Security awareness, password and authentication policy

Granite City Family Dental — Policy set version 1.0 — Effective November 1, 2026 — Binder edition 2026

Authority: 45 CFR 164.308(a)(5) (security awareness and training) and 164.312(d) (person or entity authentication).

Approved by Dr. Maria Lindqvist, Owner. Responsible officer: Janelle Okafor, Office Manager.

Purpose and scope

People, not systems, are the first target of most attacks on a practice of this size. This policy sets what every workforce member of Granite City Family Dental is taught, how they prove who they are when they sign in, and how they use email, the internet and practice devices. It applies to every employee, provider, owner, contractor, student and volunteer.

1. Security awareness program

Authority: 45 CFR 164.308(a)(5)(i).

• New hires complete security awareness training within 30 days of hire and before unsupervised access to PHI.
• Every workforce member repeats the training annually. Source of training: CRU training seats (included with add-on).
• Completion is tracked by Janelle Okafor on the training roster (document 12 and the registers appendix).
• Owners and providers train on the same schedule as staff.
• Training is repeated for everyone when a policy changes in a way that affects daily work, and for the people involved after any incident.

Topics covered every cycle: recognizing phishing and social engineering; password and MFA rules; locking screens and clean desks; what counts as PHI and the minimum-necessary rule; reporting incidents; safe use of email, texting and fax; working remotely; what happens under the sanction policy.

2. Security reminders

Authority: 45 CFR 164.308(a)(5)(ii)(A).

Janelle Okafor issues a security reminder quarterly: a huddle topic, a short email, or a poster in the break room. The HHS OCR cybersecurity newsletter and the 405(d) "Knowledge on Demand" videos are approved free sources. The date and topic of each reminder are noted on the training roster or in the annual review minutes.

3. Protection from malicious software

Authority: 45 CFR 164.308(a)(5)(ii)(B).

• Endpoint protection: CRU Security Suite (managed ESET) is installed on every workstation, laptop and server, updates itself automatically, and reports to CRU Technologies.
• Patching: operating system and application updates are applied automatically by the it provider within 30 days.
• Workforce members do not install software, browser extensions or apps on practice devices without the IT provider's approval, and never disable protection.
• Suspicious attachments or links are not opened; they are reported under section 9.

4. Log-in monitoring

Authority: 45 CFR 164.308(a)(5)(ii)(C).

• Failed sign-in attempts are limited by lockout on Windows, email and the EHR where the system supports it.
• Sign-in records are kept on: EHR access log, Email sign-in log (M365 / Google), Windows event logs, Firewall log and Backup job log. CRU Technologies with Janelle Okafor reviews them monthly for sign-ins at odd hours, from unexpected places, or repeated failures (see document 21).
• A workforce member who notices they are locked out without cause, or receives an MFA prompt they did not start, reports it at once; it may mean someone else has their password.

5. Password management

Authority: 45 CFR 164.308(a)(5)(ii)(D).

The password standard at Granite City Family Dental:

Minimum 12 characters; passphrases encouraged; no reuse of the last 4; changed on suspicion of compromise; stored only in the approved password manager; never shared, written on notes or sent by email.

• Default passwords on any new device, router, printer or account are changed before first use.
• Passwords are never the same as a personal password used elsewhere.
• The practice password manager, where provided, is the only approved place to store passwords. Spreadsheets, sticky notes and browser "remember password" on shared machines are prohibited.
• A password is changed the same day if it is suspected of being exposed, typed into a suspicious page, or known to a departing workforce member.

6. Multi-factor authentication

Authority: 45 CFR 164.312(d).

MFA means a second proof of identity beyond the password. The status at the effective date and the requirement for each system:

Method in use: Authenticator app.

• The EHR is not protected by MFA. Required control: MFA is enabled in Open Dental within 60 days; if the vendor cannot provide it, the Security Officer records the vendor's written answer and the compensating controls (unique IDs, strong passwords, log review) in the risk register. Recorded as "EHR without MFA", owner Janelle Okafor.

Rules for everyone:

• Never approve an MFA prompt you did not start. Report it the same day.
• MFA devices are not shared. A lost phone or key is reported immediately so it can be removed.
• New accounts are not handed over until MFA is enrolled.

The proposed update to the HIPAA Security Rule (published January 2025, not yet final) would make MFA mandatory on every system holding ePHI. Granite City Family Dental treats it as required now.

7. Acceptable use

Practice systems and accounts are provided for practice business.

Email:

• Patient information is sent by email only by the method in document 21 (Encrypted email feature (M365 / Google encryption)). Unencrypted PHI in ordinary email is prohibited.
• Practice email is not forwarded to personal accounts. Personal email is not used for any practice business.
• Attachments and links from unexpected senders are not opened. When in doubt, call the sender on a known number.

Internet and software:

• Browsing is limited to what the job needs. Streaming, gaming, gambling, adult and file-sharing sites are prohibited on practice devices.
• No software, extension or cloud service is used for practice work unless approved by the Security Officer, because an unapproved tool that touches PHI is an unregistered business associate.
• Artificial-intelligence assistants, transcription tools and translation sites receive no PHI unless the vendor has signed a business associate agreement and the Security Officer has approved the tool.

Personal use and devices:

• Limited personal use of a practice computer is allowed on breaks if it does not involve PHI systems, does not slow work and does not break any rule here.
• Personal devices: Not permitted for PHI.
• Texting of patient information: Appointment reminders only, no clinical content.
• Social media: No workforce member may post, confirm or respond to anything identifying a patient on social media or review sites, including replying to a patient's own review. All review responses are generic and approved by the Privacy Officer.

Monitoring: the practice may review activity on its systems and accounts at any time without notice, and the EHR records every record opened. There is no expectation of privacy in practice systems.

8. Reporting suspicious activity

Every workforce member must report, the same day, anything that looks wrong: a phishing email, a pop-up demanding payment, a computer behaving strangely, a lost device, a stranger at a workstation, a login they did not make, or a colleague looking at records they should not.

Tell the Privacy or Security Officer immediately, in person or by phone, then complete an Incident Report Form the same day. Do not investigate, delete or forward anything yourself.

Reporting in good faith is never punished, even when it turns out to be nothing. Failing to report is a sanctionable offense.

9. Phishing tests

Granite City Family Dental does not yet run simulated phishing tests. Recommended control: quarterly simulations through the IT provider, with results reviewed at the annual review. This is recorded in the risk register as a Low-to-Medium item with the Security Officer as owner; the practice may accept the risk in writing if the workforce is five people or fewer.

10. Acknowledgment and enforcement

Every workforce member signs the acknowledgment in document 26 confirming they have read this policy. Violations are handled under the sanction policy (document 05).

Approval

Policy approved by: Dr. Maria Lindqvist, Owner Signature: ___________________________ Date: ______________

Security Officer: Janelle Okafor Signature: ___________________________ Date: ______________