Assignment #4IMPORTANT NOTE: This paper must be submitted no later than the last day of class and if late will not be accepted. In addition to the written instructions, there are 2 VIDEOS that explain this assignment. See above links for videos. The final project for this course is an analysis of the legal and or ethical issues involved in the below health care scenario. See questions to be answered at end of this factual scenario below. I have also provided, after the formatting requirements for the paper, two articles that will aid you in your analyzing the scenario and writing your paper. The two articles to base the analysis of your paper are entitled:Clinical Ethics Issues and Discussion andA Framework for Thinking EthicallyThis is the final paper for the class and must be double spaced and be approximately 4-5 pages in 12 point New Times Roman font. Include a cover page [not counted as a page] which should have student name and title of your paper. See more formatting requirements later in these paper instructions.NOTE: For this paper it is unnecessary to do any research beyond the two articles I furnished with this assignment. Both are after the specific paper requirements. You may use all the articles in the class also. To do internet research would only be wasting your valuable time.Case ScenarioA 72 year old woman was admitted to the Neurological Intensive Care Unit following a cerebral hemorrhage which left her with severe brain damage and ventilator dependent. One year before this event, the patient and her husband had drawn up "living wills" with an attorney. She was diagnosed by her treating physician as being in a permanent unconscious condition. The patient's living will specified that the patient did not want ventilator support or other artificial life support in the event of a permanent unconscious condition or terminal condition.The patient's husband is her legal next of kin and the person with surrogate decision-making authority. When the living will was discussed with him, he insisted that the patient had not intended for the document to be used in a situation like the present one. Further discussion with him revealed that he understood that the patient would not be able to recover any meaningful brain function but he argued that the living will did not apply because her condition was not imminently terminal. He further indicated that he did not consider his wife to be in a permanent unconscious condition. The immediate family members (the couple’s adult children) disagreed with their father’s refusal to withdraw life support.The treatment team allowed a week to pass to allow the husband more time to be supported in his grief and to appreciate the gravity of his wife’s situation. Nevertheless, at the end of this time, the husband was unwilling to authorize withdrawal of life support measures consistent with the patient's wishes as expressed in her living will. End of scenario.You paper should have 3 major sections. Each is numbered 1, 2 and 3. Questions to be discussed based on the facts above. You must weave into your discussion the relevant facts from above scenario to support your discussion in discussion areas 2 and 3 below. And for discussion area 3 you must weave into your discussion the ethics philosophy you pick for each issue from the article A Framework for Thinking Ethically. -5% penalty in grading rubric if fail to use appropriate underlined headings in your paper. Three Legal/Ethical Issues. Just list the three most important legal/ethics issues in this scenario that you will discuss. They must be three separate, different and distinct issues. Pay particular attention to the article I furnished with this assignment. No explanation needed, just state them 1, 2, 3. Discussion of Three Legal/Ethical Issues. Discuss the three most important ethical/legal issues you listed above. Must use the relevant facts in the scenario to support your discussion of the legal/ethical issues. Must use underlined headings below. Headings will be: Legal/Ethical issue 1 [state the issue] then discussion Legal/Ethical issue 2 [state the issue] then discussion Legal/Ethical issue 3 [state the issue] then discussion For each legal/ethical issue above discuss a. Why each is a legal /ethical issue? b. Discuss each issue in the context of the scenario facts and c. Define the concepts you useHow I would Handle Each Issue. First, in this section and for each issue, as a health care provider, how would you handle each of the three issues discussed above and why? Must use the relevant facts in the scenario to support your positions. Secondly for each issue, using the article in these requirements, entitled "A Framework of Thinking Ethically" fully discuss the specific ethics philosophy that would epitomize your handling of each issue. Fully define the specific ethics philosophy used and weave the ethics philosophy into your discussion. See article below entitled A Framework for Thinking Ethically. Must use underlined headings below. Headings will be: Handling of Legal/ethical issue #1 [then discussion] Handling of Legal/ethical issue #2 [then discussion] Handling of Legal/ethical issue #3 [then discussion][-5% in grading rubric fail to use appropriate headings in your paper. ]This is an independent paper and you are on the honor system not to discuss or consult with any students or other individuals about this paper. You may use the information we have discussed in the class, the articles in the class, and the two articles I have furnished below. Just so you know, all you need to read to analyze the questions for your paper are the two articles I have furnished with this assignment and information in the class.All you need to read to analyze the questions for this paper are the two articles below entitled:Clinical Ethics Issues and Discussion andA Framework for Thinking EthicallyThe paper must be:Late submission – No late assignment 4 papers will be accepted. Paper is due last day of class. Paper must be in narrative format not outline or bullets. Double spaced and be 4-5 pages in 12 point New Times Roman font. [No deduction if paper exceeds a page or so. Thus 3 and half page paper will be penalized.]Must cite to source of all your facts in the text of your paper in APA format. You can cite directly to the original source. Here are the links to the sources where the University received copyright permissions for the materials:Clinical Ethics and Law:http://depts.washington.edu/bioethx/topics/law.htmlA Framework for Ethical Decision Making:https://www.scu.edu/ethics/ethics-resources/ethical-decision-making/a-framework-for-ethical-decision-making/Include a cover page [not counted as a page] which should have student name and title of your paper [Provide a short name for the legal responsibility the specific health care organization has for one type of patient right in a specific