How can a traumatic experience influence childrens behaviour

How can a traumatic experience influence childrens behaviour How can a traumatic experience influence children’s behaviour? The issues surrounding children’s behaviour after a traumatic experience are complex, multifactorial and often hugely controversial. Having considered the literature on the subject, one could be forgiven for believing that there are as many opinions on the issues as there are people considering the issues. In this review we have attempted to cover as many of the major areas as possible in order to present a reasonably comprehensive overview of the subject. The definition of a traumatic experience is subjective from both the point of view of the child concerned and also form the observer. Some commentators have suggested that the only workable definition of a traumatic experience is one that, by definition, produces demonstrable psychological sequelae. (Abikoff 1987) This may be the case, but as other commentators observe, some psychological sequelae may not surface for years, if at all. This does not mean that the original triggering episode was not traumatic. There is also the view that that the worst kind, or most extreme type of trauma may be the most likely to be actively suppressed at either a conscious or subconscious level. (Haddad Garralda. 1992) Literature Review With an area of literature as vast as the one that we are considering here, it is often difficult to find a place to start. In this instance we will consider the paper by Prof. Harry Zetlin (1995) who starts with a short monograph on the screening of a television programme which dealt with arguably the most catastrophic of stresses to befall a child, that of the loss of a parent through murder or violence. He makes several thought provoking comments which are worthy of consideration as they are germinal to the thrust of this article. The first is a plea that the diagnostic label of post-traumatic stress should not be a catch-all basket for all emotional and behavioural problems that can occur after a traumatic experience. (Gorcey et al.1986) The second is the realisation that in the particular circumstances portrayed on the television where a parent is murdered have two consequences. The first is the obvious catastrophic trauma that the child experiences with the violent loss of a parent, but the second is the much less obvious fact that the child has, at a stroke, also lost a valuable, and normally available resource, of the protective family environment, which is often one of the most useful therapeutic tools available to the therapist. He adds to this two further insights. The first is that the surviving parent has their own trauma to deal with and that is invariably transmitted to the child and that, because such events are mercifully comparatively rare, only a comparatively few professionals are ever able to build up any significant expertise and experience on the subject. The main issue of the piece is, however, the very relevant point that considering the apparent obsession of the media with intrusive fly-on-the-wall documentaries and the almost equally insatiable public hunger for sensation, the very fact that such a programme is made at all, almost inevitably adds to the trauma felt by the victims. (Koss et al 1989) One could argue that actually confronting and talking about such issues is part of the healing process. Such considerations may be of value in the adult who is more able to rationalise the concepts involved, but to the child this may be very much more difficult and being forced to relive the episodes in a very public and unfamiliar arena, may do little more than add to the psychological stresses and damage already caused. (Mayall Gold 1995) This paper offers a wise and considered plea for sense and moderation, not to mention reservation and decency. It is written in calm and considered moderate tones which makes the impact of its message all the more powerful. The next few papers that we would like to analyse deal with the thorny issue of Attention deficit hyperactivity disorder (ADHD) in children. It has to be commented that there is a considerable body of literature which argues on both sides of the debate about whether ADHD is the result of childhood trauma. One side is presented, quite forcibly, by Bramble (et al. 1998). The authors cite Kewley (1998) as stating that the prime aetiology of ADHD is a genetic neuro-developmental one. They challenge the expressed views that it is a manifestation of early childhood abuse or trauma which can have occurred at some time previously with the words: ..early abuse and trauma later manifest as symptoms and that the detection of these symptoms in children clearly illustrates early trauma is a prime example of the logical fallacy that underpins all psychoanalytical theory and practice. The authors argue that to state because psychotherapy is often effective it must reflect the fact that a traumatic episode must have been responsible because it addresses directly the original emotional trauma (Follette et al.1996), is completely unsound. The natural progression of this argument, they assert, is the reason why many parents of children with ADHD have such difficulty in finding child psychiatrists who can actually help them rather than the many who would seek to blame them for the childs behaviour in the first place. (Breire 1992) The authors take the view that the reason that psychoanalytical practitioners have held so much influence on the profession over the years is that it is only recently that the glare of evidence based medicine has fallen on their discipline. The authors argue that far from using psychotherapeutic tools to try to achieve resolution, the evidence suggests that psycho-stimulant treatment is far more effective (Abikoff 1987) if only because it enhances the therapeutic effect of other forms of treatment such as family therapy and special educational provision. The converse argument, or perhaps an extension of the argument, is presented by Thambirajah (1998) who takes the view that many papers on ADHD (and by inference he is referring to the one reviewed above), regard the syndrome as being a diagnosis made simply by checking an appropriate number of boxes on a check-list. He asserts that factors such as biopsychological circumstances should be weighed equally strongly