Risk Management Solutions
Will traditional insurance cover internet-related risks? www.ashrm.org S p r i n g 2 0 0 1 13 Exhibit 3
Assessing Network Liability Exposures
The following is a broad overview of areas that should be considered when assessing an organization's network liability exposures. It should not be considered an all-inclusive list; rather, it should be viewed as a beginning point in a risk management assessment of online liability.
J Review sample contract templates used with patients, online users, customers and vendors. J Review your disaster recovery plan. Identify alternate providers. J Identify any technology your organization makes available to others. Identify any critical interdependent business J Calculate how long any system can be "down" or compromised before costs or revenues are seriously impacted. J Determine if any significant systems are co-located in shared data centers operated by third parties, and if the third J Ask if any mission-critical applications are managed or served by external application service providers. If so, develop J Determine if your organization has a written Computer Incident Response plan. If so, obtain a copy and review. J Learn how frequently technical security assessments or audits are completed. Review the executive J Determine if your organization has a written information security policy, and if employees are made aware of it.
J Collect copies of your own promotional material and review, along with your Web site, to look for copyright and J Develop a policy for reviewing and validating any outside information being posted to the site. J Review your copyright notice and disclaimer statements.
J Review any transactions between the hospital and its providers for compliance with the Federal Stark I1 Statute or J If the hospital's site directly or indirectly relates to the referral of patients, consider whether it complies with the J Review Internet advertising for compliance with state laws. J Consider jurisdictions where your organization may be sued, and where you may be subject to state and local taxation. J Develop a privacy policy and make it accessible to users. Review and be prepared to comply with all aspects of the J Consult with legal counsel experienced in Internet law.
relationships. An attack on the other organization could disrupt your operations.
party's security has been evaluated. appropriate contingency plans.
summary of their findings.
trademark infringement potential.
other regulatory implications.
Federal anti-kickback law.