setting ] A the end of the paper a list of references [not counted as a page] Be prepared using word-processing software and saved with a .doc, .docx, or .rtf extension. No pdf.Be uploaded to your Assignments Folder by 11:59 p.m. EST on the due date. The paper is to be posted in Assignment #4 drop box.Grading rubric for assignment is with assignment in Assignments area of class.Background articles to support the issues you will discuss in the paper. Article One of TwoClinical Ethics Issues and Discussion ArticleRelationships: I. clinical ethics, law & risk managementDefinitions and sources of authorityIn the course of practicing medicine, a range of issues may arise that lead to consultation with a medical ethicist, a lawyer, and/or a risk manager. The following discussion will outline key distinctions between these roles.Clinical ethics may be defined as: a discipline or methodology for considering the ethical implications of medical technologies, policies, and treatments, with special attention to determining what ought to be done (or not done) in the delivery of health care. Law may be defined as: established and enforceable social rules for conduct or non-conduct; a violation of a legal standard may create criminal or civil liability.Risk Management may be defined as: a method of reducing risk of liability through institutional policies/practices.Many health care facilities have in-house or on-call trained ethicists to assist health care practitioners, caregivers and patients with difficult issues arising in medical care, and some facilities have formally constituted institutional ethics committees. In the hospital setting, this ethics consultation or review process dates back to at least 1992 with the formulation of accreditation requirements that mandated that hospitals establish a “mechanism” to consider clinical ethics issues.Ethics has been described as beginning where the law ends. The moral conscience is a precursor to the development of legal rules for social order. Ethics and law thus share the goal of creating and maintaining social good and have a symbiotic relationship as expressed in this quote:[C]onscience is the guardian in the individual of the rules which the community has evolved for its own preservation. William Somerset MaughamThe role of lawyers and risk managers are closely linked in many health care facilities. Indeed, in some hospitals, the administrator with the title of Risk Manager is an attorney with a clinical background. There are, however, important distinctions between law and risk management. Risk management is guided by legal parameters but has a broader institution-specific mission to reduce liability risks. It is not uncommon for a hospital policy to go beyond the minimum requirements set by a legal standard. When legal and risk management issues arise in the delivery of health care, ethics issues may also exist. Similarly, an issue originally identified as falling within the clinical ethics domain may also raise legal and risk management concerns.To better understand the significant overlap among these disciplines in the health care setting, consider the sources of authority and expression for each.Ethical norms may be derived from:LawInstitutional policies/practicesPolicies of professional organizationsProfessional standards of care, fiduciary obligationsNote: If a health care facility is also a religious facility, it may adhere to religious tenets. In general, however, clinical ethics is predominantly a secular professional analytic approach to clinical issues and choices.Law may be derived from:Federal and state constitutions (fundamental laws of a nation or state establishing the role of government in relation to the governed)Federal and state statutes (laws written or enacted by elected officials in legislative bodies, and in some states, such as Washington and California, laws created by a majority of voters through an initiative process) Federal and state regulations (written by government agencies as permitted by statutory delegation, having the force and effect of law consistent with the enabling legislation)Federal and state case law (written published opinions of appellate-level courts regarding decisions in individual lawsuits)City or town ordinances, when relevantRisk Management may be derived from law, professional standards and individual institution’s mission and public relations strategies and is expressed through institutional policies and practices.Conceptual Models Another way to consider the relationship among the three disciplines is through conceptual models:LinearDistinctionsInterconnectednessOrientation to law for non-lawyersPotential legal actions against health care providersThere are two primary types of potential civil actions against health care providers for injuries resulting from health care: (1) lack of informed consent, and (2) violation of the standard of care. Medical treatment and malpractice laws are specific to each state.Informed Consent. Before a health care provider delivers care, ethical and legal standards require that the patient provide informed consent. If the patient cannot provide informed consent, then, for most treatments, a legally authorized surrogate decision-maker may do so. In an emergency situation when the patient is not legally competent to give informed consent and no surrogate decision-maker is readily available, the law implies consent on behalf of the patient, assuming that the patient would consent to treatment if he or she were capable of doing so. Information that must be conveyed to and consented to by the patient includes: the treatment’s nature and character and anticipated results, alternative treatments (including non-treatment), and the potential risks and benefits of treatment and alternatives. The information must be presented in a form that the patient can comprehend (i.e., in a language and at a level which the patient can understand) and that the consent must be voluntary given. An injured patient may bring an informed consent action against a provider who fails to obtain the patient’s informed consent in accordance with state law.From a clinical ethics perspective, informed consent is a communication process, and should not simply be treated as a required form for the patient’s signature. Similarly, the legal concept of informed consent refers to a state of mind, i.e., understanding the information provided to make an informed choice. Health care facilities and providers use consent forms to document the communication process. From a provider’s perspective, a signed consent form can be valuable evidence the communication occurred and legal protection in defending against a patient’s claim of a lack of informed consent. Initiatives at the federal level (i.e., the Affordable Care Act) and state level (e.g., Revised Code of Washington § 7.70.060) reflect approaches that