Recent orders
UNIVERSITY OF THE INCARNATE WORD
UNIVERSITY OF THE INCARNATE WORD
ILA FAYE MILLER SCHOOL OF NURSING
NURS 4445 MEDICAL SURGICAL COMPLEX CARE NURSING II
CLINICAL ETHICS PAPER FALL 2022
Objectives:
Upon successful completion of this activity the student will be able to:
Examine clinical reasoning performed by the registered nurse, physician, and/or health care team member in the acute care setting related to an ethical dilemma.
Compare and contrast between observed clinical reasoning by the registered nurse, physician, or health care team member as it relates to Catholic Social Teachings (CST).
Discuss the appropriateness of the registered nurse’s, physician’s, and/or health care team member’s intervention as it relates to the ethical dilemma.
The Assignment:
Read the online summary of the Catholic Social Teaching: United States Conference of Catholic Bishops. (2022, August 3). Seven themes of Catholic Social Teaching. HYPERLINK “http://www.usccb.org/beliefs-and-teachings/what-we-believe/catholic-social-teaching/seven-themes-of-catholic-social-teaching.cfm” http://www.usccb.org/beliefs-and-teachings/what-we-believe/catholic-social-teaching/seven-themes-of-catholic-social-teaching.cfm
Read the case study: Pages 133-136 of Neverloff-Dubler, N., & Liebman, C. B. (2011). Bioethics mediation: A guide to shaping shared solutions. Vanderbilt University Press. It can be found in Canvas.
Submit a formal academic paper comparing and contrasting the actions of the health care team as it relates to one of the seven themes.
Instructions:
Over the course of the semester, you will be submitting short writing assignments via a Dropbox in Canvas. These assignments will the building blocks of an ethical analysis. The final assignment will be to compile these paragraphs into one formal, academic paper.
Paragraph 1 Submission: The Introduction (5%)
You will be writing an ethical analysis of the case study provided using the Catholic Social Teachings as the framework for your analysis. Use this introduction paragraph to (1) give a brief narrative of an ethical issue in the case study that stands out to you and, (2) introduce one Catholic Social Teaching theme you will be applying to the ethical issue you identified. This paragraph should be an example of your academic writing skills, be no more than 300 words and formatted and referenced according to APA 7th edition.Submit your paragraph to the specified Drop Box in Canvas as a Word document by the due date. Late submissions will result in a reduction of 5% per day.When you receive feedback on your submission, make the suggested revisions, and save your work for the next submission.
Paragraph 2: Interpretation of the Theme (15%):
Write a paragraph describing your interpretation of the theme you have selected for your analysis. This should be your original thoughts on the meaning of the theme. Consider these questions: What does this theme mean to you? How does the theme apply to nursing? How would you apply this theme in your nursing practice? This paragraph should be an example of your academic writing skills, be no more than 300 words, and formatted and referenced according to APA 7th edition.
Add paragraph 2 to your revised paragraph 1 and submit them as one Word document to the specified Drop Box in Canvas by the due date. Late submissions will result in a reduction of 5% per day.
When you receive feedback on your submission, make the suggested revisions, and save your work for the next submission.Paragraph 3: Comparisons (15%):
Compare how the ethical issue in the case study was addressed as it relates to the theme you selected. Consider these questions: Where the actions of the health care team members consistent with the theme you selected? Would you have acted as the health care team members did? If yes, why? Would you have chosen a different course of action? If so, why? This paragraph should focus on aspects of the health care team’s actions that honored the theme you selected.
Write a paragraph answering the questions above. This paragraph should be an example of your academic writing skills, be no more than 300 words, and formatted and referenced according to APA 7th edition.
Use one current peered review nursing journal article (published within the last five years) to support your analysis.
Add paragraph 3 to your revised paragraphs 1 and 2 and submit them as one document to the specified Drop Box in Canvas as a Word document by the due date. Late submissions will result in a reduction of 5% per day.
When you receive feedback on your submission, make the suggested revisions, and save your work for the final exercise.
Paragraph 4: Contrasts (15%):
Contrast how the ethical issue in the case study was addressed as it relates to the theme you have chosen. Consider these questions: Where the actions of the health care team members consistent with the theme you selected? Would you have acted as the health care team members did? If yes, why? Would you have chosen a different course of action? If so, why? This paragraph should focus on aspects of the health care team’s actions that dishonored the theme you selected.
Write a paragraph answering the questions above. This paragraph should be an example of your academic writing skills, be no more than 300 words, and formatted and referenced according to APA 7th edition.
Use one current peered review nursing journal article (published within the last five years) to support your analysis. It can be the same article used in the previous paragraph.
Add paragraph 4 to your working document and submit it to the specified Drop Box in Canvas as a Word document by the due date. Late submissions will result in a reduction of 5% per day.When you receive feedback on your submission, make the suggested revisions, and save your work for the final exercise.
Paragraph 5: Conclusion (5%)
Add a conclusion to your working document that will bring your writing together into a cohesive academic paper. This is the first draft of the entire paper.
Submit the draft to the specified Drop Box in Canvas as a Word document by the due date. Late submissions will result in a reduction of 5% per day.
When you receive feedback on your submission make the suggested revisions.
