Management Overview of Security Manager Role

1. Management Overview of Security Manager Role Karen Hughart, MSN, RN-BC, Dir. Systems Support Services

2. What is changing and Why? WHAT? Security Management responsibilities are being decentralized to the unit level. • Each unit will need a primary and back-up Security Administrator identified and trained before Thanksgiving, 2013. Current System no longer HIPAA compliant. • Requires that systems access limited to just that functionality required to perform job responsibilities. • Role or job change required systems access review and correction • The person with hiring/firing responsibility is accountable for ensuring appropriate systems access. WHY?

3. Security Manager Role and Responsibilities Maintain an understanding of Vanderbilt standards and policies regarding information security, confidentiality, and privacy and communicate these to individuals within my department. Assist the organization in identifying, classifying, and securing confidential and restricted information. Orient and train the faculty, staff, and trainees within my department on security awareness in general and security procedures that should be followed in direct relation to their job duties. Monitor compliance with information security policies and procedures, referring ongoing problems to the Information Privacy and Security Office.

4. Security Manager Role and Responsibilities (Cont.) • Monitor the process of granting system access to users within my department to ensure that appropriate information access levels and security clearances are maintained when transfers, changes in job functions, and terminations occur. This includes: • ■ Creating and maintaining a current process map for all employee types regarding the process for notification of changes to employee status. • ■ Creating and maintaining a list of active PAF responsible persons within the area served. • ■ Creating and maintaining a list of departmental systems operators/owners that need to be notified when an employee status changes. Refer to policy IM 10-30.19 Authorization and Access to Electronic Systems and Applications Section IV: Specific Information, Item D: Modification of Access. • ■ Maintain flow of information to and from department systems operators/owners that need notification of changes to employee status.

5. Security Manager Role and Responsibilities (Cont.) Identify potential exposures and risks to the confidentiality, integrity, and availability of information and make recommendations to my Department Head or the Information Privacy and Security Office (when appropriate) to mitigate the risks. Alert the Information Privacy and Security Office to changes in the patient-care, business, and computer systems environments in the organization that would have an impact on the information security program. Train another individual in the department to act as an ISM backup, in case of emergency or absence.

6. Management Oversight of Security Manager Requires: • Support for training and developing proficiency in new role. • Regular check-ins to ensure Systems Access is priority consideration for any HR change. • Consultation (including CAPS or other resources when warranted) to address complex systems access issues. • Knowledgeable and visibly supportive of organizational policies and regulatory requirements for systems privacy and security. • Knowledgeable of resources available when Security Manager changes or requires additional training/support.

7. How do you know when there are competency issues? • Staff report that they do NOT have appropriate systems access when they start work or change roles • You observe staff sharing ID’s/Passwords because one or more do not have needed access • Security Manager cannot respond to questions: • “Who do you contact when there is an issue obtaining a VU Net ID?” [Should say “VAS” or “Vu Net ID Team” & know phone number and web URL] • “Who do you contact when there is an issue with obtaining a Rac F ID or clinical systems access?” [Should say “SAM Team” or “Identity Management”& know phone number and web URL] • “How do we get access to VandyWorks?” [Should say e-mail the VandyWorks e-mail address on the person on call will get in touch] • “Who grants access to Business Objects?” [Should say contact Maribeth Hagan and Systems Support Services] • Security Manager cannot state correct sequence for the following onboarding steps: • Submit PAF to HR • Register new employee for New Employee Orientation • Obtain VU Net ID from VSA (that was automatically generated once PAF processed) • Request Rac F ID and appropriate clinical/business systems access • Provide Rac F ID letter to new employee • Security Manager does not enter Systems Access transfer information or request termination of systems access in a timely fashion with transfers and terminations

8. Triggers for Re-evaluation of Systems Access: New hire? Will need VU Net ID, Rac F ID, access to StarPanel, HEO/Wiz, HED/AdminRx, & possibly Medipac, POU, Teletracking, etc. Refer to grid for role-specific requirements for unit. Cross –train for added duties (eg. CP x-trained as MR)? Will need to compare CP functionality to MR functionality on grid and request what’s missing. Will need Medipac access to enter transfers, discharges, and departures. Job change on same unit (eg. CP to RN)? Will need to compare current functionality to functionality needed for new role and request what’s missing. (Eg. An RN will need a “role change” in HEO to enable them to enter verbal orders for meds. ) Transfer in or out? Will need to compare current functionality to functionality needed for role on new unit and request what’s missing (or delete what is no longer needed). (Eg. POU access may need to be added or deleted). Unit information will need to be updated to show current home dept. Systems access will need to be inactivated. In some cases with involuntary terminations, this needs to be done very quickly to prevent malicious activity. There is a monthly PeopleSoft feed that will eventually inactivate VU Net ID but this is delayed. Be cautious in situations where one job is ending but staff member will continue to have a job elsewhere at VUMC as their access may need to be transitioned to new Security Manager rather than ended. Termination (voluntary or involuntary)? 2nd Job (eg. CP who is Nursing Student doing clinical placement here)? This can get tricky and requires a case-by-case review and perhaps consultation with CAPS or other resource. In general, the individual will need access to perform in both roles AND will need guidance that they need to match what systems they use and how they use them to the role in which they are functioning at any given time. (eg. A Nursing Student might document meds in AdminRx but a CP would not.)