support shared decision-making and the use of patient decision aids in order to ensure the provision of complete information for medical decision-making.Failure to follow standard of care. A patient who is injured during medical treatment may also be able to bring a successful claim against a health care provider if the patient can prove that the injury resulted from the provider’s failure to follow the accepted standard of care. The duty of care generally requires that the provider use reasonably expected knowledge and judgment in the treatment of the patient, and typically would also require the adept use of the facilities at hand and options for treatment. The standard of care emerges from a variety of sources, including professional publications, interactions of professional leaders, presentations and exchanges at professional meetings, and among networks of colleagues. Experts are hired by the litigating parties to assist the court in determining the applicable standard of care.Many states measure the provider’s actions against a national standard of care (rather than a local one) but with accommodation for practice limitations, such as the reasonable availability of medical facilities, services, equipment and the like. States may also apply different standards to specialists and to general practitioners. As an example of a statutory description of the standard of care, Washington State currently specifies that a health care provider must “exercise that degree of care, skill, and learning expected of a reasonably prudent health care provider at that time in the profession or class to which he belongs, in the State of Washington, acting in the same or similar circumstances.” III. Common clinical ethics issues: medical decision-making and provider-patient communicationThere are a number of common ethical issues that also implicate legal and risk management issues. Briefly discussed below are common issues that concern medical decision-making and provider-patient communication.If a patient is capable of providing informed consent, then the patient’s choices about treatment, including non-treatment, should be followed. This is an established and enforceable legal standard and also consistent with the ethical principle of respecting the autonomy of the patient. The next two sections (Surrogate decision-making; Advance directives) discuss how this principle is respected from a legal perspective if a patient lacks capacity, temporarily or permanently, to make medical decisions. The third section briefly introduces the issue of provider-patient communication, and highlights a contemporary dilemma raised in decisions regarding the disclosure of medical error to patients.Surrogate decision-makingThe determination as to whether a patient has the capacity to provide informed consent is generally a professional judgment made and documented by the treating health care provider. The provider can make a determination of temporary or permanent incapacity, and that determination should be linked to a specific decision. The legal term competency (or incompetency) may be used to describe a judicial determination of decision-making capacity. The designation of a specific surrogate decision-maker may either be authorized by court order or is specified in state statutes.If a court has determined that a patient is incompetent, a health care provider must obtain informed consent from the court-appointed decision-maker. For example, where a guardian has been appointed by the court in a guardianship action, a health care provider would seek the informed consent of the guardian, provided that the relevant court order covers personal or health care decision-making.If, however, a physician determines that a patient lacks the capacity to provide informed consent, for example, due to dementia or lack of consciousness, or because the patient is a minor and the minor is legally proscribed from consenting, then a legally authorized surrogate decision-maker may be able to provide consent on the patient’s behalf. Most states have specific laws that delineate, in order of priority, who can be a legally authorized surrogate decision-maker for another person. While these laws may vary, they generally assume that legal relatives are the most appropriate surrogate decision-makers. If, however, a patient has previously, while capable of consenting, selected a person to act as her decision-maker and executed a legal document known as a durable power of attorney for health care or health care proxy, then that designated individual should provide informed consent.In Washington State, a statute specifies the order of priority of authorized decision-makers as follows: guardian, holder of durable power of attorney; spouse or state registered partner; adult children; parents; and adult brothers and sisters. If the patient is a minor, other consent provisions may apply, such as: court authorization for a person with whom the child is in out-of-home placement; the person(s) that the child’s parent(s) have given a signed authorization to provide consent; or, a competent adult who represents that s/he is a relative responsible for the child’s care and signs a sworn declaration stating so. Health care providers are required to make reasonable efforts to locate a person in the highest possible category to provide informed consent. If there are two or more persons in the same category, e.g., adult children, then the medical treatment decision must be unanimous among those persons. A surrogate decision-maker is required to make the choice she believes the patient would have wanted, which may not be the choice the decision-maker would have chosen for herself in the same circumstance. This decision-making standard is known as substituted judgment. If the surrogate is unable to ascertain what the patient would have wanted, then the surrogate may consent to medical treatment or non-treatment based on what is in the patient's best interest.Laws on surrogate decision-making are slowly catching up with social changes. Non-married couples (whether heterosexual or same sex) have not traditionally been recognized in state law as legally authorized surrogate decision-makers. This lack of recognition has left providers in a difficult legal position, encouraging them to defer to the decision-making of a distant relative over a spouse-equivalent unless the relative concurs. Washington law, for example, now recognizes spouses and domestic partners registered with the state as having the same priority status. Parental decision-making and minor children. A parent may not be permitted in certain situations to consent to non-treatment of his or her minor child, particularly where the decision would significantly impact and perhaps result in death if the minor child did not receive treatment. Examples include parents who refuse medical treatment on