as the symptom cluster of impulsivity, inattention or hyperactivity. (Tannock 1998) In direct contrast to the preceding paper he states that early traumatic experiences, current abuse or even depression of the mother may all be contributory factors in the aetiology of the condition. He argues that taking no account of these factors is to ignore much of the accumulated evidence and wisdom on the subject. He also makes a very valid point that to ignore these factors and only to use the check-list approach means that here is an over-reliance on the significance of these symptoms and, as a direct result, this leads to an overestimation of prevalence. He points to the obviously erroneous estimate of a study that was based exclusively on check list symptomatology, of 15% (although the study is not quoted). The author makes the very valid point that most psychiatrists would agree that the hyperkinetic disorder is a small sub-group within the ADHD syndrome and that these children may need treatment with stimulants but only after other aetiologies have been excluded. He makes the rather apt comparison of treating all children with ADHD the same way as calling all four legged animals with a tail donkeys. There are a great many more papers on this issue which we could usefully review but we must explore other areas of trauma in a childs life in order to try to give a representative overview. With the possible exception of the situation outlined in the first paper reviewed, there can be few experiences more traumatising to a child than to me made homeless as a refugee in a time of war. The paper by Hodes (et al. 2001) is both heart rending and informative as it explores the health needs of refugees arriving in the UK. Although the paper catalogues all of the health needs (that need not concern us in this article) of the refugees, it does not overlook the psychosocial trauma aspects of the childrens plight. They point to the fact that one way that a childs psychological trauma can be minimised is by being accepted into a peer group such as a school. While this may indeed be true, the problem is that refugee children are seldom seen by their peers as belonging and are therefore seldom completely accepted. (Lewis 1998) This is either aggravated or caused by the fact that they already have twice the rate of psychiatric disorder as found in control groups of children. (Tousignant et al. 1999). It is therefore important to be aware of these problems as they are often very amenable to psychiatric intervention (OShea et al. 2000). The authors quote a paper by Burnett and Peel (2001) who appear to be particularly pessimistic about making a diagnosis of post-traumatic stress disorder in children from a fundamentally different culture, as their recovery is thought to be secondary to the reconstruction of their support networks, which may prove particularly difficult in a different or even alien, cultural environment. They point to studies of the children who fled to the USA to escape the Pol Pot regime, who had post-traumatic stress in childhood, and even when followed up 12 years later they quote 35% as still having post traumatic stress and 14% had active depression. (Sack et al. 1999). This may be a reflection of the difficulty in getting appropriate treatment for a condition in a different culture. But, in distinct relevance to our considerations here, the authors comment that even exposure to a single stressor may result in a surprisingly persistent post traumatic stress reaction. (Richards Lovell 1999). The last article that we are going to consider here is a paper by Papineni (2003). This paper has been selected partly because of its direct relevance to our consideration, but also because on a human level, it is a riveting piece of writing. It is entitled Children of bad memories and opens with the quote Every time there is a war there is a rape (Stiglmayer 1994). The whole article is a collection of war-related rape stories and the resultant psychopathology that ensued. The author specifically explores the issues relating to childhood rape and its aftermath. She also considers a related issue and that is how the effect of maternal shame shapes a childs perception of themselves (with heartrending consequences), how the shame felt by the mother is often externalised to affect the child who is the visible symbol of the physical act. (Carpenter 2000) The catalogue of emotion and reaction described in this article by some of the subjects, would almost make an authoritative text book on the consequences of a traumatic experience in childhood. It would be almost impossible to quantify a single negative emotion that was neither articulated nor experienced by the victims, not only of the act of rape, but also of the stigma and aftermath of the act which was often described as the worst aspect of the whole thing. A constant theme that runs trough the paper is the realisation that the presence of a child conceived by a rape is a potent reminder of the trauma and therefore is, in itself a bar to psychological healing. The author also points to the fact that another, almost inevitable consequence of forcible rape, is difficulty with relationships and intimacy which can devastate a childs social development. (Human Rights Watch.1996). Such a child may not only have this burden to bear for its life, but the stigma forced upon it by society may also have untold consequences. The author quotes a child born from the Rwandan conflict, describing itself by different names which bear witness to societys perception, and more accurately and inevitably, the childs perception of itself: children of hate, enfants non-desirÃÆ'Â ©s (unwanted children), or enfants mauvais souvenir (children of bad memories) The author describes how such psychological trauma may never be successfully treated and ends with the very perceptive comment. There cannot be peace without justice, and unless the international community recognises all rape in conflict situations as crimes against humanity, there will be no peace for the victims of such atrocities. Conclusion It is clearly a forlorn hope to cover all of the aspects of trauma and its potential impact on a childs life in one short article. We hope that, by being selective, we have been able to provide the reader with an authoritative insight into some on the problems associated with the subject.

