a. transmitting ePHI using unauthorized networks;

b. storing ePHI on unauthorized information systems, including unsecured networks and devices;

c. removal of ePHI from Medical Center;

d. prohibition on sharing accounts and passwords for ePHI access or storage;

e. encryption of portable devices that access or store ePHI; and

f. security incident reporting related to ePHI.

a. Unannounced site visits to five [Medical Center] departments, including the Cardiology Department (the “Covered Departments”) to assess implementation of the policies and procedures [described in this Settlement Agreement];

b. Interviews with a total of fifteen (15) randomly selected [Medical Center] workforce members who have access to ePHI, thirteen (13) of whom shall be from the Covered Departments—including at least one intern, resident, or fellow, and the remaining two (2) of whom shall be interns, residents, or fellows working in Hematology/Oncology; and

c. Inspection of at least three (3) portable devices at each of the Covered Departments that can access ePHI, including one (1) laptop, one (1) other portable device, such as a tablet or smartphone, and one (1) portable storage media, such as a USB flash drive, randomly selected to ensure that such devices satisfy all applicable requirements of the policies and procedures [described in this Settlement Agreement].

a. Dates and locations of unannounced site visits;

b. Job titles and duties of workforce members interviewed;

c. Summaries of results of interviews;

d. Summaries of inspections of workstations and other devices containing ePHI; and

e. Identification of any material compliance issues with the policies described [described in this Settlement Agreement], and recommendations for improving these policies and procedures, oversight and supervision, or training.