behalf of their minor children because of the parents’ social or religious views, such as Jehovah’s Witnesses and Christian Scientists. The decision-making standard that generally applies to minor patients in such cases is known as the best interest standard. The substituted judgment standard may not apply because the minor patient never had decision-making capacity and therefore substituted judgment based on the minor’s informed choices is not able to be determined. It is important to note that minors may have greater authority to direct their own care depending on their age, maturity, nature of medical treatment or non-treatment, and may have authority to consent to specific types of treatment. For example, in Washington State, a minor may provide his or her own informed consent for treatment of mental health conditions, sexually transmitted diseases, and birth control, among others. Depending on the specific facts, a health care provider working with the provider’s institutional representatives could potentially legally provide treatment of a minor under implied consent for emergency with documentation of that determination, assume temporary protective custody of the child under child neglect laws, or if the situation is non-urgent, the provider could seek a court order to authorize treatment. Advance directivesThe term advance directive refers to several different types of legal documents that may be used by a patient while competent to record future wishes in the event the patient lacks decision-making capacity. The choice and meaning of specific advance directive terminology is dependent on state law. Generally, a living will expresses a person’s desires concerning medical treatment in the event of incapacity due to terminal illness or permanent unconsciousness. A durable power of attorney for health care or health care proxy appoints a legal decision- maker for health care decisions in the event of incapacity. An advance health care directive or health care directive may combine the functions of a living will and durable power of attorney for health care into one document in one state, but may be equivalent to a living will in another state. The Physician Orders for Life Sustaining Treatment (POLST) form is a document that is signed by a physician and patient which summarizes the patient’s wishes concerning medical treatment at the end of life, such as resuscitation, antibiotics, other medical interventions and artificial feeding, and translates them into medical orders that follow patients regardless of care setting. It is especially helpful in effectuating a patient’s wishes outside the hospital setting, for example, in a nursing care facility or emergency medical response context. This relatively new approach is available in about a dozen states, although the programs may operate under different names: POST (Physician Orders for Scope of Treatment), MOST (Medical Orders for Scope of Treatment), MOLST (Medical Orders for Life-Sustaining Treatment), and COLST (Clinician Orders for Life-Sustaining Treatment). The simple one page treatment orders follow patients regardless of care setting. Thus it differs from an advance directive because it is written up by the clinician in consultation with the patient and is a portable, actionable medical order. The POLST form is intended to complement other forms of advance directives. For example, Washington State recognizes the following types of advance directives: the health care directive (living will), the durable power of attorney for health care, and the POLST form. Washington also recognizes another legal document known as a mental health advance directive, which can be prepared by individuals with mental illness who fluctuate between capacity and incapacity for use during times when they are incapacitated.State laws may also differ on the conditions that can be covered by an individual in an advance directive, the procedural requirements to ensure that the document is effective (such as the number of required witnesses) and the conditions under which it can be implemented (such as invalidity during pregnancy).Advance directives can be very helpful in choosing appropriate treatment based upon the patient’s expressed wishes. There are situations, however, in which the advance directive’s veracity is questioned or in which a legally authorized surrogate believes the advance directive does not apply to the particular care decision at issue. Such conflicts implicate clinical ethics, law and risk management.Provider-patient communications: disclosing medical errorHonest communication to patients by health care providers is an ethical imperative. Excellent communication eliminates or reduces the likelihood of misunderstandings and conflict in the health care setting, and also may affect the likelihood that a patient will sue.One of the more contentious issues that has arisen in the context of communication is whether providers should disclose medical errors to patients, and if so, how and when to do so. Disclosure of medical error creates a potential conflict among clinical ethics, law and risk management. Despite a professional ethical commitment to honest communication, providers cite a fear of litigation as a reason for non-disclosure. Specifically, the fear is that those statements will stimulate malpractice lawsuits or otherwise be used in support of a claim against the provider. An increase in malpractice claims could then negatively affect the provider’s claims history and malpractice insurance coverage. There is some evidence in closed systems (one institution, one state with one malpractice insurer) that an apology coupled with disclosure and prompt payment may decrease either the likelihood or amount of legal claim. In addition, a number of state legislatures have recently acted to protect provider apologies, or provider apologies coupled with disclosures, from being used by a patient as evidence of a provider’s liability in any ensuing malpractice litigation. It is currently too early to know whether these legal protections will have any impact on the size or frequency of medical malpractice claims. For this reason and others, it is advisable to involve risk management and legal counsel in decision-making regarding error disclosure. Article Two of TwoA Framework for Thinking Ethically ArticleThis document is designed as an introduction to thinking ethically. We all have an image of our better selves-of how we are when we act ethically or are "at our best." We probably also have an image of what an ethical community, an ethical business, an ethical government, or an ethical society should be. Ethics really has to do with all these levels-acting ethically as individuals, creating ethical organizations and governments, and making our society as a whole ethical in the way it treats everyone.What is Ethics?Simply stated, ethics refers to standards of behavior that tell us how human beings ought to act in the many situations in which they find themselves-as friends, parents, children, citizens, businesspeople, teachers, professionals, and so on.It is helpful to identify what ethics is NOT:• Ethics is not the same as feelings. Feelings provide important information for our ethical choices. Some people have highly developed habits that make them feel bad when they do something wrong, but many people feel good even though they are doing something wrong. And often our feelings will tell us it is uncomfortable to do the right thing if it is hard.