9. Helpful Links • Systems Access Online Request Form (Log in with your VUNET ID and Epassword): https://samprod.mc.vanderbilt.edu/sam/Access.aspx • Website to print Security Letters and Check Listing of Active Users (Log in with your RACF ID and RACF ID Password): https://10.109.11.191/login.php Websites: • Systems Access Management: http://www.mc.vanderbilt.edu/root/vumc.php?site=sam • Help Desk: http://helpdesk.mc.vanderbilt.edu • Information Technology: http://it.vanderbilt.edu/ • AccessVU: http://www.vanderbilt.edu/accessvu/ • ITS Product Page for SecurID Tokens: https://its.vanderbilt.edu/services/rsa-securid-tokens • EprocurementOrdering Process Tutorial: (http://its.vanderbilt.edu/files/web_files/RSA_SecurID_eProcurement_tutorial.pdf)

10. Frequently Asked Questions Q-- What is a VSA Administrator and how do I become one? A -- VuNet Services Administrators (VSAs) can assist users dealing with their VuNet IDs, resetting E-passwords, modifying personal options, and other facets of managing a VuNet account. In order to become a VSA, you must: 1) Sumit an application which is found at: http://its.vanderbilt.edu/files/documents/vsa_app.pdf Q – How do you appoint or remove a security manager? A -- the Security Manager’s Appointment and Removal from may be found at the following links: Appointment: http://www.mc.vanderbilt.edu/root/vumc.php?site=sam Removal: http://www.mc.vanderbilt.edu/root/vumc.php?site=sam Training will be scheduled for new Security Managers/VSA Administrators once their applications have been received.

11. Next Steps • Identify Security Manager for your unit(s) • Negotiate back-up coverage across units (eg. 9W Sec. Mgr. backs up 9E and visa versa) • Ensure Security Manager scheduled to attend training class • 9/12,14,20,21 instructor-led classes available • Sign up via LMS) • Visible support first 2-3 months in new role • Brief check in q 1-2 wks. • Monthly mtgs. to discuss barriers and agree on solutions • Use Resources as needed

12. Resources • Systems Support Services Web Site: • Help Desk: 3-HELP/3-4357 to access support from: • Identity Management • VSA support • Systems Support Services

13. Current State Hiring Mgt. (or surrogate) completes PAF & registers new hire for New Employee Orientation (NEO) VU Net ID is created by feed from PeopleSoft to VSA VU Net ID available? Needs Rac F ID /Systems Access SSS Sec. Admin. Checks NEO registrations for staff who need systems access SSS Sec. Admin. Requests Rac F ID & access to applications based on role and unit Rac F ID letter sent to SSS Sec. Admin. & given to new employee in NEO Sign On class Yes Yes No No SSS Sec. Admin. Checks w/hiring Mgr. (or surrogate) to see if PAF done Does employee lack appropriate systems access? SSS Sec. Admin. Requests access to applications based on Manager request At present, units seldom notify SSS of role changes, transfers, terminations & other changes that impact systems access requirements resulting in HIPAA violations. Manager notifies SSS Sec. Admin. Of needed systems access //Later//

14. Future State – Near Term Hiring Mgt. (or surrogate) completes PAF & registers new hire for New Employee Orientation (NEO) VU Net ID is created by feed from PeopleSoft to VSA Medipac access needed? VU Net ID available? Sec. Mgr. assigns appropriate M’Pac functions based on spreadsheet Security Mgr. requests Rac F ID & access to all applications needed by new employee based on spreadsheet Identity Management sets up access in apps. They support and provides Rac F ID letter to Security Mgr. Yes Yes No No Does employee lack appropriate systems access? Identity Management makes requested changes Security Manager requests addition/deletion of systems access via SAM on line request form //Later//