PURPOSE
To give life to what We Believe and memorialize PDS Health’s commitment to the core values that guide our daily lives, distinguish the strength and character of our organization, and direct all of our critical decisions.
This policy provides the overarching framework for establishing, implementing, maintaining, and continually improving PDS Health’s Information Security Management System (ISMS). The ISMS is defined in the “ISMS Manual” document and is designed to meet the requirements of the ISO/IEC 27001:2022 standard. This policy demonstrates PDS Health’s unwavering commitment to protecting the confidentiality, integrity, and availability of its information assets, ensuring compliance with all applicable legal, regulatory, and contractual obligations.
SCOPE
This policy applies to all PDS Health team members, contractors, third-party users, and other relevant interested parties who access, process, store, or transmit information on behalf of PDS Health. It covers all information assets, including electronic data, physical documents, software, hardware, and intellectual property, used within the company’s database and computer systems. This policy also extends, where appropriate, to external risk sources, including outsourced functions, to ensure a comprehensive security posture.
Any workforce member who violates this policy may be subject to disciplinary action, up to and including separation. In the case of a contractor or vendor and depending on the severity of the situation, his or her contractual agreement may be terminated.
Inquiries or questions regarding this policy may be directed to the Information Security team via email at InformationSecurity@pdshealth.com.
LEADERSHIP AND COMMITMENT
PDS Health’s management, represented by the ISMS Steering Committee and the executive leadership team, is fully dedicated to establishing, implementing, maintaining, and continually improving the ISMS. This commitment is demonstrated through:
- Active participation: The ISMS Steering Committee carries out its responsibilities, providing strategic direction and oversight
- Resource provision: PDS Health will ensure that sufficient resources are available for the effective establishment, implementation, maintenance, and improvement of our ISMS. These resources include
- Financial support
- Skilled personnel
- Appropriate facilities and technical infrastructure
- Policy and objectives alignment: Management will establish a robust information security policy and set information security objectives that are fully aligned with PDS Health’s strategic imperatives and organizational purpose.
INFORMATION SECURITY POLICY STATEMENT
PDS Health’s top management establishes and upholds a dedicated information security policy. This policy:
- Explicitly aligns with the purpose, mission, and the specific needs of the organization.
- Incorporates our information security objectives and provides the foundational framework for determining, monitoring, and reviewing such objectives.
- Demonstrates our commitment to meeting all relevant information security requirements, including legal, regulatory, and contractual obligations.
- Emphasizes our continual dedication to enhancing and improving our ISMS.
PDS Health establishes clear, measurable security objectives that are reviewed annually by the ISMS Steering Committee based upon a clear understanding of business requirements and the evolving threat landscape. The current information security objectives are:
- Protect confidentiality, availability, and integrity: Safeguard the confidentiality, availability, and integrity of company, patient (PHI), and team member data.
- Communicate policy: Make the details of this policy known to all team members, contractors, and other interested parties, including external partners where appropriate, determining the need for communication and the methods relevant to the appropriate audience.
- Ensure compliance: Comply with all applicable legal requirements (e.g., HIPAA, state-specific privacy laws), industry codes of practice, customer contractual obligations related to information security and privacy and all other requirements pertinent to our activities. PDS Health is committed to satisfying these applicable requirements related to information security and the continual improvement of the ISMS.
- Provide resources: Provide all necessary resources, including equipment, trained and competent staff, and any other requirements to enable these objectives to be met.
- Foster individual accountability: Ensure that all team members are made aware of their individual obligations in respect of this information security policy.
- Maintain management system: Maintain a management system that will achieve these objectives and seek continual improvement in the effectiveness and performance of our management system, based on a robust risk management approach.
This information security policy provides a comprehensive framework for setting, monitoring, reviewing, and achieving our information security objectives, programs, and targets. Action plans to achieve these objectives are maintained and reviewed annually by the ISMS Steering Committee.
POLICY REVIEW AND COMMUNICATION
To ensure the organization maintains its awareness for continuous improvement, the ISMS, including this policy, is regularly reviewed by the ISMS Steering Committee to ensure it remains appropriate and suitable for our business and the current risk environment. The ISMS is subject to both internal and external annual audits.
At least once a year, the ISMS Steering Committee and the VP, IT & CISO will meet with the Executive Leadership Team. This will provide an update on the overall ISMS maturity, major non-conformities, review the risk register and corrective actions, etc. to ensure the ISMS continuously aligns with the organization’s strategic objectives and imperatives.
For transparency and awareness:
- This policy is documented and readily accessible to all interested parties (internal and relevant external).
- It is actively communicated across all levels within PDS Health through training, awareness programs, and internal communication channels.
- Furthermore, we ensure this policy is available to relevant external parties, demonstrating our commitment to information security and fostering trust.