• Ethics is not religion. Many people are not religious, but ethics applies to everyone. Most religions do advocate high ethical standards but sometimes do not address all the types of problems we face.• Ethics is not following the law. A good system of law does incorporate many ethical standards, but law can deviate from what is ethical. Law can become ethically corrupt, as some totalitarian regimes have made it. Law can be a function of power alone and designed to serve the interests of narrow groups. Law may have a difficult time designing or enforcing standards in some important areas, and may be slow to address new problems.• Ethics is not following culturally accepted norms. Some cultures are quite ethical, but others become corrupt -or blind to certain ethical concerns (as the United States was to slavery before the Civil War). "When in Rome, do as the Romans do" is not a satisfactory ethical standard.• Ethics is not science. Social and natural science can provide important data to help us make better ethical choices. But science alone does not tell us what we ought to do. Science may provide an explanation for what humans are like. But ethics provides reasons for how humans ought to act. And just because something is scientifically or technologically possible, it may not be ethical to do it.Why Identifying Ethical Standards is HardThere are two fundamental problems in identifying the ethical standards we are to follow: 1. On what do we base our ethical standards?2. How do those standards get applied to specific situations we face?If our ethics are not based on feelings, religion, law, accepted social practice, or science, what are they based on? Many philosophers and ethicists have helped us answer this critical question. They have suggested at least five different sources of ethical standards we should use.Five Sources of Ethical StandardsThe Utilitarian ApproachSome ethicists emphasize that the ethical action is the one that provides the most good or does the least harm, or, to put it another way, produces the greatest balance of good over harm. The ethical corporate action, then, is the one that produces the greatest good and does the least harm for all who are affected-customers, employees, shareholders, the community, and the environment. Ethical warfare balances the good achieved in ending terrorism with the harm done to all parties through death, injuries, and destruction. The utilitarian approach deals with consequences; it tries both to increase the good done and to reduce the harm done.The Rights ApproachOther philosophers and ethicists suggest that the ethical action is the one that best protects and respects the moral rights of those affected. This approach starts from the belief that humans have a dignity based on their human nature per se or on their ability to choose freely what they do with their lives. On the basis of such dignity, they have a right to be treated as ends and not merely as means to other ends. The list of moral rights -including the rights to make one's own choices about what kind of life to lead, to be told the truth, not to be injured, to a degree of privacy, and so on-is widely debated; some now argue that non-humans have rights, too. Also, it is often said that rights imply duties-in particular, the duty to respect others' rights.The Fairness or Justice ApproachAristotle and other Greek philosophers have contributed the idea that all equals should be treated equally. Today we use this idea to say that ethical actions treat all human beings equally-or if unequally, then fairly based on some standard that is defensible. We pay people more based on their harder work or the greater amount that they contribute to an organization, and say that is fair. But there is a debate over CEO salaries that are hundreds of times larger than the pay of others; many ask whether the huge disparity is based on a defensible standard or whether it is the result of an imbalance of power and hence is unfair.The Common Good ApproachThe Greek philosophers have also contributed the notion that life in community is a good in itself and our actions should contribute to that life. This approach suggests that the interlocking relationships of society are the basis of ethical reasoning and that respect and compassion for all others-especially the vulnerable-are requirements of such reasoning. This approach also calls attention to the common conditions that are important to the welfare of everyone. This may be a system of laws, effective police and fire departments, health care, a public educational system, or even public recreational areas.The Virtue ApproachA very ancient approach to ethics is that ethical actions ought to be consistent with certain ideal virtues that provide for the full development of our humanity. These virtues are dispositions and habits that enable us to act according to the highest potential of our character and on behalf of values like truth and beauty. Honesty, courage, compassion, generosity, tolerance, love, fidelity, integrity, fairness, self-control, and prudence are all examples of virtues. Virtue ethics asks of any action, "What kind of person will I become if I do this?" or "Is this action consistent with my acting at my best?"Putting the Approaches TogetherEach of the approaches helps us determine what standards of behavior can be considered ethical. There are still problems to be solved, however.The first problem is that we may not agree on the content of some of these specific approaches. We may not all agree to the same set of human and civil rights.We may not agree on what constitutes the common good. We may not even agree on what is a good and what is a harm.The second problem is that the different approaches may not all answer the question "What is ethical?" in the same way. Nonetheless, each approach gives us important information with which to determine what is ethical in a particular circumstance. And much more often than not, the different approaches do lead to similar answers.Making DecisionsMaking good ethical decisions requires a trained sensitivity to ethical issues and a practiced method for exploring the ethical aspects of a decision and weighing the considerations that should impact our choice of a course of