Internal Prospective Medical Customer Assessment Form

Company Demographics

Company Name *

Street Address *

Address Line 2

City *

State/Province *

ZIP / Postal Code *

Main Office Phone Number *

Main Fax Number

Website

Company Tax ID

Tax Region

Tax Exempt

Number of Offices/Locations

Cyber Insurance

Cyber Insurance CarrierIf customer responded "Yes."

Primary Contact Demographics

Primary Contact First Name *

Last Name *

Suffix

Title *

Email Address *

Location Office Name

Street AddressEnter if different from Primary location.

Address Line 2

City

State/Province

ZIP / Postal Code

Phone Number *

Extension

Fax Number

Mobile Number

Medical Demographics

Legal Practice Name

Specialty

Group Tax ID

Practice NPI Number

Number of Physicians

Number of Midlevels

Billing Company

Software/Applications

Practice Management (PM) Application Name

Version Number

Cloud-Based

Support Contact

Data Backup and Frequency

Application Pain Points

Electronic Health Record (EHR) Application Name

Version Number

Cloud-Based

Support Contact

Data Backup and frequency

Application Pain Points

Picture Archiving & Communication System (PACS) Application Name

Version Number

Cloud-Based

Support Contact

Data Backup and Frequency

Application Pain Points

Other Application Name

Version Number

Cloud-Based

Support Contact

Data Backup and Frequency

Application Pain Points

Additional Software Notes

Electronic Data Handling

Types of Electronic Data Processed/StoredWhat types of electronic data does your company process, transmit, and/or store on its computer systems?

Personally Identifiable InformationDoes your company process, transmit, and/or store Personally Identifiable Information such as Social Security, Driver’s License numbers, Financial/bank account, Credit/debit card information, Email addresses?

Data Privacy and Protection

Access RestrictionsDoes your company restrict employee access to customer files and personally identifiable information of employees to those whose job role requires this information on a need-to-know basis?

Encryption of Private DataIs all data that is to be secured in accordance with government regulations and/or industry guidelines encrypted?

Customer Data and Web-based SystemsDoes your company require the transmission of customer data that includes one or more the following as part of your internet-based web services: Contact information, Credit/debit card numbers, and/or Social Security numbers?

Customer Opt-Out Preference ReadinessAre your company’s information systems and business processes readied to ensure that customer preferences associated with the opt-out of sharing of non-public, personal information with non-affiliated third parties can be successfully honored?

Regulatory Compliance

Gramm-Leach-Bliley Act (GLBA)Health Insurance Portability & Accountability Act (HIPAA)Payment Card Industry Data Security Standard (PCI DSS)

Is your company in compliance with one or more of the following data protection regulations: GLBA, HIPAA, and/or PCI DSS? If so, please indicate which of the regulation’s compliance standards have been met by your company

Areas of Concern, Challenges and Suggestions

Security Policies and Procedures

Implemented Security PolicyDoes your company have a written information system and network security policy in place that applies to employees, independent contractors, and third-party vendors?

IT Risk Assessment PracticesDoes your company perform an IT security risk assessment annually and upgrade risk controls to mitigate identified security risks?

Security Policy TrainingDoes your company provide employees, independent contractors, and third-party vendors security policy awareness training on an annual basis?

Security Incident ReportingDoes your company have a security incident reporting process to enable the escalation of security incidents and possible breaches of information?

Areas of Concern, Challenges and Suggestions

Security Audits and Controls Testing

Security/Privacy Compliance AssessmentHas your company undergone an information security and/or privacy compliance assessment?

Who performed the assessment?

Data the assessment was performed?

Assessment Type

Mitigation actions implemented

Data Security Control Testing

Areas of Concern, Challenges and Suggestions

Network Closet

Network Closet/Cabinet DesignBrief description of appearance and design of the server room.

Closet/Cabinet Locked

Equipment LayoutIs the equipment laid out in an orderly manner? What is the organization scheme used or are devices placed randomly?

Wiring/CablingBrief description of the cabling. Is cable management employed? Attach photo if appropriate.

All Devices LabeledAre all devices clearly labeled? Are labels accurate and updated when devices are re-provisioned?

Battery Backup/UPS

Make and Model

Number of Batteries

Network Monitoring

Rack Mounted or Floor Model

Climate (Temp/Humidity)What is the general temperature and humidity of the server room? How is it controlled?

Remote Access Control (DRAC, iLO, etc.)Is low-level remote access to the servers available? Can the server room devices and servers be managed remotely?

Servers

Virtual Servers

Quantity of Virtual Servers

Roles of Servers

Operating System of Virtual Servers

Physical Servers

Quantity of Physical Servers

Roles of Servers

Operating System of Physical Servers

Quantity of Switches

Switches

Make and Model

Port Density

POE

Rack Mounted

Layer

Areas of Concern, Challenges and Suggestions

Network Firewall/Safeguards

On-Prem Managed Firewall

Firewall Make and Model

Elimination of Factory Default SettingsAre vendor/factory default settings in network and computing system components replaced with settings that ensure that the systems are securely configured?

Firewall at InternetDoes your company have a firewall established at each Internet connection?

Firewall Rules Review ProcessHow often are the rules within implemented firewalls reviewed?

Network Change ManagementDoes your company have a network change management policy and process to ensure the network is always configured to be secure?

Remote AccessDo you allow remote access to your network ?

Security Standards for Remote Access EquipmentDo you require that any systems that are used to access your company’s IT system remotely are at least as secure as your company’s system?

Remote Access SecurityRemote Access Security – Are connections from remote users, laptops, and mobile devices into your company’s network secured with one more of the following methods?

