A trusted partner shall establish and maintain administrative procedures to protect BAR information integrity, confidentiality, and availability, which include:

1. A. Entering and maintaining with the Department a trusted partner agreement that certifies that the trusted partner shall:

   1. (1) Establish and implement the policies and procedures to carry out the requirements of this chapter; and
   2. (2) Designate a BAR information custodian;

2. B. Establishing and implementing a contingency plan for protecting confidentiality of and access to BAR information when responding to a disaster or computer information system emergency, which includes:

   1. (1) Preparing critical facilities that can be used to facilitate continuing protection of BAR information in the event of an emergency;

   2. (2) Disaster recovery procedures to follow in the event of:

      1. (a) Fire;
      2. (b) Vandalism;
      3. (c) Natural disaster; or
      4. (d) Computer information system failure;

   3. (3) An emergency mode operation plan that includes procedures for assuring continuing protection of BAR information when the trusted partner continues to operate in the event of:

      1. (a) Fire;
      2. (b) Vandalism;
      3. (c) Natural disaster; or
      4. (d) Computer information system failure; and

   4. (4) Testing and revising procedures that document the process of periodically testing the written contingency plan procedures to determine:

      1. (a) Weaknesses; and
      2. (b) The subsequent process of revising the procedures, if necessary;
3. C. A mechanism for the receipt, viewing, manipulation, storage, release, dissemination, and disposal of BAR information;
4. D. Information-use policies that ensure that BAR information is used only as specified in this chapter;

5. E. Internal audit procedures for:

   1. (1) Maintaining records of computer information system activity including:

      1. (a) Logons;
      2. (b) File accesses; and
      3. (c) Security incidents; and

   2. (2) Reviewing the records of computer information system activity for:

      1. (a) Breaches in security; and
      2. (b) Unauthorized access;

6. F. Personnel security procedures that ensure that only personnel who have the required authorizations and agency clearances have access to BAR information by:

   1. (1) Providing oversight of unauthorized personnel when the personnel are performing their duties near BAR information, which includes:

      1. (a) Supervision of maintenance personnel by an authorized and knowledgeable individual; and
      2. (b) Assuring that unauthorized or unsupervised operating and maintenance personnel do not have and cannot acquire access to BAR information;
   2. (2) Maintaining and reviewing a record of access authorizations that documents the levels of access granted to an individual accessing BAR information;
   3. (3) Establishing personnel clearance procedures as a protective measure applied to determine that an individual's access to BAR information is permissible; and
   4. (4) Ensuring that BAR information computer information system users, including maintenance personnel, receive security awareness training;

7. G. Employee termination procedures for ending an employee's employment or a user's access to BAR information, which includes:

   1. (1) Changing locks, lock combinations, or keypad codes when personnel knowledgeable of locks, lock combinations, or keypad codes no longer need to:

      1. (a) Know the information; or
      2. (b) Access BAR information;
   2. (2) Removal from access lists, including physical eradication of an individual's access privileges;
   3. (3) Termination or deletion of an individual's access privileges to BAR information for which the individual currently has authorization and need-to-know access when the authorization and need-to-know access no longer exists; and

   4. (4) Returning to the trusted partner any access devices, such as:

      1. (a) Keys;
      2. (b) Tokens;
      3. (c) Badges; or
      4. (d) Cards; and

8. H. Training for all personnel concerning the vulnerabilities of the BAR information and ways to ensure the protection of BAR information, which include:

   1. (1) Awareness training including:

      1. (a) Password maintenance;
      2. (b) Security incident reporting; and
      3. (c) Viruses and other forms of malicious software;
   2. (2) Periodic security reminders of security concerns; and

   3. (3) User education in:

      1. (a) What to do if a virus is detected;
      2. (b) Monitoring logon success or failure;
      3. (c) How to report discrepancies; and

      4. (d) Password management, including the:

         1. (i) Rules to be followed in creating and changing passwords; and
         2. (ii) Need to keep passwords confidential.

Authority: Health-General Article, §§17-601—17-605, Annotated Code of Maryland

Effective date: November 25, 2002 (29:23 Md. R. 1811)

Chapter revised effective July 31, 2006 (33:15 Md. R. 1280)

Chapter revised effective January 23, 2012 (39:1 Md. R. 17)

Regulation .03B amended effective May 18, 2020 (47:10 Md. R. 517)

Regulation .04B amended effective May 18, 2020 (47:10 Md. R. 517)

Regulation .07F amended effective May 18, 2020 (47:10 Md. R. 517)

Regulation .09B amended effective May 18, 2020 (47:10 Md. R. 517)

Regulation .10E amended effective May 18, 2020 (47:10 Md. R. 517)

Regulation .11A amended effective May 18, 2020 (47:10 Md. R. 517)

Regulation .12B, C amended effective May 18, 2020 (47:10 Md. R. 517)

Regulation .13 amended effective May 18, 2020 (47:10 Md. R. 517)

Regulation .14 amended effective May 18, 2020 (47:10 Md. R. 517)

Regulation .21 amended effective May 18, 2020 (47:10 Md. R. 517)

Regulation .22 amended effective May 18, 2020 (47:10 Md. R. 517)