action. Having a method for ethical decision making is absolutely essential. When practiced regularly, the method becomes so familiar that we work through it automatically without consulting the specific steps.The more novel and difficult the ethical choice we face, the more we need to rely on discussion and dialogue with others about the dilemma. Only by careful exploration of the problem, aided by the insights and different perspectives of others, can we make good ethical choices in such situations.We have found the following framework for ethical decision making a useful method for exploring ethical dilemmas and identifying ethical courses of action.A Framework for Ethical Decision MakingRecognize an Ethical IssueCould this decision or situation be damaging to someone or to some group? Does this decision involve a choice between a good and bad alternative, or perhaps between two "goods" or between two "bads"?Is this issue about more than what is legal or what is most efficient? If so, how?Get the FactsWhat are the relevant facts of the case? What facts are not known? Can I learn more about the situation? Do I know enough to make a decision?What individuals and groups have an important stake in the outcome? Are some concerns more important? Why?What are the options for acting? Have all the relevant persons and groups been consulted? Have I identified creative options?Evaluate Alternative ActionsEvaluate the options by asking the following questions:Which option will produce the most good and do the least harm? (The Utilitarian Approach)Which option best respects the rights of all who have a stake? (The Rights Approach)Which option treats people equally or proportionately? (The Justice Approach)Which option best serves the community as a whole, not just some members? (The Common Good Approach)Which option leads me to act as the sort of person I want to be? (The Virtue Approach)Make a Decision and Test ItConsidering all these approaches, which option best addresses the situation?If I told someone I respect-or told a television audience-which option I have chosen, what would they say?Act and Reflect on the OutcomeHow can my decision be implemented with the greatest care and attention to the concerns of all stakeholders?How did my decision turn out and what have I learned from this specific situation?This framework for thinking ethically is the product of dialogue and debate at the Markkula Center for Applied Ethics at Santa Clara University. Primary contributors include Manuel Velasquez, Dennis Moberg, Michael J. Meyer, Thomas Shanks, Margaret R. McLean, David DeCosse, Claire André, and Kirk O. Hanson. It was last revised in May 2009. End of article.Assignment #4IMPORTANT NOTE: This paper must be submitted no later than the last day of class and if late will not be accepted. In addition to the written instructions, there are 2 VIDEOS that explain this assignment. See above links for videos. The final project for this course is an analysis of the legal and or ethical issues involved in the below health care scenario. See questions to be answered at end of this factual scenario below. I have also provided, after the formatting requirements for the paper, two articles that will aid you in your analyzing the scenario and writing your paper. The two articles to base the analysis of your paper are entitled:Clinical Ethics Issues and Discussion andA Framework for Thinking EthicallyThis is the final paper for the class and must be double spaced and be approximately 4-5 pages in 12 point New Times Roman font. Include a cover page [not counted as a page] which should have student name and title of your paper. See more formatting requirements later in these paper instructions.NOTE: For this paper it is unnecessary to do any research beyond the two articles I furnished with this assignment. Both are after the specific paper requirements. You may use all the articles in the class also. To do internet research would only be wasting your valuable time.Case ScenarioA 72 year old woman was admitted to the Neurological Intensive Care Unit following a cerebral hemorrhage which left her with severe brain damage and ventilator dependent. One year before this event, the patient and her husband had drawn up "living wills" with an attorney. She was diagnosed by her treating physician as being in a permanent unconscious condition. The patient's living will specified that the patient did not want ventilator support or other artificial life support in the event of a permanent unconscious condition or terminal condition.The patient's husband is her legal next of kin and the person with surrogate decision-making authority. When the living will was discussed with him, he insisted that the patient had not intended for the document to be used in a situation like the present one. Further discussion with him revealed that he understood that the patient would not be able to recover any meaningful brain function but he argued that the living will did not apply because her condition was not imminently terminal. He further indicated that he did not consider his wife to be in a permanent unconscious condition. The immediate family members (the couple’s adult children) disagreed with their father’s refusal to withdraw life support.The treatment team allowed a week to pass to allow the husband more time to be supported in his grief and to appreciate the gravity of his wife’s situation. Nevertheless, at the end of this time, the husband was unwilling to authorize withdrawal of life support measures consistent with the patient's wishes as expressed in her living will. End of scenario.You paper should have 3 major sections. Each is numbered 1, 2 and 3. Questions to be discussed based on the facts above. You must weave into your discussion the relevant facts from above scenario to support your discussion in discussion areas 2 and 3 below. And for discussion area 3 you must weave into your discussion the ethics philosophy you pick for each issue from the article A Framework for Thinking Ethically. -5% penalty in grading rubric if fail to use appropriate underlined headings in your paper. Three Legal/Ethical Issues. Just list the three most important legal/ethics issues in this scenario that you will discuss. They must be three separate, different and distinct issues. Pay particular attention to the article I furnished with this assignment. No explanation needed, just state them 1, 2, 3. Discussion of Three Legal/Ethical Issues. Discuss the three most important ethical/legal issues you listed above. Must use the relevant facts in the scenario to support your discussion of the legal/ethical issues. Must use underlined headings below. Headings will be: Legal/Ethical issue 1 [state the issue] then discussion Legal/Ethical issue 2 [state the issue] then discussion Legal/Ethical issue 3 [state the issue] then discussion For each