Policy, Program and Procedures

 View Only

  • 1.  Individual Physician Consultant

    This message was posted by a user wishing to remain anonymous
    Posted 12 days ago
    This message was posted by a user wishing to remain anonymous

    How does your organization handle individual medical professionals (e.g., physicians, medical consultants, peer reviewers) who perform underwriting or claim-related reviews and require access to sensitive personal and medical information?

    Specifically:

    • Are individual practitioners considered third parties subject to your TPRM policy?
    • Do they undergo the same risk assessment and due diligence process as traditional vendors?
    • If not, do you have an alternative assessment approach for individuals who are not operating within a formal corporate control environment?
    • How do you evaluate information security risks when these professionals access highly sensitive information but may not have the ability to complete a standard security questionnaire (e.g., SIG)?
    • Are there compensating controls, contractual provisions, or access restrictions that you rely on instead?

    We are evaluating an individual physician consultant who will review medical records and underwriting files containing highly sensitive personal and health information. Our standard process would typically require an information security assessment, but we're interested in understanding how other organizations address situations where the third party is an individual professional rather than an established vendor with a mature control environment.



  • 2.  RE: Individual Physician Consultant

    Posted 5 days ago
    • Are individual practitioners considered third parties subject to your TPRM policy? Yes
    • Do they undergo the same risk assessment and due diligence process as traditional vendors?  No
    • If not, do you have an alternative assessment approach for individuals who are not operating within a formal corporate control environment? We created a customized questionnaire for companies with less than 5 employees that focuses on controls for people working from their homes.
    • How do you evaluate information security risks when these professionals access highly sensitive information but may not have the ability to complete a standard security questionnaire (e.g., SIG)? We look at things like network controls such as secure firewall, standard endpoint controls like system lock time, physical controls like locked storage or office space for files, clean desk and clear screen, and professional credentials. It is a light assessment.
    • Are there compensating controls, contractual provisions, or access restrictions that you rely on instead? I am not familiar with how contracts are done for these third parties.

    Thank you,

     

    Vickie McGregor CISSP, CCSK, CISA, CTPRA, CTPRP, CDPSE

    Third-Party Risk Management Consultant / Privacy and Third Party Risk Dept.

     

    614-356-0958 - Mobile

     

    signature_1277781578

     

    signature_1777845039  signature_342851659  signature_671486466  signature_322587541  signature_1298600858

     



    Disclaimer

    This message (and any attachments) is confidential and is intended only for the addressee(s). This message may contain information that is protected by one or more legally recognized privileges. If the reader of this message is not the intended recipient, I did not intend to waive, and I do not waive, any legal privilege or the confidentiality of the message. If you receive this message in error, please notify me immediately by return e-mail and delete this message from your computer and network without saving it in any manner. The unauthorized use, dissemination, distribution, or reproduction of this message, including attachments, is prohibited and may be unlawful.