Final Submission: Formal academic paper (45%)
It is now time to turn your draft document into a formal academic paper.
The final paper is to be typed, using APA format, 7th edition. Appropriate references should be cited. The case study as well as the website containing the Seven themes of Catholic Social Teaching should be cited in your paper.
All papers will be turned electronically as a Word document. The paper is due by the date specified in the course calendar. Late submissions will result in a reduction of 5% per day.
Please make sure your papers are proofread for spelling, grammar, and APA style. Nursing students are expected to be able to write professional collegiate level papers. Students are encouraged to utilize the available services on campus for assistance with writing, APA, and proofreading.
University of Phoenix Material
University of Phoenix Material
Theory Definition/Characteristics Examples
Trait Leadership The trait theory is also known as the disposition theory. It is an approach to the study of human personality. Therefore, trait theorists are interested in the measurement of human traits that are classified as habitual patterns, emotions, and thoughts. According to the trait theory of leadership, there are certain natural qualities of an individual that shape and develop good leaders (Derue et al., 2011). However, the possession of certain qualities does not qualify a person to be a good leader. For example, some leaders may be excellent communicators or listeners, but this doesn’t mean that every good listener or communicator can be a good leader. The trait approach attempts to identify demographics (education, age, and socioeconomic background), physiological (height, appearance, and weight), intellective (decisiveness, intelligence, knowledge, and judgement), social characteristics (cooperativeness and sociability), task-related (initiative, achievement, and persistence) with leader emergence and effectiveness. Also, the leadership theory focuses on personality, aggressiveness, and self-confidence for leaders.
The main characteristics of trait leadership include:
Honesty and integrity – The trait approach emphasizes on leaders to be characterized by reliability, openness, and transparency.
Achievement drive – Leaders need to have high levels of ambition, effort, energy, and initiative.
Self-confidence – leaders need to believe in oneself, their ability, and ideas.
Leadership desire – The trait approach emphasizes that leaders need to have an intense desire to lead others so that they can achieve shared goals.
Emotional maturity – Leaders need to be well-adjusted and don’t suffer from severe psychological disorders.
Cognitive ability – Good leaders need to be capable of emphasizing good judgement, develop conceptual skills and also develop strong analytical abilities to help them in decision making
Business knowledge – Leaders are not only in the political arena but also in a profit-oriented organization. Based on this, a good leader is required to have knowledge of the industry as well as other technical matters relating to business to help in achieving the shared goals.
Other major characteristics of the trait leadership theory include flexibility, creativity, and charisma. An example of the trait leadership can be found in the late Steven Jobs, who was known for his charisma. He had the ability to articulate his visions passionately and this made him a great leader.
Behavioral
Leadership Behaviorism is a theory of learning which is based on the idea that all behaviors are acquired through conditioning. Conditioning, in this case, occurs through environmental interaction (Phillips & Phillips, 2016). According to scholars, individual responses to the environmental stimulus is what shapes the action of a person. Based on this approach, not all people are born to be leaders, but there are certain traits that can be learned through conditioning to make a person an effective leader. The approach of behavioral leadership is relevant and makes more sense in that many leadership programs have helped many people to become great leaders. Since there are relevant skills taught in these leadership programs, the behavioral perspective of leadership has proven that leadership is not only for specific people, but anyone can be a leader provided they can properly demonstrate leadership behavior. Behaviorism depicts leadership in a more positive light and, therefore, helps individuals to take leadership in a more open-minded approach. There are various behaviors that are associated with great behavioral leadership.
They are grounded in ethics and integrity – Behavioral leaders are committed to doing the right things and for the right reasons, even when it is difficult to stay on course.
Building trust – Trust is not inborn but can be earned. Behavioral leaders take actions that are aimed at granting them more respect.
Bringing others, along with them- Behavioral leaders are always willing to help other people grow and achieve. Based on this, they also act as coaches and teachers to help others become great leaders and thus are an inspiration to many.
Reward achievement – Everyone likes to see their hard work and accomplishments recognized. Behavioral leaders are aware that behaviors are learned, and thus, rewarding achievements helps in motivating their employees.
Encourage innovation – Great behavioral leaders encourage employees in their organizations to be creative and innovative as they understand the significance of training people to be more innovative through observation, questioning, networking, and experimenting.
An example of behavioral leadership includes rewarding employees who perform better to increase their motivation. Also, punishing poor performance is an example of behavioral leadership.
Contingency
Leadership The contingency theory of leadership focuses on specific situations that affect the effectiveness of a leader as well as the ability of the leader to adapt to the important tools in the workplace. According to the contingency theory of leadership, the effectiveness of a leader is contingent on whether or not their style of leadership style is suitable for the specific position (Jansen et al., 2016). A person can be an effective leader in one situation and also be ineffective in another situation. There are a dozen of factors in the workplace that can affect the effectiveness of leadership, and some of them include the size of the team, the expected delivery date of the results as well as the scope of the project. It should be noted that different leaders do possess unique leadership styles, and therefore, they will respond to each of the factors differently. According to the contingency leadership theory, no matter how successful a leader has been in some tasks, there will always be a specific situation that will cause a lot of challenges to them. Therefore, a contingent leader must be willing to acknowledge the fact that their success is dependent on the current circumstances as well as on their skills. Based on this, contingent leaders that may include supervisors and managers are required to adapt their leadership styles to the present situation or delegate some of their leadership responsibilities to a junior employee so that they can be effective as leaders.