legal/ethical issue above discuss a. Why each is a legal /ethical issue? b. Discuss each issue in the context of the scenario facts and c. Define the concepts you useHow I would Handle Each Issue. First, in this section and for each issue, as a health care provider, how would you handle each of the three issues discussed above and why? Must use the relevant facts in the scenario to support your positions. Secondly for each issue, using the article in these requirements, entitled "A Framework of Thinking Ethically" fully discuss the specific ethics philosophy that would epitomize your handling of each issue. Fully define the specific ethics philosophy used and weave the ethics philosophy into your discussion. See article below entitled A Framework for Thinking Ethically. Must use underlined headings below. Headings will be: Handling of Legal/ethical issue #1 [then discussion] Handling of Legal/ethical issue #2 [then discussion] Handling of Legal/ethical issue #3 [then discussion][-5% in grading rubric fail to use appropriate headings in your paper. ]This is an independent paper and you are on the honor system not to discuss or consult with any students or other individuals about this paper. You may use the information we have discussed in the class, the articles in the class, and the two articles I have furnished below. Just so you know, all you need to read to analyze the questions for your paper are the two articles I have furnished with this assignment and information in the class.All you need to read to analyze the questions for this paper are the two articles below entitled:Clinical Ethics Issues and Discussion andA Framework for Thinking EthicallyThe paper must be:Late submission – No late assignment 4 papers will be accepted. Paper is due last day of class. Paper must be in narrative format not outline or bullets. Double spaced and be 4-5 pages in 12 point New Times Roman font. [No deduction if paper exceeds a page or so. Thus 3 and half page paper will be penalized.]Must cite to source of all your facts in the text of your paper in APA format. You can cite directly to the original source. Here are the links to the sources where the University received copyright permissions for the materials:Clinical Ethics and Law:http://depts.washington.edu/bioethx/topics/law.htmlA Framework for Ethical Decision Making:https://www.scu.edu/ethics/ethics-resources/ethical-decision-making/a-framework-for-ethical-decision-making/Include a cover page [not counted as a page] which should have student name and title of your paper [Provide a short name for the legal responsibility the specific health care organization has for one type of patient right in a specific setting ] A the end of the paper a list of references [not counted as a page] Be prepared using word-processing software and saved with a .doc, .docx, or .rtf extension. No pdf.Be uploaded to your Assignments Folder by 11:59 p.m. EST on the due date. The paper is to be posted in Assignment #4 drop box.Grading rubric for assignment is with assignment in Assignments area of class.Background articles to support the issues you will discuss in the paper. Article One of TwoClinical Ethics Issues and Discussion ArticleRelationships: I. clinical ethics, law & risk managementDefinitions and sources of authorityIn the course of practicing medicine, a range of issues may arise that lead to consultation with a medical ethicist, a lawyer, and/or a risk manager. The following discussion will outline key distinctions between these roles.Clinical ethics may be defined as: a discipline or methodology for considering the ethical implications of medical technologies, policies, and treatments, with special attention to determining what ought to be done (or not done) in the delivery of health care. Law may be defined as: established and enforceable social rules for conduct or non-conduct; a violation of a legal standard may create criminal or civil liability.Risk Management may be defined as: a method of reducing risk of liability through institutional policies/practices.Many health care facilities have in-house or on-call trained ethicists to assist health care practitioners, caregivers and patients with difficult issues arising in medical care, and some facilities have formally constituted institutional ethics committees. In the hospital setting, this ethics consultation or review process dates back to at least 1992 with the formulation of accreditation requirements that mandated that hospitals establish a “mechanism” to consider clinical ethics issues.Ethics has been described as beginning where the law ends. The moral conscience is a precursor to the development of legal rules for social order. Ethics and law thus share the goal of creating and maintaining social good and have a symbiotic relationship as expressed in this quote:[C]onscience is the guardian in the individual of the rules which the community has evolved for its own preservation. William Somerset MaughamThe role of lawyers and risk managers are closely linked in many health care facilities. Indeed, in some hospitals, the administrator with the title of Risk Manager is an attorney with a clinical background. There are, however, important distinctions between law and risk management. Risk management is guided by legal parameters but has a broader institution-specific mission to reduce liability risks. It is not uncommon for a hospital policy to go beyond the minimum requirements set by a legal standard. When legal and risk management issues arise in the delivery of health care, ethics issues may also exist. Similarly, an issue originally identified as falling within the clinical ethics domain may also raise legal and risk management concerns.To better understand the significant overlap among these disciplines in the health care setting, consider the sources of authority and expression for each.Ethical norms may be derived from:LawInstitutional policies/practicesPolicies of professional organizationsProfessional standards of care, fiduciary obligationsNote: If a health care facility is also a religious facility, it may adhere to religious tenets. In general, however, clinical ethics is predominantly a secular professional analytic approach to clinical issues and choices.Law may be derived from:Federal and state constitutions (fundamental laws of a nation or state establishing the role of government in relation to the governed)Federal and state statutes (laws written or enacted by elected officials in legislative bodies, and in some states, such as Washington and California, laws created by a majority of voters through an initiative process) Federal and state regulations (written by government agencies as permitted by statutory delegation, having the force and effect of law consistent with the enabling legislation)Federal and state case law (written published opinions of appellate-level courts