upon impact to business. A team isassigned based on the severity of the incident and then containment and eradication of the incident iscompleted. On completion, we document investigative and corrective actions.7 | 48