Areas of Concern, Challenges and Suggestions

Endpoints/Workstations

Digital Signage

Quantity of Digital Signage

Postage Meter

Quantity of Postage Meters

Printers/MFP

Quantity of Printers

Quantity of MFPs

Network Scanners

Quantity of Network Scanners

Workgroup Switches

Quantity of Workgroup Switches

MonitorsAverage size, dual, average make and model.

Quantity of DesktopsRun Computer Data Collector on each desktop.

Quantity of Unsupported OS Desktops

Areas of Concern, Challenges and Suggestions

Mobile Computing

BYOD or Company ProvidedDescribe the company's mobile device policy. Is the company using a MDM solution? BYOD devices or standardized company devices.

Types of Devices

Quantity of Laptops

Laptop HDD Encryption

HDD Encryption Solution

Quantity of Unsupported OS Laptops

Required LOB Access from Mobile DevicesList essential line of business applications that require mobile access.

External Access MethodsBeyond mobile phones, what other methods for external access are available?

Internal Access Methods

Areas of Concern, Challenges and Suggestions

FileShare System

FileShare Solution

Storage Availability

File Redirects Implemented for Users

FileShare System Pain Points

System Access Safeguards

Use of Strong PasswordsDoes your company employ the use of “Strong” user password protection that include non-alphanumeric characters, at least eight (8) characters in length, at least one (1) upper case letter, contain at least one (1) lower case letter, contain one number, contain one special character such as #, !, @, ?, or ^, must be different from previous passwords, and an expiration period length of between 45-90 days?

Removal of Outdated User AccountsDoes your company have a policy of periodically reviewing computer accounts and removing accounts for employees no longer with the company or for vendor/service provider employees that no longer require IT system access?

Physical Security ControlsDoes your company have physical security controls in place to control access to company computer systems?

System Access Control PoliciesDoes your company have access control policies and procedures in place to authorize and control access to business-critical computers systems and those systems that store sensitive data?

Areas of Concern, Challenges and Suggestions

Computer Equipment Safeguards

Anti-malware/Antivirus Deployment

Anti-malware/Antivirus Solution

Scans on Email File DownloadsAre antivirus scans performed on all email attachments, downloads, and files before opening?

Infected File Quarantine ProceduresAre any files that are identified as infected during antivirus and antispyware scans quarantined and/or deleted?

Current Software Versions, Updates, and PatchesDoes your company use the most current versions, updates, and patches available from the third-party suppliers of antivirus, antispyware, firewall, and software security protection software on all workstations, laptops, mobile devices, and business critical servers to prevent security breaches and authorized access?

Security Software UpdatesAre security software updates and patches check weekly and applied within 30 days?

Disabling of Unnecessary Services and PortsAre unnecessary services and ports on computers and the network disabled?

Virus NotificationsDoes the company automatically receive virus information/notifications from Cert or from similar agencies and/or industry organizations?

Areas of Concern, Challenges and Suggestions

Systems Monitoring

Security MonitoringDoes your company use technologies and/or testing techniques to monitor and/or test IT system security?

Suspicious Activity MonitoringAre business critical applications, security systems, and network activity logs periodically reviewed for suspicious activity?

Unauthorized Access Detection

Areas of Concern, Challenges and Suggestions

Systems Backup and Recovery

Business Continuity/Recovery PlanDoes your company have a business continuity/disaster recovery plan that incorporates procedures to restore computer operations after a disruptive event?

Business Continuity/Recovery Solution

Backup and Recovery Process TestingAre all mission critical systems backup and recovery procedures tested on an annual basis?

Time to Restore Computer OperationsWhat period of time is necessary to restore computer system operations after an attack on your company’s IT environment or as a result of data loss and/or corruption?

Offsite Backup

Last Time Restore Tested

Onsite Backup

Last Time Restore Tested

Areas of Concern, Challenges and Suggestions

Current Service Provider

Internet Provider

Contract Expiration

Type of Connection

Speed Up

Speed Down

Telephone Provider

Contract Expiration

Telephony Solution Name

Version Number

VoIP

Number of Phones

Fax Line Provider

Number of Fax Lines

Electronic Fax Solution

Email SPAM/AV Filtering ServiceIs an external anti-spam or anti-virus server employed to protect incoming and outgoing emails? Describe the service and general satisfaction with the service.

Email Provider

Contract Expiration

If Exchange, Version Number

Available Storage

Website Hosting

Website MaintenanceHow and who performs website maintenance? Is it outsourced or in-house?

Third Party Service Providers

IT Service OutsourcingIs any critical part of your IT network/computer system or Internet access/web presence to others outsourced to any third parties?

IT Service Provider/Resource

Financial Services and Payment Processing ProviderPlease document the Service Provider companies that provide the Financial Services and Payment Processing services to your company that are necessary to operate your company's IT network and systems

Cloud, ASP, and SaaS Services ProvidersPlease document the Service Provider companies that provide the Cloud, ASP, and SaaS services to your company that are necessary to operate your company's IT network and systems.

Service Provider Security PracticesAre your company’s information security policies, procedures, and training practices required to be complied with by third party service providers and detailed as terms within the written agreements executed with third party service providers and verified as being in force per the terms in the agreement?

Indemnification by Service ProvidersDo your company's agreements with third party service providers include terms that provide for indemnification of your company from the unauthorized use or disclosure of stored personal information on the service provider’s network?

Service Provider Security AuditsDoes your company perform audits on its vendors and service providers that handle your company’s privacy sensitive data to verify that security protocols are in place to secure the data?

Photo Uploads

Internal Prospective Medical Customer Assessment Form

Please fill out the following assessment form for the prospective medical customer:

Contact Us