Kurt Vonnegut :: essays research papers

  Ã‚  Ã‚  Ã‚  Ã‚  Kurt Vonnegut has always had a great awareness of the destructive social impact of science and technology. Contraptions that Vonnegut calls â€Å"social transplants† replace real relatives and friends with synthetic ones. Recordings, radio and television are just a few of these devices. They make it possible to bring synthetic relatives and friends right into your home and replace those friends and relatives who are not perfect, nor even consistent, with a better class of people. Vonnegut’s least favorite technology is the computer, because it is a nervous system outside of our own, and it has deprived humans of the experience of becoming. â€Å"All they have to do now is wait for the next program from Microsoft† (Pickering 24). Films, books and plays show us people talking much more entertainingly than people really talk. Singers and musicians show us humans making sounds far lovelier than humans really make (Skaw 568). All of these technological developments have decreased the amount of contact we have with other humans. The first of these â€Å"transplants† took place in the 4th century before Christ. Audiences accepted attractive people who memorized interesting things to say on stage as genuine relatives and friends (Vonnegut 266). We no longer have a need to make conversation with our dreadful real family and friends, not when we have all of these technological and entertaining transplanted friends and family. Vonnegut believes contemporary society is lonely because we have alienated ourselves from each other because of all of the technology in our world. Throughout his many writings Vonnegut shows his fascination with the way technology changes the social environment (Lundquist 88).   Ã‚  Ã‚  Ã‚  Ã‚   He never abandons his theme of hatred for science and technology and its social impact on society. Vonnegut also believes that we no longer have developed imaginations because of destructive technological developments. We are not born with an imagination; teachers and parents help us to develop it. Imagination was once very important because it was your major source of entertainment. The imagination circuit is built in your head. People can read a book and envision it in their mind. However, this is no longer necessary. Now there are shows, actors, and movies that show us the story instead of letting us use our imagination to envision it. We do not need imagination just like we do not need to know how to ride horses in our society. We have cars that can go much faster than horses so why learn how to ride one? This question can be applied to imagination. Why unleash your imagination to envision an unknown world in a book

Edgar Allan Poe - Mr. Pessimistic Essay -- Biography Biographies

Edgar Allan Poe - Mr. Pessimistic Some people always look at the bad side of things instead of the good side. This is called pessimism. Edgar Allan Poe could be recognized as the king of pessimism. He is known for his tales of the mysterious and macabre. His dark and twisted works are filled with pessimism. Poe was a person who had faced many troubling experiences throughout his life. To escape from his saddened world, Poe drank and wrote short stories and poems with a pessimistic outlook. Being a pessimist is what made Poe such a great and creative writer. He brought out his dark side in his work. It seems that all of his stories and poems are laced with pessimism. Pessimism was like Poe’s warm blanket. He had a sad life, which definitely contributed to his writing. Poe’s poem â€Å"The Raven† greatly reflects his own life and his feelings after the death of his wife Virginia. Of Poe’s entire life "The Raven" is said to be Poe’s best-known and written work. It is about a lover lamenting his dead mistress. It makes it clear that the death of a beautiful woman was for him the supremely interesting subject, and that the most appropriate tone of a poem is melancholy, and certainly there can be no subject more melancholy than the loss of beauty through death (Minor 2244). The autobiographical element in this poem can be noticed. As a young child Poe’s father abandoned them and he lost his mother. John and Fanny Allan took him home, but they did not formally adopt him (Qrisse). J...

Analysis of Through the Tunnel by Doris Lessing Essay -- Through the T

Analysis of Through the Tunnel by Doris Lessing â€Å" Through The Tunnel† is written by a lady called Doris Lessing. Through the tunnel is a short story about a boy called Jerry and his mother who are on holiday in Spain. There are three themes to the story, the first is the safe beach . The second is the dangerous beach. The third is when jerry goes through the tunnel. The characters are introduced on their first day on holiday where they are going to the safe beach. It begins when they are walking to the beach and jerry stops to look at the other beach (dangerous beach), Jerry’s mother stops and looks for him and asks if he wants to go to that beach instead. Guilt gets the better of him because his dad is dead, and he dose not want to leave his mother on her own. The next day it was the same routine of going to the beach and doing swimming and sunbathing all day. His mother asks him the same question as the other day, she wants to let him go and give him some independence. She also wants him with her to make sure he is ok when he is swimming. She was having an inner conflict at this point. Inner conflicts are going on between both characters. As they both carry on walking Jerry blurts out: â€Å"I’d like to go and have a look at those rocks over there† The writer makes Jerry say this because in this story Jerry wants to be more mature like an adult than immature like a kid. When she left him to go his own ways, Jerry had some more guilt going through his head. When his mum left him she felt insecure about letting him go his own ways. â€Å"once Jerry got to the other beach, he went straight to the sea for a swim. The sea was warm from the heat of the sun, but when the currents of the deep sea came in, it w... ...e he goes under water for a long time his nose starts to bleed. He can hold his breath for one hundred and sixty seconds and when he keeps on practicing he can hold it for two minutes. This is the amount of time he needs to go through the tunnel. when he finds out that he is going home in a couple of days he decides to do it the day before he goes home. The time comes for him to do the challenge he goes to the bay and dives in. when he is going to the tunnel lots of thoughts are going through his head whether he is going to die or not and whether he will see his mother again. Once he gets to the tunnel he starts to go through the tunnel it gets thinner and thinner, and he starts to wonder if he will make it. Jerry makes it through and he is so delighted because he thinks he is mature now, but really he is just the same person as before the challenge.