Situations in a contingency leadership theory are defined by three factors, that is, leader-member relation, task structure, and positional power.
Leader-member relation – this factor is a measure of leadership acceptance between the organizational hierarchies. If the junior leaders have trust, confidence, and adequately feel motivated by their superiors, the leader-member relation tends to be positive, and this increases the chances of the leader being effective.
Task structure – The factor is a measure of the clarity of the activities, methods, and output.
Positional power – The factor is a measure of the amount of authority possessed by the leader to enable them to influence the productivity of the followers. Positional power defines whether a leader can punish or reward employees.
An example of contingency leadership is delegating simple tasks to junior leaders to help ease the delivery of a service in a shorter time.
Skills
Leadership The skills leadership focuses on the leader’s knowledge and abilities. The approach suggests that knowledge, skills, and abilities are essential for a leader to be termed effective, and these can be acquired through learning and further developed to make a leader more competent. Many people can be potential leaders, but they lack the essential skills required to be enhanced through training and experiences to make a leader more effective. Training, experiences, involvement, as well as exposure to specific activities, can help in shaping an individual for a leadership position. There are two major models of skills leadership that include the Katz model and Mumford models. Katz’s model is the most influential and identifies three different abilities that are essential for a leader and which include technical skills, conceptual skills, and human skills (Holmberg-Wright & Hribar, 2016).
Technical skills – These are the knowledge and expertise that are essential for the completion of a particular task. They include the need for specialized knowledge applicable for specific methods, techniques, and procedures such as advancing computer software skills that can be developed through vocational training as well as through on-the-job training programs.
Human skills – They are te people skills required for effective work with peers, followers, and superiors. Human skills include the ability to motivate others, verbal and non-verbal communication skills as well as the ability to create a positive team spirit. Based on this, a leader with high human skills is aware of their behavior as well as how they can affect others.
Conceptual skills – They are the skills required by a leader to allow them to think through and work with ideas, concepts, and hypotheses. Leaders who possess excellent conceptual skills are good at working with abstract ideas and hypothetical situations. Some of the essential conceptual skills for good leaders include creativity, deep strategic thinking, problem-solving, and decision-making.
It is essential that leaders possess all the three skills; conceptual, technical, and human skills. However, depending on where they are positioned in the management structure, there are skills that are more important than others.
An example of skills leadership is a leader using certain computer software packages to advance their technical skills effective for performing a programming task.
Situational Leadership The situational theory of leadership refers to the type of leaders who adopt various leadership styles according to the present situation and the development level of their team members (Meier, 2016). Situational leadership is an effective way of leadership as it adapts to the needs of the team and also helps set a beneficial balance for the entire organization. The situational leadership theory posits that the leader’s leadership styles and the follower’s maturity or levels of preparedness are two key elements that need to be matched appropriately. Four main approaches are identified by the situational theory of leadership as defined by Blanchard and Hershey, and they include telling, selling, participating, and delegating.
Telling and directing – In this style of situational leadership, the leader is required to provide specific guidance, support, and close supervision. The telling and directing leaders tend to make decisions and direct actions through interaction and communication. These leaders are closely involved and use a top-down approach, implying that the employees obey the directions provided by these leaders.
Selling and coaching – These kinds of leaders are open to the employees’ input and thus encourage them to submit their ideas and suggestions to improve business activities. The leaders effectively sell their concepts to the groups and aim to recruit their cooperation through debate and collaboration. However, the final decision is made by the leader.
Participating and supporting – These kinds of leaders provide fewer directions and leave the decision to be made by others. However, these kinds of leaders may be involved in overseeing operations; they expect others to make appropriate choices.
Delegation – These kinds of leaders tend to limit participation and leave most of the responsibilities to the group. However, they are consulted now and then, but decision making and project direction are primarily left to the group members.
An example of situational leadership can occur when an organization has a lot of work, such as hiring. During this time, lots of applications are made, and this may overwhelm the leaders. Since they cannot tackle all the applications, they may delegate the responsibilities to the junior groups, giving them the mandate to make final decisions. However, they might make consultations to their leader.
Leadership Theories Matrix
Complete the following sections using the provided matrix template.
Develop a leadership theories matrix that describes the definition and characteristics of various leadership theories and approaches to leadership (trait leadership, behavioral leadership, contingency leadership, skills leadership, and situational leadership).
Provide one or more examples to support the definition or characteristics of each form of leadership.
Write out your explanations in each section; each section should contain about 350 words.
Format your matrix consistent with APA guidelines.
References
Derue, D. S., Nahrgang, J. D., Wellman, N. E. D., & Humphrey, S. E. (2011). Trait and behavioral theories of leadership: An integration and meta‐analytic test of their relative validity. Personnel psychology, 64(1), 7-52.
Holmberg-Wright, K., & Hribar, T. (2016). Soft skills–the missing piece for entrepreneurs to grow a business. American Journal of Management, 16(1).
