Call to Order and Approval of Minutes
- Minutes from the last meeting were received and approved without modification.
- Guests Leslie Pfeffer, Eric Schmidt, Rick Jackson, and Mark Bruhn were introduced.
Old Business and New Business
- An update on Committee of Data Steward activities was given by Kim Milford.
- An update of recent incidents, including the President’s Challenge incident, was given by Kim Milford.
- An update on the Information Security & Privacy Program was given by Merri Beth Lavagnino.
- Domain 1: Security and privacy risk assessment templates were added to the quick start guide for the domain. It’s not meant to be the master tool that everyone should use, but it is available for people to use if they don’t have their own tool(s).
- Domain 12: There was an empty box for “audit considerations.” Ryan Chizum created some language and Mike Gardner reviewed and edited the final version which has now been posted.
- Outreach Campaign: Initiated a “12 Domains in 12 Months” campaign with an email to IT Professionals focusing on Domain 1 in mid-February. A communication on Domain 2 is planned in mid-March, and a mailing on Domain 3 is planned for mid-April.
HIPAA Compliance Initiative (Leslie Pfeffer, Eric Schmidt, and Marcia Gonzales):
- An update on the HIPAA compliance initiative was given by Marcia Gonzalez and guests Leslie Pfeffer (Interim University HIPAA Privacy Officer), and Eric Schmidt (Interim University HIPAA Security Officer).
- We are working to address HIPAA at an institutional level.
- Indiana University is considered a hybrid covered entity under HIPAA. That means some units of IU are covered components, some units provide services to covered components, some units handle health information but aren’t technically covered by HIPAA, and other areas of the university don’t handle this information at all. These components have been inventoried and a list made. The HITECH act amends HIPAA. It requires HIPAA to be addressed institutionally for hybrid entities, and requires internal “business associates,” i.e. those areas of the university providing services to covered components, to also comply with HIPAA. We are working to communicate required breach notification procedures. Increased enforcement by the Office of Civil Rights (OCR) is highlighting the need for the university to address this issue at an institutional level. A HIPAA Compliance Program/Plan is being developed.
- Dan Rives pointed out/clarified that Leslie and Eric are focusing on the privacy & security aspects of HIPAA, and other offices may be focusing on other aspects of HIPAA such as the portability aspects, pre-existing conditions, carry overs, etc. We think that many of these other titles of HIPAA are addressed by Human Resources. Merri Beth will work with HR to identify which parts of HIPAA are addressed by HR.
Enterprise Risk Management (Mark Bruhn)
- The university now has a risk management structure of 4 components to address institutional risk:
- Risk Committee (comprised of 7 Vice Presidents appointed by the President) which is the owner of the university-wide enterprise risk management process.
- Risk Owners comprised of other university executives who are risk owners for their respective organizations.
- Support staff and resources to Risk Owners and Committee – Mark Bruhn (Chief Risk Officer), Merri Beth Lavagnino, and temporarily Ryan Chizum is stepping in to assist until a permanent position can be established. Have also budgeted for Governance, Risk, and Compliance (GRC) Tool/Software.
- Advisory Group (quasi official) – comprised of Mike Gardner, MaryFrances McCourt, Larry Stephens, Merri Beth Lavagnino, and Mark Bruhn.
- The initial process by which Risk Owners will identify strategic, enterprise-level risk for their respective areas, and bring them to the Risk Committee for discussion, acceptance, mitigation, etc. was outlined.
- Will present to Board in June. Most probably will report on the process description, assessment of 3 areas of risk, progress report, plan, and current meaningful results.
Secure Email Project (Rick Jackson)
- Iron Port product will automatically look at outbound email (not email within IU) for a variety of sensitive information (including many types of text-based attachments) and decide, based on a confidence level/score, whether or not to encrypt the email (and associated attachments). If the email is encrypted, the recipient will receive an email notification. The recipient can then retrieve a copy of the encrypted message from the Cisco cloud service, after creating a free account. The system has the capability to prevent the recipient from reading the email if it is discovered to have been sent in error, and can also indicate whether the recipient has viewed the email or not. The product is configurable for encryption thresholds, and custom data patterns/rules.