Looking Glass Self Essay

In the most basic terms the Looking Glass self is your self image which is formed by the views others hold of you. These views the people around you have can have either a positive or negative effect on your self imagine. First we picture how our personality and appearance will come off to others, and then we think about how they will judge our personality and appearance. As people around us pass judgment on who we are this is when our self-concept develops, basically who we think we are and how we feel about ourselves as a whole. These judgments’ can have a powerful effect on ones beliefs and feelings about themselves. I’ve felt and been effected by the beliefs another person has about me. When I was in the 8th grade I thought I was a wonderful student, smart, well behaved. I felt as though my teachers all thought the same way. Then one day my homeroom teacher called me stupid for missing a homework assignment. To be called out in front of the class like that was horrifying. Though that wasn’t the only time an incidence like that occurred. In the 9th grade I struggled with math. I did poorly on tests, I already lacked confidence in the subject and it took one day with a substitute teacher to shatter it completely. I will never forget the words she said to me â€Å"Why can’t you finish the test? Are you stupid? † As child of any age, those words are damaging to the way you feel about yourself, and the way you think others perceive you. â€Å"Tell a child he’s stupid enough times and eventually he’ll start believing you, claims Benj Vardigan, with the Behavioral Institute. When a child makes mistakes or doesn’t understand a concept, his knee-jerk reaction may be to conclude that he’s stupid. Take that one step further and watch a child stop trying to understand or stop trying to learn a concept because he automatically assumes he can’t figure it out. † (Hatter) In A Class Divided on of the first examples of looking glass self that I picked up on was when the children came back in from recess after fighting. Mrs. Elliot asks â€Å"What’s wrong with being called brown eyes? † and a little boy, Roy, says â€Å"It means we’re stupider and – well, not that†¦Ã¢â‚¬  It’s immediate how the effect of this experiment took hold. These children took to heart what their teacher, Mrs. Elliot had said, that brown eyed children are less than blue eyed children, they aren’t as smart or as well behaved. In the first day of the lesson the effects on their peers perception of them had caused so much turmoil that it caused one child to hit another, clearly the negative aspect of looking glass. In the Teaching Adults section, Mrs. Elliott describes how she gave tests before during and after the lesson on discrimination. Telling the audience that the student test scores raise on the day they are on top, scores drop when they are on the bottom and after the experiment the children’s testing scores maintain a higher level. She attributed this to the children discovering how good they are. I believe instilling a positive self-imagine in a child is one of the most important things a parent, or teacher can do. â€Å"Whether self-concept is positive or negative can influence important areas of a child’s development and achievement. Educators have recognized that there is a link between self-concept and performance in school. Students with a strong self-concept tend to have good grades and take an active role in school. They are able to accept challenges and enjoy new learning experiences. Students with a negative self-concept tend to have both attitude and behavior problems. They may be unwilling to try new things, because they believe they will fail anyway, or they may not work up to their potential. Some educators feel that a positive self-concept is so important that children need to be taught to like themselves before they are taught academic skills such as reading, writing, and mathematics. † (Myers-Walls and Hinkley)

Lord of the Flies: Human Nature Essay

In the novel, Lord of the Flies, Golding has young and innocent children on a remote island to test how human nature works. Golding uses objects such as the conch and the Beast to reflect our society politically and psychologically. The novel shows human’s own illness and human nature. Human nature is unavoidable and can be a source of evil. It is one’s nature to do whatever it takes in order to survive. By trying to survive one’s evil creeps out. Jack and his hunters showed the most evil. The first pig being killed was the first sign of evil. They celebrated the killings and became blood thirsty for hunting. It was human nature for the hunters and the little boys to follow Jack and to try to survive on the island. Evil is an inborn trait that lives inside every one. It is our parents’ job to teach good morals and values when we are young, but evil can not be fully covered up. The children enjoyed the freedom away from rules and adults. As time passes on the island their freedom soon turns into a nightmare and in the end some died. Civilization is not so far from savagery and everyone has some kind of evil lurking about. Even the little innocent British boys have a certain amount of evil in themselves. The kids are used to rules, but they soon realize that rules do not matter anymore. They can not be punished for throwing rocks or pushing a boulder and killing someone. Roger can not get into trouble by adults anymore, so his human nature kicks in and he reveals his evilness. He was able to kill without getting into trouble. The Beast is messing with the kids’ minds and they become crazed little boys. The fear makes them turn into savages and kill to survive. The Beast is like a phobia for the littluns. Beast from the Air arrives and stirs up some more trouble. It confuses them because they realize there are more things to be cautious of. The conch was supposed to be good, but the power of it changes the kids. Jack and Ralph fight about who has the conch and who is the leader. It is human nature for Jack to desire the conch and what is not his. Human nature has a big role in Lord of the Flies and many of the kids can not handle it. Once human nature was revealed many turned into little killers. It was human nature to try to survive and many did live at the end, but at the cost of lives.

General Security Policy

Sample Information Security Policy I. POLICY A. It is the policy of ORGANIZATION XYZ that information, as defined hereinafter, in all its forms–written, spoken, recorded electronically or printed–will be protected from accidental or intentional unauthorized modification, destruction or disclosure throughout its life cycle. This protection includes an appropriate level of security over the equipment and software used to process, store, and transmit that information. B. All policies and procedures must be documented and made available to individuals responsible for their implementation and compliance. All activities identified by the policies and procedures must also be documented. All the documentation, which may be in electronic form, must be retained for at least 6 (six) years after initial creation, or, pertaining to policies and procedures, after changes are made. All documentation must be periodically reviewed for appropriateness and currency, a period of time to be determined by each entity within ORGANIZATION XYZ. C. At each entity and/or department level, additional policies, standards and procedures will be developed detailing the implementation of this policy and set of standards, and addressing any additional information systems functionality in such entity and/or department. All departmental policies must be consistent with this