Jansen, J. J., Kostopoulos, K. C., Mihalache, O. R., & Papalexandris, A. (2016). A socio‐psychological perspective on team ambidexterity: The contingency role of supportive leadership behaviours. Journal of Management Studies, 53(6), 939-965.
Meier, D. (2016). Situational Leadership Theory as a Foundation for a Blended Learning Framework. Journal of Education and Practice, 7(10), 25-30.
Phillips, A. S., & Phillips, C. R. (2016). Behavioral styles of path-goal theory: An exercise for developing leadership skills. Management Teaching Review, 1(3), 148-154.
University of Nebraska medical center
University of Nebraska medical center
Name:
Number:
Course:
Lecturer:
Table of ContentsTOC z o “1-3” u hTable of Contents PAGEREF _Toc417232926 h 21PURPOSE PAGEREF _Toc417232927 h 42CORPORATE GOVERNANCE PAGEREF _Toc417232928 h 42.1 RISK MANAGEMENT PAGEREF _Toc417232929 h 42.2 CODE OF CONDUCT PAGEREF _Toc417232930 h 43BUSINESS OPERATIONS PAGEREF _Toc417232931 h 53.1 FACILITY MANAGEMENT & PLANNING PAGEREF _Toc417232932 h 53.2 RECORDS MANAGEMENT PAGEREF _Toc417232933 h 54COMMUNICATIONS PAGEREF _Toc417232934 h 64.1 COMMUNICATIONS PAGEREF _Toc417232935 h 64.2 INFORMATION SHARING PAGEREF _Toc417232936 h 65ASSET MANAGEMENT PAGEREF _Toc417232937 h 65.1 COMPUTER/DEVICE TRANSFERRED BETWEEN PRIMARY USERS WITHIN THE SAME DEPARTMENT PAGEREF _Toc417232938 h 65.2 COMPUTER/DEVICES SOLD/TRANSFERRED TO A DIFFERENT DEPARTMENT PAGEREF _Toc417232939 h 76COMPLIANCE PAGEREF _Toc417232940 h 76.1 COMPLIANCE TRAINING PAGEREF _Toc417232941 h 76.2 FINANCIAL COMPLIANCE AND COST ANALYSIS PAGEREF _Toc417232942 h 87CUSTOMERS PAGEREF _Toc417232943 h 87.1 RED FLAG IDENTITY THEFT PREVENTION PAGEREF _Toc417232944 h 87.2 ASSESSMENT AND REPORTING PAGEREF _Toc417232945 h 88INCIDENT MANAGEMENT PAGEREF _Toc417232946 h 98.1 ROLE OF UNIVERSITY CHIEF INFORMATION SECURITY OFFICER PAGEREF _Toc417232947 h 98.2 PROTECTED HEALTH INFORMATION (PHI) PAGEREF _Toc417232948 h 99APPLICATION DEVELOPMENT PAGEREF _Toc417232949 h 109.1 CONFIGURATION GUIDELINES IN COMPLIANCE WITH HIPAA PAGEREF _Toc417232950 h 10In this case, the configuration will be such that the healthcare plus the additional types of patient information and /or data shall be stored either provisionally or permanently in the back end database outside the control of patient. Data confidentiality is one of the main challenges for patients who use the cloud based services such as it will be for this case. PAGEREF _Toc417232951 h 109.2 ASSESSMENT AND CERTIFICATION GUIDELINES IN COMPLIACE WITH HIPAA PAGEREF _Toc417232952 h 1010IT OPERATIONS PAGEREF _Toc417232953 h 1010.1 UNMC NET ID ACCOUNTS PAGEREF _Toc417232954 h 1010.2 UNMC EMAIL ACCOUNTS PAGEREF _Toc417232955 h 1011OUTSOURCING PAGEREF _Toc417232956 h 1011.1 INFRASTRUCTURE OUTSOURCING: NETWORK SERVICES PAGEREF _Toc417232957 h 1011.2 INFRASTRUCTURE OUTSOURCING: SECURITY SERVICES PAGEREF _Toc417232958 h 1112ACCESS CONTROL PAGEREF _Toc417232959 h 1112.1 ACCESS CONTROL SYSTEM COMPONENTS PAGEREF _Toc417232960 h 1112.1.2 WORKSTATION ACCESS CONTROL PAGEREF _Toc417232961 h 1112.2 PHYSICAL / ENVIRONMENTAL PAGEREF _Toc417232962 h 1112.2.1 HIPPA COMPLIANT ACCESS PHYSICAL SAFEGUARD ACCESS CONTROL PAGEREF _Toc417232963 h 1112.2.2 BARRIERS AND PROCEDURES ESTABLISHING CONTROLLED AREAS AROUND THE BUILDING PAGEREF _Toc417232964 h 1213POLICIES & PROCEDURES PAGEREF _Toc417232965 h 1213.1. DEPARTMENT PERSONNEL RESPONSIBILITIES PAGEREF _Toc417232966 h 1213.2 SECURING CAMPUS BUILDINGS AFTER NORMAL BUSINESS HOURS PAGEREF _Toc417232967 h 1214PRIVACY PAGEREF _Toc417232968 h 1214.1HEALTH INSURANCE PORTABILITY AND ACCOUNTABILITY ACT PAGEREF _Toc417232969 h 1214.2GRAMM – LEACH – BLILEY ACT (GLBA – 16 CFR PART 314) PAGEREF _Toc417232970 h 1315SECURITY PAGEREF _Toc417232971 h 1315.1PRIVACY/CONFIDENTIALITY PAGEREF _Toc417232972 h 1315.2COMPUTER USE/ELECTRONIC INFORMATION PAGEREF _Toc417232973 h 1316SUMMARY PAGEREF _Toc417232974 h 1317REFERENCES PAGEREF _Toc417232975 h 14
PURPOSEThe purpose of this paper is to prepare security plan that offers security awareness policy framework outline according to the critical infrastructure which concentrates on identifying, protecting, detecting, responding and recovering of disasters.
