10
votes

I have been wondering this past week because my big boss told me to start keeping track of all the things I have fixed, how to fix them, etc. Which is reasonable and have been doing anyway. But then a related question came to mind. What kind of documentation should I have on hand as far as users go. More specifically I am talking in terms of EULA, ToC, etc (correct me please if I'm using the wrong terms) Or more specifically a policy, so to speak, for the users and such. Can't say I'm a legal expert, otherwise I'd be a lawyer. The environment the users are in is pretty laid back so I don't forsee a problem. But assume that there should ever arise a problem, what should I have written up/have on hand?

EDIT: I really should have noted that we are a medical transport facility and have patient records so I know that something must be done there to comply with HIPAA policies I believe. I do like what anthonysomerset said about the "If I get by a bus" Scenario and want to apply it not only to the documentation I am currently writing but also for if say an employee were to steal info from the server or edge cases, theft, etc. As far as our staff, its relatively small as in a single HR person, no legal department aside from the 2 owners' lawyers and me being the only IT person on staff with a guy who is no more than a mac superuser.

4
  • 4
    I think your legal documentation requirements will wholly depend on what context you're using them for. Are you a hosting provider needing docs for hosting customers? Are you some type of service provider needing docs for your customers? Are you an IT guy that just wants your users to follow policies?
    – GregD
    Aug 31, 2011 at 14:22
  • We don't host anything currently, all the servers are for internal work only and its in medical transport so we do have patient information and the such on the servers that dispatchers and all office employees access daily. Like I said, its pretty laid back and the bosses don't care too much when employees are on Facebook and the such as long as they're doing their job properly.
    – Tablemaker
    Aug 31, 2011 at 14:44
  • 1
    Then in that case, I would assume that HIPAA will be the foundation of your documentation. Having said that, someone mentions below, and I'll reiterate, it probably isn't solely IT's responsibility for "legal documentation". That's better left to management/HR.
    – GregD
    Sep 1, 2011 at 5:45
  • This question is very off-topic now. Jan 21, 2015 at 15:53

4 Answers 4

10
votes

You should work with your boss/HR people to have a series of written policies, adopted by the supervisors, that outline how various issues are handled and what is expected of employees. These can vary depending on the business, but basically you would have documents that specify what is and isn't allowed on your network and computer systems and what the followup (how remediation is handled, what can lead to termination, etc.) actions are. Then your employees are given the material as part of an employee handbook or memo, possibly to sign and keep on file.

Come up with scenarios that you would have to deal with in terms of acceptable use on the computer systems and then talk to your boss about it; unless you have the authority to fire someone you should work on the language of the policies with other heads-of-departments or supervisors. If you have a legal department you will want it run through them as well to make sure you're not stepping on legal issues involving privacy or termination in your area.

Ideally your business already has some employee handbooks or materials that employees have to be aware of and prop their desks up with, so there could be some idea of a template in there to work from for you.

3
  • 2
    i was writing pretty much the same thing but was beaten to it, the other thing is that the stuff he has asked you to do is classic "if i get hit by a bus" documentation to cover the gaps if you for whatever reason were no longer able to fulfil your duties Aug 31, 2011 at 14:24
  • +1 for the desk props. However, with my big boss continually being MIA this will be a bit tougher than I thought. They definately want me to present new employees with AUP's and the like when the first do all their introductory documentation (the fun that it is) in a web based form once I get some sort of web site with employee portal running. Not too sure if he has any literal handbook though, I'm sure he at least has signed paperwork in their files.
    – Tablemaker
    Aug 31, 2011 at 15:02
  • 4
    Just wanted to add that while you should work with your boss/HR on this that the ball is in their court and IT cannot/shouldnot be the driving force when it comes to polices, it should be from the business owners/management, otherwise you are just the angry BOFH and people will have zero respect for your policies.
    – mtinberg
    Aug 31, 2011 at 15:25
3
votes

Our office just went through this. However we have to comply with HIPAA. We took a framework for our IT standards from an online version, and fleshed it out. I personally wrote a vast majority of the policies. As @Bart Silverstrim said you will need to work with your HR person. We were a two person team for our standards doc.

