I am currently working to help a bunch of small pharmacies remain compliant and one of the requirements is: Interviews with staff members about privacy and security policies relevant to their positions.
How do I determine what is relevant to their position or should I just go with a wider range talking about common sense about keep their devices with information secure and protecting client's health information.
Is there a NIST type of document that talks about key points that should be hit?
This is for a URAC compliance.
Compliance areas are: PHARM Core 13 and Core 15