policy. All systems implemented after the effective date of these policies are expected to comply with the provisions of this policy where possible. Existing systems are expected to be brought into compliance where possible and as soon as practical. II. SCOPE A. The scope of information security includes the protection of the confidentiality, integrity and availability of information. B. The framework for managing information security in this policy applies to all ORGANIZATION XYZ entities and workers, and other Involved Persons and all Involved Systems throughout ORGANIZATION XYZ as defined below in INFORMATION SECURITY DEFINITIONS. C. This policy and all standards apply to all protected health information and other classes of protected information in any form as defined below in INFORMATION CLASSIFICATION. III. RISK MANAGEMENT A. A thorough analysis of all ORGANIZATION XYZ information networks and systems will be conducted on a periodic basis to document the threats and vulnerabilities to stored and transmitted information. The analysis will examine the types of threats – internal or external, natural or manmade, electronic and non-electronic– that affect the ability to manage the information resource. The analysis will also document the existing vulnerabilities within each entity which potentially expose the information resource to the threats. Finally, the analysis will also include an evaluation of the information assets and the technology associated with its collection, storage, dissemination and protection. From the combination of threats, vulnerabilities, and asset values, an estimate of the risks to the confidentiality, integrity and availability of the information will be determined. The frequency of the risk analysis will be determined at the entity level. B. Based on the periodic assessment, measures will be implemented that reduce the impact of the threats by reducing the amount and scope of the vulnerabilities. IV. INFORMATION SECURITY DEFINITIONS Affiliated Covered Entities: Legally separate, but affiliated, covered entities which choose to designate themselves as a single covered entity for purposes of HIPAA. Availability: Data or information is accessible and usable upon demand by an authorized person. Confidentiality: Data or information is not made available or disclosed to unauthorized persons or processes. HIPAA: The Health Insurance Portability and Accountability Act, a federal law passed in 1996 that affects the healthcare and insurance industries. A key goal of the HIPAA regulations is to protect the privacy and confidentiality of protected health information by setting and enforcing standards. Integrity: Data or information has not been altered or destroyed in an unauthorized manner. Involved Persons: Every worker at ORGANIZATION XYZ — no matter what their status. This includes physicians, residents, students, employees, contractors, consultants, temporaries, volunteers, interns, etc. Involved Systems: All computer equipment and network systems that are operated within the ORGANIZATION XYZ environment. This includes all platforms (operating systems), all computer sizes (personal digital assistants, desktops, mainframes, etc. ), and all applications and data (whether developed in-house or licensed from third parties) contained on those systems. Protected Health Information (PHI): PHI is health information, including demographic information, created or received by the ORGANIZATION XYZ entities which relates to the past, present, or future physical or mental health or condition of an individual; the provision of health care to an individual; or the past, present, or future payment for the provision of health care to an individual and that identifies or can be used to identify the individual. Risk: The probability of a loss of confidentiality, integrity, or availability of information resources. V. INFORMATION SECURITY RESPONSIBILITIES A. Information Security Officer: The Information Security Officer (ISO) for each entity is responsible for working with user management, owners, custodians, and users to develop and implement prudent security policies, procedures, and controls, subject to the approval of ORGANIZATION XYZ. Specific responsibilities include: 1. Ensuring security policies, procedures, and standards are in place and adhered to by entity. 2. Providing basic security support for all systems and users. 3. Advising owners in the identification and classification of computer resources. See Section VI Information Classification. 4. Advising systems development and application owners in the implementation of security controls for information on systems, from the point of system design, through testing and production implementation. 5. Educating custodian and user management with comprehensive information about security controls affecting system users and application systems. 6. Providing on-going employee security education. 7. Performing security audits. 8. Reporting regularly to the ORGANIZATION XYZ Oversight Committee on entity’s status with regard to information security. B. Information Owner: The owner of a collection of information is usually the manager responsible for the creation of that information or the primary user of that information. This role often corresponds with the management of an organizational unit. In this context, ownership does not signify proprietary interest, and ownership may be shared. The owner may delegate ownership responsibilities to another individual by completing the ORGANIZATION XYZ Information Owner Delegation Form. The owner of information has the responsibility for: 1. Knowing the information for which she/he is responsible. 2. Determining a data retention period for the information, relying on advice from the Legal Department. 3. Ensuring appropriate procedures are in effect to protect the integrity, confidentiality, and availability of the information used or created within the unit. 4. Authorizing access and assigning custodianship. 5. Specifying controls and communicating the control requirements to the custodian and users of the information. 6. Reporting promptly to the ISO the loss or misuse of ORGANIZATION XYZ information. 7. Initiating corrective actions when problems are identified. 8. Promoting employee education and awareness by utilizing programs approved by the ISO, where appropriate. 9. Following existing approval processes within the respective organizational unit for the selection, budgeting, purchase, and implementation of any computer system/software to manage information. C. Custodian: The custodian of information is generally responsible for the processing and storage of the information. The custodian is responsible for the administration of controls as specified by the owner. Responsibilities may include: 1. Providing and/or recommending physical safeguards. 2. Providing and/or recommending procedural safeguards. 3. Administering access to information. 4. Releasing information as authorized by the Information Owner and/or the Information Privacy/ Security Officer for use and disclosure using procedures that protect the privacy of the information. 5. Evaluating the cost effectiveness of controls. 6. Maintaining information security policies, procedures and standards as appropriate and in consultation with the ISO. 7. Promoting employee education and awareness by utilizing programs approved by the ISO, where appropriate. 8. Reporting promptly to the ISO the loss or misuse of ORGANIZATION XYZ information. 