DrugStop Pharmacy Inc. opened in May 2012 as part of theEasyDrugs group of pharmacies. The company offers a variety ofservices including consultations, prescription delivery, homecareand diabetic supplies. They deliver fast and friendly service whileoffering personalized care for their customers. As a new businessowner, Walter Walters was looking for a feature-rich and wellsupported point of sale solution that would also include managinginventory, accounting, staying on top of sales trends and more.DrugStop installed the TELUS Assyst Point of Sale system to meetthese needs. This solution has helped to automate their businessprocesses, allowing them to continue to focus on providingexceptional customer service. The computers used to employ thepoint of sale system include a server and twoterminal/workstations. In addition, DrugStop uses TELUS Assyst Rx,a locally installed software solution for pharmacies to effectivelymanage patient files, prescriptions, inventory, orders, andprofessional info bulletins, while integration/connectivity withprovincial Drug Information Systems (DIS), such as Newfoundland?sThe Pharmacy Network. There is an additional server and twoworkstations used with the TELUS Assyst Rx software. As a pharmacyoperating in the province of Newfoundland, CANADA, DrugStop isrequired to adhere to the provincial Personal Health InformationAct (PHIA) and participate in The Pharmacy Network. The PharmacyNetwork is an online, real-time provincial drug information systemwhich provides authorized health professionals with comprehensivemedication profiles for all patients. The Pharmacy Network enablesthe sharing of information across the continuum of care, acrosshealthcare delivery organizations and across geographies. Whetherthe information flows from a doctor's office, a clinic, hospital orpharmacy, it will appear as one patient record. Theresponsibilities pharmacies have regarding Electronic HealthRecords (EHR) are similar to those that they have always had withrespect to their patients? information - they will have theresponsibility to ensure that appropriate access to patientinformation is controlled at the point of service. The PharmacyNetwork is only accessible by authorized health care providers andtheir delegates (people that work under the supervision ofauthorized health care providers, such as pharmacist assistants,technicians and students). All users of the Pharmacy Networkrequire their own username and password which, to protect privacyand confidentiality, cannot be shared. The Pharmacy Network enablesthe sharing of information across the continuum of care, acrosshealthcare delivery organizations and across geographies. Whetherthe information flows from a doctor's office, a clinic, hospital orpharmacy, it will appear as one patient record.

QUESTION:

Risk Identification ? Tasks include: Asset Identification, AssetClassification, and Vulnerability Assessment

Classify & prioritize assets

Classify the information assets in Column 2 of Table 1(below).

Rank the inventoried and classified data assigning a number toeach CIA column according to the financial impact it would have andhow much trust (integrity) you place in the data as being reliableto the business, if compromised and not being available for aperiod of time. Understand that any data has a financial impact toa business if Confidentiality, Integrity or Availability iscompromised and each should have a number assigned.

next, consider the potential vulnerabilities associated witheach threat, to produce a threat-vulnerability pair (TV pair). Avulnerability can be associated with one or more threats. Collectinput from previous risk assessments, audits, system deficiencyreports, security advisories, scanning tools, security testresults lts, system development testing, industry andgovernment listings, such as sans.org.

Transcribed Image Text:

Below is an example of how information flows through the Pharmacy Network when a prescription is filled. Pharmacy software sends prescription information to the HIAL The HIAL sends messages to: O Client Registry to verify the patient, O The Provider Registry to verify both the prescriber and dispenser, O The DIS to check for interactions. Once the HIAL receives responses from Client Registry, Provider Registry, and DIS, it sends messages back to the pharmacy software showing the results Administrators Admin Portal Data Warehouse Care Provider Portal Nurse, Physician, ER, etc. Core DIS Privacy Data Patient Profile Health Information Access Layer (HIAL) Meditech Drug Data -- Pharmacist, Tech, Student Direct DUR LDAP EMR RxDesktop API Physician, Delegate, etc. Security Registry Services Client Registry Provider/Location Registry Clinical Data Sources Health Canada Other Sources CRMS Batch Immunization Data Pharmacy Software RxDesktop Direct API Pharmacist, Tech, Student Table 1 Asset Name Information Asset Valuation and Prioritization Data classification Confidentiality Integrity (1-3) (1-3) (Confidential, Private, Public) Availability Score (average) (1-3) Table 2 (separate table for EACH asset) Asset Name: Threat category Compromises to intellectual property Espionage or trespass Forces of Nature Human error or failure Information extortion Missing, inadequate, or incomplete controls Missing, inadequate, or incomplete organizational policy or planning Quality of Service deviations from service providers Sabotage or vandalism Software attacks Technical hardware failures or errors Technical software failures or errors Technological obsolescence Theft Vulnerability Assessment Possible Vulnerabilities Below is an example of how information flows through the Pharmacy Network when a prescription is filled. Pharmacy software sends prescription information to the HIAL The HIAL sends messages to: O Client Registry to verify the patient, O The Provider Registry to verify both the prescriber and dispenser, O The DIS to check for interactions. Once the HIAL receives responses from Client Registry, Provider Registry, and DIS, it sends messages back to the pharmacy software showing the results Administrators Admin Portal Data Warehouse Care Provider Portal Nurse, Physician, ER, etc. Core DIS Privacy Data Patient Profile Health Information Access Layer (HIAL) Meditech Drug Data -- Pharmacist, Tech, Student Direct DUR LDAP EMR RxDesktop API Physician, Delegate, etc. Security Registry Services Client Registry Provider/Location Registry Clinical Data Sources Health Canada Other Sources CRMS Batch Immunization Data Pharmacy Software RxDesktop Direct API Pharmacist, Tech, Student Table 1 Asset Name Information Asset Valuation and Prioritization Data classification Confidentiality Integrity (1-3) (1-3) (Confidential, Private, Public) Availability Score (average) (1-3) Table 2 (separate table for EACH asset) Asset Name: Threat category Compromises to intellectual property Espionage or trespass Forces of Nature Human error or failure Information extortion Missing, inadequate, or incomplete controls Missing, inadequate, or incomplete organizational policy or planning Quality of Service deviations from service providers Sabotage or vandalism Software attacks Technical hardware failures or errors Technical software failures or errors Technological obsolescence Theft Vulnerability Assessment Possible Vulnerabilities

Answer rating: 100% (QA)

To classify and prioritize the assets for DrugStop Pharmacy Inc we can look at the information flow diagram you provided and identify key data assets that are critical to the pharmacys operations Base... View the full answer