CORPORATE GOVERNANCE2.1 RISK MANAGEMENTRisk management will involve identification of the possible risk factors by the University medical IT team. Risks will also have to be detected once they occur, followed by response against the risk by the relevant team of expert from the It department. However, the issue of risk management will involve corporate participation of all system users together with the executive management team of the medical center. The management will also involve the design of medical devices through consideration of security and privacy from the initial phases of requirements specifications and all through the development lifecycle of the medical software. The whole process of risk management will thus various processes such as constant monitoring of information security which in turn requires maintenance of the continuing awareness for privacy and security controls, threats and vulnerabilities. The main aim is to carry out constant checking of the security for the university medical center’s network together with information, the IT systems in place. This will be followed by timely response, avoidance or risk alleviation strategy as circumstances continues to vary. Risk assessment will also be carried out as part and parcel of risk management process. The extra control of procedures, processes and equipment used will have to be employed for the sake of minimizing risks on medical information.
2.2 CODE OF CONDUCTThe code of conduct will apply to all staff and the users of health records within the university medical center. Some of the codes of conduct will include the following: Limitation of use whereby patient data and other personal and confidential data are not allowed to be disclosed, made accessible or used for different purposes which differs from the ones specified except with the permission from the relevant subject or through the right of law. Security defense must be observed where patient and other sensitive data should be safeguarded by means of sensible security safeguards against risks like loss or illegal access, destruction, data disclosure, alteration or even use of data. Openness: As part of conduct, there should be broad policy concerning medical center operations, policies and practices in relation to personal data. The medical data controller should also be accountable for complying with measures which give effect to the principles such as openness, limitation of use, security safeguard and others. In the case of any disclosure of individual information about patient, a notice or awareness should be given to those concerned in advance.
The concerned medical staff should ensure that there is no leakage or loss of patient data or records. Therefore, the data clerks, database administrator together with the chief information officer should ensure that the stored data records are accurate and secure. In addition, they should ensure high integrity of data. The medical information staff should also ensure that information is made available where necessary to the concerned stakeholder within the shortest time possible. The purpose for which individual data gathered should be specified at a time not later than the time of data gathering and the succeeding use constrained to the achievement of those purposes. The users and data administrators should also follow practice principles that govern electronic medical record and guidelines with respect to patient care according to HIPAA rules. In other words, fair information practices should be followed by the medical staff members. The staff should also report any perceived incident of risk in advance before the actual happening takes place. Disasters should be reported to the disaster recovery manager and to the administration at large within the shortest time possible. In addition, the data controller should be accountable for meeting the key principles.
BUSINESS OPERATIONS3.1 FACILITY MANAGEMENT & PLANNINGThis will involve management of University medical center network which in general will comprise of traffic management, delay and distortion management, security management and the management of network equipment used. The traffic management shall have the role of achieving high quality of service across the medical network during the process of sending and receiving data/information. Traffic management shall include the use of traffic security design for media aware control. The media aware traffic control architecture used shall consists of key management for scalable and non-scalable scheme, batch keying for periodic, leave rekeying and join rekeying, authentication which include group, source and single sender authentication measures and watermarking for single and multiple copies.
The management of delay and distortions shall use algorithms for traffic management to control and minimize the effect of both transmission delay and signal distortion. The facility management and planning shall make use of firewall for packet filtration to ensure that invalid packets do not pass through the nodes of the network. There shall also be management of potential malicious attack by viruses and cyber criminals for the purpose of keeping transmission of patient related information safe and secure. The management of leaked and modified information shall also be carried out to maintain the integrity of patient medical records.
3.2 RECORDS MANAGEMENTThe medical electronic records shall be concealed from the management staff, insurance providers, researchers and other individual personnel who do not have any suitable privilege for the access of such records. Several electronic health records shall not be linked to the same owner to stop patient profiling. The access of medical records shall also be restricted by means of password, access controls and other possible authentication measures. The management and access of patient’s health records shall be done in accordance with the HIPAA rules, regulations and guidelines that guides that defines patient care and treatment procedures.
COMMUNICATIONS4.1 COMMUNICATIONS Communication process within the university medical center shall be made possible through the use of both software and appropriate hardware. Web browsers will serve as clients with any suitable server software. The hardware to be used will include personal computers for both clients and servers. Firewalls in addition to virtual private network will also be used to enhance secure communication between communicating nodes. The medical center network will thus use the services of the internet such as transfer control protocol/internet protocols and the World Wide Web to get the services of the internet within its internal network. The communication infrastructure as whole will employ the use of both guided and unguided transmission mediums. The guided mediums shall include optic fiber cable for quick transmission at several terabytes of data second. The CAT5 network cables shall also be used within the network layout to get data signals from the source. The network Switches will data signal sources where the batch codes will link the switch to the batch panel. The batch panel is a network hardware device where all other CAT 5 network cables from the access points shall be terminated. Microwave transmission will be used as non-guided medium based on the line of sight of points of communication.