- The Committee discussed the “positioning” of this service; that is, how should its use be communicated/portrayed to our community, how should we advise that people use it?
- Committee consensus: If your unit/dept allows sending sensitive/critical information through email, and you have a need to send such information via email, then users should manually label the message with the [Secure Message] tag in the subject line to force encryption. This aligns best with the university philosophy of knowing what information you’re dealing with and handling it properly, and compensates for attachment types that aren’t effectively scanned (ex. images). It’s another tool that can be used to send sensitive information via email, but shouldn’t be portrayed as something that would enable or encourage people to be less vigilant in their handling of sensitive information. We do not want to communicate to people that they can send sensitive information via email without manually tagging the message for encryption with [Secure Message] in the subject line. However, the tool is a good safety net/insurance policy since all outgoing email will be scanned regardless.
Classified Research (10 minutes)
Doug Wasitis and Marcia Gonzalez raised the issue of what the role of the Council would be relative to policies the university might develop to accept classified research (which IU currently does NOT accept). Wasitis thinks there’s interest by some units at IU to accept such research and how that might be done, but it hasn’t progressed very far. Marcia noted that there hasn’t been much discussion on the matter or a policy change. Bruhn clarified that we have policy to not conduct classified research using university facilities/systems, but we do have people that conduct such research at other locations. Related issues are that classified research often carries a publication restriction (to which some are opposed), and significant added cost/infrastructure to manage and protect such research is required. Tom Davis raised the potential risk of people doing research at other locations and bringing that information to the university. Marcia will work to determine how many people we might have doing classified research off site so that the Council can get a sense of the risk involved. Otherwise, the Council’s involvement will be deferred until such time as there is further activity in this area.
Memo to VPs and Chancellors
Tom Davis gave an update on the status of the draft memo (on the progress of this council) to VPs and chancellors. Feedback on the draft was discussed. It was suggested that the letter offer a briefing to executives on the program. Tom will revise to include an offer to brief executives on program. Distribution of the memo was discussed. Committee consensus: John Applegate and Brad Wheeler should review memo and determine distribution. Dan will provide list of executives to Tom for potential future use.
Review of Top Priority Gaps
Survey Monkey results of the first priority gaps were shared and reviewed. Based on time and resources, our plan is to focus on the top 5 gaps. It is likely that other gaps will also be addressed as opportunity/resources/synergies arise. Ownership of gaps was identified: Gap 1(g) – Tom Davis, Gap 2(c) – Merri Beth Lavagnino, Gap 3(h) – Tom Davis, Gap 4(a) – Kim Milford, Gap 5(b) – Kim Milford. Council members should forward other ideas to the chairs.
Wrap-up and Next Steps
Next meeting: April 30, 2012, 2-4 PM
Action Items
- Merri Beth will work with HR to identify which parts of HIPAA are addressed by HR.
- Leslie and Eric S. will distribute HIPAA participant list to the Council for context.
- Marcia will work to determine how many people we might have doing classified research off site.
- Dan will provide executive distribution list to Tom for potential future use.
- Tom will revise executive memo to include an offer to brief executives on program.
Meeting Information
Date
March 7, 2012
Time
1:30pm
Location
Poplars 017, Video Bridge 223739
Attendees
In person
Mark Bruhn (Guest)
Eric Cosens (staff)
Tom Davis (Chair)
Mike Gardner
Joan Hagen
Rick Jackson (Guest)
Jeff Lambright
Kim Milford
Dan Rives
Joe Scodro
Chris Viers
Via video
Philip Cochran
Marcia Gonzales
Leslie Pfeffer (Guest)
Eric Schmidt (Guest)
Doug Wasitis
Via Audio/phone
Merri Beth Lavagnino (Co-Chair)
Absent
Jim Kennedy
Mary Frances McCourt