9. Identifying and responding to security incidents and initiating appropriate actions when problems are identified. D. User Management: ORGANIZATION XYZ management who supervise users as defined below. User management is responsible for overseeing their employees' use of information, including: 1. Reviewing and approving all requests for their employees access authorizations. . Initiating security change requests to keep employees' security record current with their positions and job functions. 3. Promptly informing appropriate parties of employee terminations and transfers, in accordance with local entity termination procedures. 4. Revoking physical access to terminated employees, i. e. , confiscating keys, changing combination locks, etc. 5. Providing employees with the opportunity for training needed to properly use the computer systems. 6. Reporting promptly to the ISO the loss or misuse of ORGANIZATION XYZ information. 7. Initiating corrective actions when problems are identified. 8. Following existing approval processes within their respective organization for the selection, budgeting, purchase, and implementation of any computer system/software to manage information. E. User: The user is any person who has been authorized to read, enter, or update information. A user of information is expected to: 1. Access information only in support of their authorized job responsibilities. 2. Comply with Information Security Policies and Standards and with all controls established by the owner and custodian. 3. Refer all disclosures of PHI (1) outside of ORGANIZATION XYZ and (2) within ORGANIZATION XYZ, other than for treatment, payment, or health care operations, to the applicable entity’s Medical/Health Information Management Department. In certain circumstances, the Medical/Health Information Management Department policies may specifically delegate the disclosure process to other departments. (For additional information, see ORGANIZATION XYZ Privacy/Confidentiality of Protected Health Information (PHI) Policy. ) 4. Keep personal authentication devices (e. g. passwords, SecureCards, PINs, etc. confidential. 5. Report promptly to the ISO the loss or misuse of ORGANIZATION XYZ information. 6. Initiate corrective actions when problems are identified. VI. INFORMATION CLASSIFICATION Classification is used to promote proper controls for safeguarding the confidentiality of information. Regardless of classification the integrity and accuracy of all classifications of information must be pr otected. The classification assigned and the related controls applied are dependent on the sensitivity of the information. Information must be classified according to the most sensitive detail it includes. Information recorded in several formats (e. g. , source document, electronic record, report) must have the same classification regardless of format. The following levels are to be used when classifying information: A. Protected Health Information (PHI) 1. PHI is information, whether oral or recorded in any form or medium, that: a. is created or received by a healthcare provider, health plan, public health authority, employer, life insurer, school or university or health clearinghouse; and b. relates to past, present or future physical or mental ealth or condition of an individual, the provision of health care to an individual, or the past present or future payment for the provision of health care to an individual; and c. includes demographic data, that permits identification of the individual or could reasonably be used to identify the individual. 2. Unauthorized or improper disclosure, modification, or destruction of this information could violate state and federal laws, result in c ivil and criminal penalties, and cause serious damage to ORGANIZATION XYZ and its patients or research interests. B. Confidential Information 1. Confidential Information is very important and highly sensitive material that is not classified as PHI. This information is private or otherwise sensitive in nature and must be restricted to those with a legitimate business need for access. Examples of Confidential Information may include: personnel information, key financial information, proprietary information of commercial research sponsors, system access passwords and information file encryption keys. 2. Unauthorized disclosure of this information to people without a business need for access may violate laws and regulations, or may cause significant problems for ORGANIZATION XYZ, its customers, or its business partners. Decisions about the provision of access to this information must always be cleared through the information owner. C. Internal Information 1. Internal Information is intended for unrestricted use within ORGANIZATION XYZ, and in some cases within affiliated organizations such as ORGANIZATION XYZ business partners. This type of information is already idely-distributed within ORGANIZATION XYZ, or it could be so distributed within the organization without advance permission from the information owner. Examples of Internal Information may include: personnel directories, internal policies and procedures, most internal electronic mail messages. 2. Any information not explicitly classified as PHI, Confidential or Public will, by default, be classified as Internal Information. 3. Unauthorized disclosure of this information to outsiders may not be appropriate due to legal or contractual provisions. D. Public Information 1. Public Information has been specifically approved for public release by a designated authority within each entity of ORGANIZATION XYZ. Examples of Public Information may include marketing brochures and material posted to ORGANIZATION XYZ entity internet web pages. 2. This information may be disclosed outside of ORGANIZATION XYZ. VII. COMPUTER AND INFORMATION CONTROL All involved systems and information are assets of ORGANIZATION XYZ and are expected to be protected from misuse, unauthorized manipulation, and destruction. These protection measures may be physical and/or software based. A. Ownership of Software: All computer software developed by ORGANIZATION XYZ employees or contract personnel on behalf of ORGANIZATION XYZ or licensed for ORGANIZATION XYZ use is the property of ORGANIZATION XYZ and must not be copied for use at home or any other location, unless otherwise specified by the license agreement. B. Installed Software: All software packages that reside on computers and networks within ORGANIZATION XYZ must comply with applicable licensing agreements and restrictions and must comply with ORGANIZATION XYZ acquisition of software policies. C. Virus Protection: Virus checking systems approved by the Information Security Officer and Information Services must be deployed using a multi-layered approach (desktops, servers, gateways, etc. ) that ensures all electronic files are appropriately scanned for viruses. Users are not authorized to turn off or disable virus checking systems. D. Access Controls: Physical and electronic access to PHI, Confidential and Internal information and computing resources is controlled. To ensure appropriate levels of access by internal workers, a variety of security measures will be instituted as recommended by the Information Security Officer and approved by ORGANIZATION XYZ. Mechanisms to control access to PHI, Confidential and Internal information include (but are not limited to) the following methods: 1. Authorization: Access will be granted on a â€Å"need to know† basis and must be authorized by the immediate supervisor and application owner with the assistance of the ISO. Any of the following methods are acceptable for providing access under this policy: . Context-based access: Access control based on the context of a transaction (as opposed to being based on attributes of the initiator or target). The â€Å"external† factors might include time of day, location of the user, strength of user