Reference Standard: All security and compliance practices in this repository are based on the workflow, logic, and standards defined in [App].[LabTest_POC_Compare].sql. For any security review, validation, or public release, always reference this file as the authoritative source.

This security policy is current as of the v1.9.0 public release. No major feature updates are planned; only occasional data source maintenance or minor corrections will be made as needed. Security practices and compliance are standardized for open-source use.

The following versions of Laboratory Testing POC Comparison are currently supported with security updates:

IMPORTANT: Do not report security vulnerabilities through public GitHub issues.

If you discover a security vulnerability, please follow these steps:

• Email: [Your secure email for security reports]
• Subject Line: "SECURITY: Laboratory POC Comparison Vulnerability Report"
• Response Time: We will acknowledge receipt within 48 hours

Please provide as much of the following information as possible:

• Type of vulnerability (e.g., SQL injection, data exposure, authentication bypass)
• Full paths of source files related to the vulnerability
• Location of the affected source code (tag/branch/commit or direct URL)
• Any special configuration required to reproduce the issue
• Step-by-step instructions to reproduce the vulnerability
• Proof-of-concept or exploit code (if possible)
• Impact assessment including potential patient data exposure
• Suggested remediation (if available)

When reporting healthcare-related vulnerabilities, please also include:

• Patient Data Exposure Risk: Potential for PHI (Protected Health Information) exposure
• Clinical Impact: Potential impact on patient care or laboratory operations
• Compliance Risk: Potential HIPAA, HITECH, or other regulatory compliance issues
• Multi-tenant Risk: Risk to multiple healthcare facilities using the solution

1. Acknowledgment: Confirm receipt of vulnerability report
2. Initial Assessment: Determine severity and scope
3. Team Assignment: Assign security response team members
4. Communication Plan: Establish secure communication channel

1. Reproduction: Attempt to reproduce the reported vulnerability
2. Impact Analysis: Assess potential patient data and clinical impact
3. Scope Determination: Identify all affected versions and components
4. Preliminary Classification: Assign initial severity level

1. Fix Development: Develop and test security patch
2. Validation: Validate fix addresses vulnerability without introducing new issues
3. Documentation: Document vulnerability and remediation steps
4. Release Planning: Plan coordinated disclosure and patch release

1. Patch Release: Release security patch to all supported versions
2. Security Advisory: Publish security advisory with details and remediation steps
3. User Notification: Notify users through appropriate channels
4. Public Disclosure: Coordinate public disclosure with reporter (typically 90 days)

• Access Control: Implement least-privilege access principles
• Encryption: Use TDE (Transparent Data Encryption) for databases containing PHI
• Network Security: Ensure secure network connections (SSL/TLS)
• Audit Logging: Enable comprehensive audit logging for compliance
• Regular Updates: Keep SQL Server and related components updated

• De-identification: Only use de-identified data for testing and development
• PHI Handling: Follow HIPAA guidelines for any PHI access
• Data Minimization: Only query and display necessary data
• Retention Policies: Implement appropriate data retention policies

• Row-level Security: Implement appropriate RLS policies
• Data Refresh Security: Secure data refresh credentials
• Report Sharing: Control report sharing and access permissions
• Embedded Security: Secure embedded PowerBI implementations

• Network Segmentation: Isolate database and reporting systems
• Firewall Configuration: Implement appropriate firewall rules
• VPN Access: Use VPN for remote access to systems
• Multi-factor Authentication: Implement MFA for administrative access

• All queries use parameterized statements
• Input validation on all user-provided parameters
• Principle of least privilege for database connections
• Regular security code reviews
• Stored Procedure Security: [App].[LabTest_POC_Compare] uses secure parameterization
• Certificate Signing: All procedures signed with [dbo].[sp_SignAppObject] for authenticity

• Limited data selection (last-4 SSN only, no full SSN)
• No storage of temporary PHI in query results
• Automatic session timeouts for PowerBI reports
• Secure handling of exported data

• Integration with existing healthcare facility authentication systems
• Role-based access control for different user types
• Regular access reviews and privilege audits
• Secure service account management

• Comprehensive logging of all data access
• Real-time monitoring for unusual access patterns
• Regular security assessments and penetration testing
• Incident response procedures

• Administrative Safeguards: Policies and procedures for PHI access
• Physical Safeguards: Protection of physical database systems
• Technical Safeguards: Access control, audit controls, integrity controls
• Business Associate Agreements: Appropriate agreements with third parties

1. Immediate Actions:

   • Contain the breach and assess scope
   • Document all known details
   • Notify security team and legal counsel
   • Preserve evidence for investigation

2. Assessment Phase:

   • Determine types of PHI involved
   • Assess probability of PHI compromise
   • Evaluate potential harm to individuals
   • Document risk assessment

3. Notification Requirements:

   • Individuals affected (60 days)
   • HHS Office for Civil Rights (60 days)
   • Media notification (if > 500 individuals in state/jurisdiction)
   • Business associates and partners

• GDPR: For European healthcare organizations
• PIPEDA: For Canadian healthcare organizations
• Local Regulations: Compliance with local healthcare data protection laws

• Parameter Validation: All input parameters validated for type and range
• Output Sanitization: All output data sanitized to prevent injection attacks
• Error Handling: Secure error messages that don't expose sensitive information
• Session Management: Appropriate session timeouts and security
• Digital Signing: All stored procedures signed with VA-approved certificates
• Certificate Validation: [dbo].[sp_SignAppObject] ensures compliance with VA security standards

• Database Activity Monitoring: Real-time monitoring of database access
• Data Loss Prevention: DLP tools to prevent unauthorized data export
• Privileged Access Management: PAM tools for administrative access
• Security Information and Event Management: SIEM integration for monitoring

• Primary Contact: [Security team email]
• Escalation Contact: [Manager/Director email]
• Emergency Contact: [24/7 security hotline]

• Healthcare ISAC: Information sharing for healthcare cybersecurity
• FBI Internet Crime Complaint Center: For criminal cyber incidents
• CISA: Cybersecurity and Infrastructure Security Agency
• Vendor Security Contacts: Contact information for all third-party vendors

• HIPAA Privacy and Security: Annual training for all users
• Cybersecurity Awareness: General cybersecurity best practices
• Incident Response: Procedures for reporting security incidents
• Role-specific Training: Additional training based on access level

• Security Policies: Link to organizational security policies
• Best Practices Guides: Healthcare-specific cybersecurity guidance
• Threat Intelligence: Current threat information relevant to healthcare
• Contact Information: Security team contact information

• Quarterly: Vulnerability scans and penetration testing
• Annually: Comprehensive security assessment
• Ad-hoc: Assessment after major changes or incidents
• Continuous: Automated security monitoring and alerting

• Code Review: Static and dynamic analysis of all code
• Infrastructure Assessment: Network and system security review
• Configuration Review: Database and application configuration assessment
• Process Review: Security procedures and incident response testing

This security policy is reviewed and updated annually or after significant security incidents.

Last Updated: January 2025 Next Review: January 2026

For questions about this security policy, please contact the project security team.