It isn't easy. Just go slowly and methodically. Start with your day to day routine, and jot that down in a bulleted list. There is a whole list of ideas just a sample of ours

  • Classification of data
  • Risk Analysis management
  • Ids and Accounts
  • personnel security
  • Change control/audit log
  • Hardware and software
  • BC/DR (every company should have this regardless)

There is much much more, it all depends on how far you want to go.

We have these standards(rules) in place to cover ourselves in case someone breaks HIPAA. So we can say "hey, we have these rules, and the broke them".

This is the framework that we used. It may or may not work for you also.

5
  • The HIPAA stuff definately applies here as we are a medical transport company with a lot of patient info that is accessed daily.
    – Tablemaker
    Aug 31, 2011 at 14:46
  • 1
    Oh wow, that really sucks :) we don't handle any claim or patient info, so a lot of HIPAA doesn't apply to us (luckily). Ask the provider(s) for examples of their documentation, we asked ours and they gave us gobs of it. Aug 31, 2011 at 14:48
  • If you need more help, just email me (email in profile) Aug 31, 2011 at 14:54
  • Actually, if you could give me the link for that framework, that would be much appreciated. :)
    – Tablemaker
    Aug 31, 2011 at 15:00
  • made the edit to the answer Aug 31, 2011 at 15:15
2
votes

We have right now four documents that we use:

  • Acceptable Use Policy - for students
  • Acceptable Use Policy - for faculty/staff
  • Copyright Education document - meets a new-ish federal requirement for higher ed
  • Service Level Agreement - details where IT's responsibilities start and stop, and the expectation for up-time of our services (still in development, but I expect this is a never-ending process for many).

Of course we keep many other records as well, but this is about it as amounts to public legal documents.

Patient records is a whole other ballgame, and my last gig was in a medical billing office. There are, of course, many additional regulations you must follow, but the only legal document I still recall is that you must obtain and keep a legal record of permission from individuals before you can share any "personally identifiable information" with other parties.

2
  • 1
    I do like the SLA thing mostly because I have already been approached by some people asking me to come to their house to fix their personal computer, saying it's my job (as in, won't compensate me for driving or time). Gotta love it xD.
    – Tablemaker
    Aug 31, 2011 at 15:15
  • 1
    @Shads0 - Yeah, the only case where that would ever be part of your job is if you have a vpn client that you provide and support. An SLA proves this. Even then, I prefer to only do this for company-issued laptops when I can get away with it.
    – Joel Coel
    Aug 31, 2011 at 15:19
1
vote

You've already received some great advice -- a few thoughts specific to the medical field (not all IT-related, but if you're storing patient data electronically there is a LOT of bleed-over):

  • In addition to the framework Thoreau linked above you can use the Payment Card Industry Data Security Standards (PCI DSS) as guidance for securing patient information -- wherever it says "cardholder information" or similar think HIPAA-protected stuff, mainly PHI/ePHI.

  • It's important to have enough documentation to prove compliance with reasonable security procedures (proving compliance with the relevant parts of PCI-DSS or other frameworks).

  • You will want a HIPAA compliance statement and HIPAA compliance policies (detailing who has access to PH/ePHII, under what circumstances, etc.).
    Part of this policy should include how you verify the identity of information-requestors.
    A separate part of this policy should deal with how you protect your backups, information in transit, etc.

  • From a legal-covering-of-your-ass perspective you also need (and probably already have) confidentiality forms signed by anyone who has access to that information -- At my company they are reviewed and re-signed annually at your performance review.
    Ensure that these are broad enough to cover ePHI (electronic records).

Not the answer you're looking for? Browse other questions tagged .