4.2 INFORMATION SHARINGThe hybrid share generation and distribution system shall be used to attain dependable and fault tolerant original data storage through offering redundancy for the innovative components of data depending on the principle of secret sharing and erasure coding. Information sharing shall also take place through the use of server computers to provide internet services to various client computers within the university medical center. The information sharing shall also be regulated to ensure that users can only access particular parts or section of health information at a given time. The efficient data integrity verification system which exploits the methods of algebraic signatures shall be employed in order to guarantee the dynamic integrity of the distributed data sharing for the health medical records information.
ASSET MANAGEMENT5.1 COMPUTER/DEVICE TRANSFERRED BETWEEN PRIMARY USERS WITHIN THE SAME DEPARTMENTAny transfer of computing device between primary users within the same department shall be done with the approval from the IT manager. The process of transfer shall also ensure that the reasons behind such transfer are well documented. If the transfer involves the change in the use of the computer, then the existing files shall be backed up in other removal storage devices and/or other computers to avoid free access of the same information by different users of the same department. The transfer of the computer or device will also be transferred with the condition that the transfer process does not compromise both the logical and physical security of the entire network system within the university medical center.
5.2 COMPUTER/DEVICES SOLD/TRANSFERRED TO A DIFFERENT DEPARTMENTThe transfer of computers and/or other communication or internetworking devices to a different department will also be done through the approval of both It manager and network administrators. This kind of device transfer shall also be done according to rules and regulations that governs the use of IT equipment within the medical center. The transfer process of computers and related devices shall be carried out if at all there is need to transfer the entire system files from one department to another for use in that new department. In case one department has computers and other devices in excess supply of what it needs, then the IT manager shall also have the responsibility of recommending the transfer of the excess devices or hardware resources to the another department which lacks sufficient resources.
The sale of computer or devices to another department shall take place in case the two departments are completely separate and do not operate or function for a common goal. On department may also decide to sell devices and other IT equipment to a different department if the buying department has few resources. The selling of devices and computers will also be subject to the fact that every department is responsible for buying its own IT equipment. In this case, the department which has managed to buy sufficient number of computers and devices shall be permitted to sell extra resources to the medical center department that is willing to buy. The sale will also be permitted only with the condition that the equipment to be sold are still fresh are thus are not subject to breakdown in the near future. The specifications of the devices and computers being sold will have to meet those of the ones used as nodes within the existing computer network to allow the buying department to get an easy way of connecting to the network. The issue of similarity in specification will be considered very crucial to ease the IT maintenance process of the network and the connected devices. Last but not least, the sale of computers and devices shall be permitted under conditions that devices needed by the other department are not easily available in the market or at the vendor shops.
COMPLIANCE6.1 COMPLIANCE TRAININGAll the staff, both IT and the medical staff members in the university medical center shall be subject to training by the medical center concerning the various codes of conduct for the use of electronic health records. The in-house training approach will be employed. The main aim of this training is to ensure that every staff follows rules and regulations that govern the use of medical health records in the university medical center. This also means that those employed as the users or administrators of the electronic health system will have to meet certain qualifications before they can use the IT medical records. Failure by any member of staff to comply with the stipulated rules and regulations, then the concerned member faces discipline committee or consequences of the law. The compliance training shall be carried out by the top management of the IT department with the help of executive management team.
6.2 FINANCIAL COMPLIANCE AND COST ANALYSISThe implementation of this policy is subject to financial compliance by the medical center to budget and invest in the security system for the management of parent’s records. Nevertheless, the cost of implementing this policy may not be that expensive given that it is to complement the existing cybersecurity framework of the program. The university medical center management system is therefore to use its existing processes and procedures for leveraging the framework in order to identify the opportunities to be strengthened. Therefore, the cost of compliance in this case will be considerably low since the policy plan is to be subjected to the already existing network infrastructure framework.
CUSTOMERS7.1 RED FLAG IDENTITY THEFT PREVENTIONThe maintenance of data using portable computers , removable media and embedded devices are prone to more risk of theft and loss of data and / information as compared to when the same data are upheld and processed within public cloud which on the other hand is characterized by less risk. As a result, this policy plan considers the use of cloud service providers for identification of theft and prevention. The use of cloud service providers thus is more convenient because it will also help in the cost minimization of the operational expense than when the university medical center installs and operate the entire IT infrastructure on their own (Jansen & Grance, 2011).
The customer’s data or information will thus be prevented from theft by cyber criminals or man in the middle. This prevention shall be carried out by identifying the possible existence of theft and raising the red flag concerning the situation. The cloud service providers shall help in the theft identification as well as prevention processes. However, any staff has the responsibility of identifying the existence of possible theft of customer’s sensitive data from the medical center. An example of information theft is the risk of images being run by consumers (Jansen & Grance, 2011).