authentication, etc. b. Role-based access: An alternative to traditional access control models (e. g. , discretionary or non-discretionary access control po licies) that permits the specification and enforcement of enterprise-specific security policies in a way that maps more naturally to an organization’s structure and business activities. Each user is assigned to one or more predefined roles, each of which has been assigned the various privileges needed to perform that role. c. User-based access: A security mechanism used to grant users of a system access based upon the identity of the user. 2. Identification/Authentication: Unique user identification (user id) and authentication is required for all systems that maintain or access PHI, Confidential and/or Internal Information. Users will be held accountable for all actions performed on the system with their user id. a. At least one of the following authentication methods must be implemented: 1. strictly controlled passwords (Attachment 1 – Password Control Standards), 2. biometric identification, and/or 3. tokens in conjunction with a PIN. b. The user must secure his/her authentication control (e. g. password, token) such that it is known only to that user and possibly a designated security manager. c. An automatic timeout re-authentication must be required after a certain period of no activity (maximum 15 minutes). d. The user must log off or secure the system when leaving it. 3. Data Integrity: ORGANIZATION XYZ must be able to provide corroboration that PHI, Confidential, and Internal Information has not been altered or destroyed in an unauthorized manner. Listed below are some methods that support data integrity: a. transaction audit b. disk redundancy (RAID) c. ECC (Error Correcting Memory) d. checksums (file integrity) e. encryption of data in storage f. digital signatures 4. Transmission Security: Technical security mechanisms must be put in place to guard against unauthorized access to data that is transmitted over a communications network, including wireless networks. The following features must be implemented: a. integrity controls and b. encryption, where deemed appropriate 5. Remote Access: Access into ORGANIZATION XYZ network from outside will be granted using ORGANIZATION XYZ approved devices and pathways on an individual user and application basis. All other network access options are strictly prohibited. Further, PHI, Confidential and/or Internal Information that is stored or accessed remotely must maintain the same level of protections as information stored and accessed within the ORGANIZATION XYZ network. 6. Physical Access: Access to areas in which information processing is carried out must be restricted to only appropriately authorized individuals. The following physical controls must be in place: a. Mainframe computer systems must be installed in an access-controlled area. The area in and around the computer facility must afford protection against fire, water damage, and other environmental hazards such as power outages and extreme temperature situations. b. File servers containing PHI, Confidential and/or Internal Information must be installed in a secure area to prevent theft, destruction, or access by unauthorized individuals. . Workstations or personal computers (PC) must be secured against use by unauthorized individuals. Local procedures and standards must be developed on secure and appropriate workstation use and physical safeguards which must include procedures that will: 1. Position workstations to minimize unauthorized viewing of protected health information. 2. Grant workst ation access only to those who need it in order to perform their job function. 3. Establish workstation location criteria to eliminate or minimize the possibility of unauthorized access to protected health information. 4. Employ physical safeguards as determined by risk analysis, such as locating workstations in controlled access areas or installing covers or enclosures to preclude passerby access to PHI. 5. Use automatic screen savers with passwords to protect unattended machines. d. Facility access controls must be implemented to limit physical access to electronic information systems and the facilities in which they are housed, while ensuring that properly authorized access is allowed. Local policies and procedures must be developed to address the following facility access control requirements: 1. Contingency Operations – Documented procedures that allow facility access in support of restoration of lost data under the disaster recovery plan and emergency mode operations plan in the event of an emergency. 2. Facility Security Plan – Documented policies and procedures to safeguard the facility and the equipment therein from unauthorized physical access, tampering, and theft. 3. Access Control and Validation – Documented procedures to control and validate a person’s access to facilities based on their role or function, including visitor control, and control of access to software programs for testing and revision. . Maintenance records – Documented policies and procedures to document repairs and modifications to the physical components of the facility which are related to security (for example, hardware, walls, doors, and locks). 7. Emergency Access: a. Each entity is required to establish a mechanism to provide emergency access to systems and ap plications in the event that the assigned custodian or owner is unavailable during an emergency. b. Procedures must be documented to address: 1. Authorization, 2. Implementation, and 3. Revocation E. Equipment and Media Controls: The disposal of information must ensure the continued protection of PHI, Confidential and Internal Information. Each entity must develop and implement policies and procedures that govern the receipt and removal of hardware and electronic media that contain PHI into and out of a facility, and the movement of these items within the facility. The following specification must be addressed: 1. Information Disposal / Media Re-Use of: a. Hard copy (paper and microfilm/fiche) b. Magnetic media (floppy disks, hard drives, zip disks, etc. ) and c. CD ROM Disks 2. Accountability: Each entity must maintain a record of the movements of hardware and electronic media and any person responsible therefore. 3. Data backup and Storage: When needed, create a retrievable, exact copy of electronic PHI before movement of equipment. F. Other Media Controls: 1. PHI and Confidential Information stored on external media (diskettes, cd-roms, portable storage, memory sticks, etc. ) must be protected from theft and unauthorized access. Such media must be appropriately labeled so as to identify it as PHI or Confidential Information. Further, external media containing PHI and Confidential Information must never be left unattended in unsecured areas. 2. PHI and Confidential Information must never be stored on mobile computing devices (laptops, personal digital assistants (PDA), smart phones, tablet PC’s, etc. ) unless the devices have the following minimum security requirements implemented: a. Power-on passwords b. Auto logoff or screen saver with password c. Encryption of stored data or other acceptable safeguards approved by Information Security Officer Further, mobile computing devices must never be left unattended in unsecured areas. . If PHI or Confidential Information is stored on external medium or mobile computing devices and there is a breach of confidentiality as a result, then the owner of the medium/device will be held personally accountable and is subject to the terms and conditions of ORGANIZATION XYZ Information Security Policies and Confidentiality Statement signed as a condition of employme nt or affiliation with ORGANIZATION XYZ. H. Data Transfer/Printing: 1. Electronic Mass Data Transfers: Downloading and uploading PHI, Confidential, and Internal Information between systems must be strictly controlled. Requests for mass downloads of, or individual requests for, information for research purposes that include PHI must be approved through the Internal Review Board (IRB). All other mass downloads of information must be approved by the Application Owner and include only the minimum amount of information necessary to fulfill the request. Applicable Business Associate Agreements must be in place when transferring PHI to external entities (see ORGANIZATION XYZ policy B-2 entitled â€Å"Business Associates†). 