Antivirus Presence

Summary

Things to Consider to Help Answer the Question:

Consider that malicious software can include viruses, worms, Trojans, time bombs, spyware, email hoaxes and the like.

Consider whether your practice's awareness and training content explains:

- The dangers presented by malware

- How to thwarting phishing schemes

- Why it is unsafe to click links contained in emails received from persons known and unknown

- Why opening attachments that are not scanned for malware is unsafe

- How to report such irregular system performance or suspicious communications.

Possible Threats and Vulnerabilities:

Your practice may not be able to safeguard its information systems, applications, and ePHI if its workforce does not follow its policies and procedures for guarding against, detecting, and reporting malicious software and include malware protection.

Some potential impacts include:

- Unauthorized or inappropriate access to ePHI can compromise the confidentiality, integrity, and availability of your practice's ePHI.

- Unauthorized disclosure, loss, or theft of ePHI can lead to medical identity theft.

- Accurate ePHI may not be available when needed, which can adversely impact your healthcare professionals' ability to diagnose and treat their patients.

Examples of Safeguards:

Some potential safeguards to use against possible threats/vulnerabilities. NOTE: The safeguards you may choose will depend on the degree of risk (likelihood) and the potential harm that the threat/vulnerability poses to you and the individuals who are the subjects of the ePHI.

Procedures for guarding against, detecting, and reporting malicious software.

[45 CFR �164.308(a)(5)(ii)(B)]

- Include practical exercises in security awareness and training that simulate:

o Actual cyber-attacks

o No-notice social engineering attempts to collect information

o The adverse impact of opening malicious email attachments or invoking, via spear phishing attacks ,malicious web links

Configuration

In order to be considered compliant, anti-virus software needs to be installed.