7.2 ASSESSMENT AND REPORTINGThe assessment of risk shall take place after the identification. The assessment shall be carried out for the purpose of knowing the magnitude of the risk in terms of its possible effect or havoc in the case where it is not alleviated. The risk assessment shall be conducted primarily to find out if there is considerable risk of harm to the customer (patient’s data) due to the breach of information according to HITEC act. The HITEC act sets forth fresh standards for notification of information breach within the health care industry and which requires covered entities to give notifications to the individuals affected (Hirsch & DEIXLER, 2013). The risk assessment shall also be used to examine the effectiveness or inefficiencies of the infrastructure security system installed by the university medical center in order to remain safeguarded from the cyber threats that are emerging. As a result, these permits shall permit the medical center to install patches and accept the needed measures of security for the purpose of protecting the medical center from the probable cyber attacks (Shah & Mehtre, 2013).
The two risk assessment approaches shall be employed, that is exploratory testing and systematic testing. The exploratory testing makes the use of Vulnerability Assessment and Penetration testing (VAPT) as an evaluation tool that guarantees cyber security. The VAPT tool is significant in scanning of every system component for the existing risk without any particular test plan and previous experience. The systematic testing shall involve the use of testers which follows the predefined plan of test instead of exploring (Shah & Mehtre, 2013).
INCIDENT MANAGEMENT8.1 ROLE OF UNIVERSITY CHIEF INFORMATION SECURITY OFFICERThe University Chief information security officer shall be responsible for handling all the information security incidents that are under the security rule. Any breach of vulnerable health information shall be reported to him/her as required through the breach notice rule. The chief information security officer shall use the organized available approach in order to tackle the results of the attack against safety of the computer network system in the university medical center. His/her responsibility shall involve making sure that the risk incidence case is reported to the cloud service provider who are in turn expected to take action within the shortest time possible. Once the incident is reported, the cloud provider shall be responsible for carrying out incident response activities which also includes verification of incidents analysis of attack, data gathering, containment, problem solution, and finally restoration of service. The Chief information security officer will thus ensure that the service operations in the medical center are appropriately restored within the acceptable time limit according to the service level agreement between the university medical center and the cloud service providers. The Chief information security officer shall handle a variety of risks ranging from data transmission errors, information theft, loss of data and/or information, hacking and all other kinds of cyber security attacks, whether internal or external the medical center.
8.2 PROTECTED HEALTH INFORMATION (PHI) The illegal acquisition, access, use or exposure of protected health information (PHI) compromises the safety and privacy of protected health information. Therefore, any attempt to disclose the PHI is considered as information breach. In the case of suspected breach of PHI, the nature and the scope of HPI shall be evaluated. This implies that entities that are covered will have to take in to an account the kind of HPI concerned. Secondly is to consider the person to whom the impermissible exposure of HPI was made. Third, is the investigation of whether the protected health information was actually gotten, viewed or whether it was just an opportunity that was available for acquiring or viewing information. The forth step of assessment is to consider the scope to which the vulnerability to the HPI has been alleviated. The associated risks, for example, shall be alleviated by means of getting the satisfactory assurance of the recipient that the information will not be used again in future or will not be exposed or destroyed. This can also involve the considering the scope and effectiveness of the of the risk alleviation when finding out the probability that the protected health information has been compromised (Hirsch & DEIXLER, 2013).
APPLICATION DEVELOPMENT9.1 CONFIGURATION GUIDELINES IN COMPLIANCE WITH HIPAAIn this case, the configuration will be such that the healthcare plus the additional types of patient information and /or data shall be stored either provisionally or permanently in the back end database outside the control of patient. Data confidentiality is one of the main challenges for patients who use the cloud based services such as it will be for this case.9.2 ASSESSMENT AND CERTIFICATION GUIDELINES IN COMPLIACE WITH HIPAAThe assessment and certification here will include some of the best practices and agreement frameworks. The practices include the general criteria for security evaluation for IT according to ISO 15408 certification which is a technical standard that certifies the degree of security presented by the safety measures in the implementation of information systems. The second practice is the control objective for IT which is an international standard for administration of IT that looks for to bringing together the models of business controls together with the models of IT controls. Other practices shall include guidelines for the IT security administration under ISO 13335, Information technology library infrastructure and critically operational threat, asset and susceptibility assessment and others (Saint-Germain, 2005).
IT OPERATIONS10.1 UNMC NET ID ACCOUNTSThe NET Id accounts will be assigned only to the medical and technical staff of the university medical center. This will be used as a way of restricting access to the university medical site freely by unauthorized persons. Nevertheless, every staff shall have different and unique ID accounts that will be relevant only to that particular staff as a user.
10.2 UNMC EMAIL ACCOUNTSEvery staff will also have unique e-mail accounts that will be relevant to that particular staff. However, that shall be one general email account that will belong to the medical center management through the office of human resource. The general email account will used by clients to communicate with the management of the medical center. His general email will be valid for use all the time. However, the individual staff emails will only be valid for use at restricted times of the day.