2. Other Electronic Data Transfers and Printing: PHI, Confidential and Internal Information must be stored in a manner inaccessible to unauthorized individuals. PHI and Confidential information must not be downloaded, copied or printed indiscriminately or left unattended and open to compromise. PHI that is downloaded for educational purposes where possible should be de-identified before use. I. Oral Communications: ORGANIZATION XYZ staff should be aware of their surroundings when discussing PHI and Confidential Information. This includes the use of cellular telephones in public areas. ORGANIZATION XYZ staff should not discuss PHI or Confidential Information in public areas if the information can be overheard. Caution should be used when conducting conversations in: semi-private rooms, waiting rooms, corridors, elevators, stairwells, cafeterias, restaurants, or on public transportation. J. Audit Controls: Hardware, software, and/or procedural mechanisms that record and examine activity in information systems that contain or use PHI must be implemented. Further, procedures must be implemented to regularly review records of information system activity, such as audit logs, access reports, and security incident tracking reports. These reviews must be documented and maintained for six (6) years. K. Evaluation: ORGANIZATION XYZ requires that periodic technical and non-technical evaluations be performed in response to environmental or operational changes affecting the security of electronic PHI to ensure its continued protection. L. Contingency Plan: Controls must ensure that ORGANIZATION XYZ can recover from any damage to computer equipment or files within a reasonable period of time. Each entity is required to develop and maintain a plan for responding to a system emergency or other occurrence (for example, fire, vandalism, system failure and natural disaster) that damages systems that contain PHI, Confidential, or Internal Information. This will include developing policies and procedures to address the following: 1. Data Backup Plan: a. A data backup plan must be documented and routinely updated to create and maintain, for a specific period of time, retrievable exact copies of information. b. Backup data must be stored in an off-site location and protected from physical damage. . Backup data must be afforded the same level of protection as the original data. 2. Disaster Recovery Plan: A disaster recovery plan must be developed and documented which contains a process enabling the entity to restore any loss of data in the event of fire, vandalism, natural disaster, or system failure. 3. Emergency Mode Operation Plan: A plan must be developed and documented which c ontains a process enabling the entity to continue to operate in the event of fire, vandalism, natural disaster, or system failure. 4. Testing and Revision Procedures: Procedures should be developed and documented requiring periodic testing of written contingency plans to discover weaknesses and the subsequent process of revising the documentation, if necessary. 5. Applications and Data Criticality Analysis: The criticality of specific applications and data in support of other contingency plan components must be assessed and documented. Compliance [ § 164. 308(a)(1)(ii)(C)] A. The Information Security Policy applies to all users of ORGANIZATION XYZ information including: employees, medical staff, students, volunteers, and outside affiliates. Failure to comply with Information Security Policies and Standards by employees, medical staff, volunteers, and outside affiliates may result in disciplinary action up to and including dismissal in accordance with applicable ORGANIZATION XYZ procedures, or, in the case of outside affiliates, termination of the affiliation. Failure to comply with Information Security Policies and Standards by students may constitute grounds for corrective action in accordance with ORGANIZATION XYZ procedures. Further, penalties associated with state and federal laws may apply. B. Possible disciplinary/corrective action may be instituted for, but is not limited to, the following: 1. Unauthorized disclosure of PHI or Confidential Information as specified in Confidentiality Statement. 2. Unauthorized disclosure of a sign-on code (user id) or password. 3. Attempting to obtain a sign-on code or password that belongs to another person. 4. Using or attempting to use another person's sign-on code or password. 5. Unauthorized use of an authorized password to invade patient privacy by examining records or information for which there has been no request for review. . Installing or using unlicensed software on ORGANIZATION XYZ computers. 7. The intentional unauthorized destruction of ORGANIZATION XYZ information. 8. Attempting to get access to sign-on codes for purposes other than official business, including completing fraudulent documentation to gain access. — ATTACHMENT 1 — Password Control Standards The ORGANIZATION XYZ Information Security Policy requi res the use of strictly controlled passwords for accessing Protected Health Information (PHI), Confidential Information (CI) and Internal Information (II). See ORGANIZATION XYZ Information Security Policy for definition of these protected classes of information. ) Listed below are the minimum standards that must be implemented in order to ensure the effectiveness of password controls. Standards for accessing PHI, CI, II: Users are responsible for complying with the following password standards: 1. Passwords must never be shared with another person, unless the person is a designated security manager. 2. Every password must, where possible, be changed regularly – (between 45 and 90 days depending on the sensitivity of the information being accessed) 3. Passwords must, where possible, have a minimum length of six characters. 4. Passwords must never be saved when prompted by any application with the exception of central single sign-on (SSO) systems as approved by the ISO. This feature should be disabled in all applicable systems. 5. Passwords must not be programmed into a PC or recorded anywhere that someone may find and use them. 6. When creating a password, it is important not to use words that can be found in dictionaries or words that are easily guessed due to their association with the user (i. e. children’s names, pets’ names, birthdays, etc†¦). A combination of alpha and numeric characters are more difficult to guess. Where possible, system software must enforce the following password standards: 1. Passwords routed over a network must be encrypted. 2. Passwords must be entered in a non-display field. 3. System software must enforce the changing of passwords and the minimum length. 4. System software must disable the user identification code when more than three consecutive invalid passwords are given within a 15 minute timeframe. Lockout time must be set at a minimum of 30 minutes. 5. System software must maintain a history of previous passwords and prevent their reuse.