HS 9453-D Remote Access - Office of Compliance Services - UCLA ...

Remote Access PolicyHS 9453-Dinformation and health insurance information for patients are also considered to be PHI.“Restricted Information” (as defined by UC Policy IS-3, Electronic InformationSecurity) describes any confidential or Personal Information that is protected by law orpolicy and that requires the highest level of access control and security protection,whether in storage or in transit. This includes Personal Information, PHI and ePHI asdefined in this section but could also include other types of information such as researchdata.“Authorized Personnel” means the designated IT support person or group for an area.For hospital areas, this would be Medical Information Technology Services (MITS); fordepartments within the David Geffen School of Medicine at UCLA (“School ofMedicine”), it would be the departmental Computer Support Coordinator (CSC); forareas supported by the School of Medicine IT Services (SOMITS), it would be SOMITS.“Device” refers to a networked device (e.g., PC, server, medical equipment).“MedNet” is the data network connecting the UCLA Medical Centers, the School ofMedicine and the UCLA Community Physician Network.“Virtual Private Network” or “VPN” is a method to allow secure remote access acrossthe Internet by using encryption and other security mechanisms to ensure that onlyauthorized users can access the network and that data cannot be intercepted.“Workforce” means employees, volunteers, and other persons whose conduct, in theperformance of their work for UCLA Health, is under the direct control of UCLA Healthor the Regents of the University of California, whether or not UCLA Health pays them.The Workforce includes employees, medical staff, and other health care professionals,agency, temporary and registry personnel, and trainees, housestaff, students andinterns, regardless of whether they are UCLA trainees or rotating through UCLA Healthfacilities from another institution.POLICYI. All remote access into UCLA Health networks across the Internet must useapproved VPN technology, and the remote access must be approved in advanceby the Department Authorizer.II.Devices that will be used for remote access that are not UCLA Health ownedequipment must be configured to comply with the provisions of this policy.2 of 5 UCLA HealthCompliance Policies and ProceduresPrivacy and Information Security Policies