OUTSOURCING11.1 INFRASTRUCTURE OUTSOURCING: NETWORK SERVICESThere shall be outsourcing of network services from the cloud computing service providers such as Amazon. The cloud service providers shall be responsible for the management of the medical center network infrastructure. The roles of outsourced cloud service provider shall include risk identification and, assessment and solution through provision of business continuity and disaster recovery. This is basically information security services to the medical center. They will also be responsible for the management of software such as installation and maintenance of operating systems and other hardware equipments used for computer network infrastructure. The roles offered shall be based on the service level agreement to be signed between the university medical center and the service provider. The three main types of services to be provided via outsourcing comprise of information as a service, platform as a service and software as a service. The three services offered are considered relatively cheap as compared to the infrastructure installed and managed by the medical center itself.
11.2 INFRASTRUCTURE OUTSOURCING: SECURITY SERVICESThe security services to be outsourced from the cloud service provider include information security, hardware security and software security. The security of information shall be implemented by assigning the users of medical center different levels of log in privileges such that there will be high level users, low level users and middle level users.
ACCESS CONTROL12.1 ACCESS CONTROL SYSTEM COMPONENTSAccess control is a kind of safety characteristic used to control the right of entry into systems and network resources. The main aim is to safeguard information from loss, damage, deletion, theft or alteration either accidentally or intentionally by illegal access users. The components include network access components, system access components and data access components. The network access component will allow network users to access every resource on the network, thus needs to be protected, checked and restricted. System access component allows users to access the system within the network. This may include servers printers and others devices which can be shared on the network. This call for the restriction, protection and monitoring on the access of the devices. Data access components will permit users to access data o the resource of the network continuously. Users can access, modify files, database and other documents which all require protection, monitoring and restriction (Rao & Nayak, 2014).
12.1.2 WORKSTATION ACCESS CONTROLThe workstation access control components provide an area of computing where access control measures are configured through the central server system. It can be used to solve de-authentication problems in hospital or medical center by deployment of a group of workstations with unique sensors designed for the detection of human closeness. The close sensors can thus detect the human’s departure as the person walks away and signs the person out where possible. Nevertheless, this kind of system is not completely efficient since it has no minimum distance for detection, implying that it is prone for manipulation (Sinclair, 2014).
12.2 PHYSICAL / ENVIRONMENTALThe physical /environment include the hardware equipment such as computers, cables and even the building room where the medical computer network is set up or where the entire network is controlled. The physical/ environment shall be safeguarded by use of method such as computer locks and room locks to keep the physical devices from an attack or from theft.
12.2.1 HIPPA COMPLIANT ACCESS PHYSICAL SAFEGUARD ACCESS CONTROLThe medical center shall employ the use of HIPAA compliance rules that governs all medical transactions and sets of code to be maintained by Medicare and Medicaid center services. The HIPAA rules are mainly concerned with software vendors, health plans, and data clearing houses which are used irrespective of the environment where computation is carried out. The access to personal medical data and related information shall be monitored, protected and restricted from unauthorized access according to HIPAA rules (Regola & Chawla, 2013).
12.2.2 BARRIERS AND PROCEDURES ESTABLISHING CONTROLLED AREAS AROUND THE BUILDINGThe medical center perimeter shall be secured, the unsuitable and improper access restricted to the resources of the medical center, the controls shall include the use of microwave barriers, CCTV cameras, electrical fences in addition to the system of intrusion detection that is sensor based. This shall also include the use of security guards to offer guarantee for the physical control access by making sure that the entry as well as exit controls are suitably offered and checked. Other will include the use of badge systems and biometric control access (Rao & Nayak, 2014).
POLICIES & PROCEDURES13.1. DEPARTMENT PERSONNEL RESPONSIBILITIESThe IT department personnel shall include Chief information officer, data manager, system analyst, It technicians and data clerks. The Chief information officer shall be responsible for overseeing the overall management of IT infrastructure ranging from the information security, network security, infrastructure security and many others. The data manager will ensure that the medical data meets the standards in terms of integrity, completeness, redundancy, error free and that all the reports are from data are available within the acceptable limits of time. The system analyst shall be responsible for assessing or evaluation the electronic medical center system for weakness, error or for any malfunction from time to time. The IT technician will be responsible for repair and maintenance of all computing devices, maintenance of computer network, repair and problem troubleshooting. The data clerks will be responsible for entering data into the computer systems of the university medical center by typing.
13.2 SECURING CAMPUS BUILDINGS AFTER NORMAL BUSINESS HOURSAfter normal business hours, the campus building shall be manned by security guards. In addition, there shall be CCTV installed at various positions from outside the building to keep track of any persons who may be responsible for physical attacks to external communication equipment like microwaves.
PRIVACYHEALTH INSURANCE PORTABILITY AND ACCOUNTABILITY ACTThe medical center policy shall conform to the HIPAA privacy rule which may subject business associates to HIPAA penalties in case they happen to go against the needed terms of agreements for business associates. The ultimate rule under this act states that the associates may be directly accountable under privacy rule for disclosures and use of protected health information in violation of agreement for the business associates or rule of privacy; failing to disclose protected health information to the secretary of HHS to evaluate the compliance of business associates with the rule of privacy; failure to make sensible effort to constrain the use and disclosure of protected health information, and the protected health information requested from a covered entity, to the suitable minimum for the accomplishment of the planned purpose; failure to disclose protected health information to confor