regarding decisions in individual lawsuits)City or town ordinances, when relevantRisk Management may be derived from law, professional standards and individual institution’s mission and public relations strategies and is expressed through institutional policies and practices.Conceptual Models Another way to consider the relationship among the three disciplines is through conceptual models:LinearDistinctionsInterconnectednessOrientation to law for non-lawyersPotential legal actions against health care providersThere are two primary types of potential civil actions against health care providers for injuries resulting from health care: (1) lack of informed consent, and (2) violation of the standard of care. Medical treatment and malpractice laws are specific to each state.Informed Consent. Before a health care provider delivers care, ethical and legal standards require that the patient provide informed consent. If the patient cannot provide informed consent, then, for most treatments, a legally authorized surrogate decision-maker may do so. In an emergency situation when the patient is not legally competent to give informed consent and no surrogate decision-maker is readily available, the law implies consent on behalf of the patient, assuming that the patient would consent to treatment if he or she were capable of doing so. Information that must be conveyed to and consented to by the patient includes: the treatment’s nature and character and anticipated results, alternative treatments (including non-treatment), and the potential risks and benefits of treatment and alternatives. The information must be presented in a form that the patient can comprehend (i.e., in a language and at a level which the patient can understand) and that the consent must be voluntary given. An injured patient may bring an informed consent action against a provider who fails to obtain the patient’s informed consent in accordance with state law.From a clinical ethics perspective, informed consent is a communication process, and should not simply be treated as a required form for the patient’s signature. Similarly, the legal concept of informed consent refers to a state of mind, i.e., understanding the information provided to make an informed choice. Health care facilities and providers use consent forms to document the communication process. From a provider’s perspective, a signed consent form can be valuable evidence the communication occurred and legal protection in defending against a patient’s claim of a lack of informed consent. Initiatives at the federal level (i.e., the Affordable Care Act) and state level (e.g., Revised Code of Washington § 7.70.060) reflect approaches that support shared decision-making and the use of patient decision aids in order to ensure the provision of complete information for medical decision-making.Failure to follow standard of care. A patient who is injured during medical treatment may also be able to bring a successful claim against a health care provider if the patient can prove that the injury resulted from the provider’s failure to follow the accepted standard of care. The duty of care generally requires that the provider use reasonably expected knowledge and judgment in the treatment of the patient, and typically would also require the adept use of the facilities at hand and options for treatment. The standard of care emerges from a variety of sources, including professional publications, interactions of professional leaders, presentations and exchanges at professional meetings, and among networks of colleagues. Experts are hired by the litigating parties to assist the court in determining the applicable standard of care.Many states measure the provider’s actions against a national standard of care (rather than a local one) but with accommodation for practice limitations, such as the reasonable availability of medical facilities, services, equipment and the like. States may also apply different standards to specialists and to general practitioners. As an example of a statutory description of the standard of care, Washington State currently specifies that a health care provider must “exercise that degree of care, skill, and learning expected of a reasonably prudent health care provider at that time in the profession or class to which he belongs, in the State of Washington, acting in the same or similar circumstances.” III. Common clinical ethics issues: medical decision-making and provider-patient communicationThere are a number of common ethical issues that also implicate legal and risk management issues. Briefly discussed below are common issues that concern medical decision-making and provider-patient communication.If a patient is capable of providing informed consent, then the patient’s choices about treatment, including non-treatment, should be followed. This is an established and enforceable legal standard and also consistent with the ethical principle of respecting the autonomy of the patient. The next two sections (Surrogate decision-making; Advance directives) discuss how this principle is respected from a legal perspective if a patient lacks capacity, temporarily or permanently, to make medical decisions. The third section briefly introduces the issue of provider-patient communication, and highlights a contemporary dilemma raised in decisions regarding the disclosure of medical error to patients.Surrogate decision-makingThe determination as to whether a patient has the capacity to provide informed consent is generally a professional judgment made and documented by the treating health care provider. The provider can make a determination of temporary or permanent incapacity, and that determination should be linked to a specific decision. The legal term competency (or incompetency) may be used to describe a judicial determination of decision-making capacity. The designation of a specific surrogate decision-maker may either be authorized by court order or is specified in state statutes.If a court has determined that a patient is incompetent, a health care provider must obtain informed consent from the court-appointed decision-maker. For example, where a guardian has been appointed by the court in a guardianship action, a health care provider would seek the informed consent of the guardian, provided that the relevant court order covers personal or health care decision-making.If, however, a physician determines that a patient lacks the capacity to provide informed consent, for example, due to dementia or lack of consciousness, or because the patient is a minor and the minor is legally proscribed from consenting, then a legally authorized surrogate decision-maker may be able to provide consent on the patient’s behalf. Most states have specific laws that delineate, in order of priority, who can be a legally authorized surrogate decision-maker for another person. While these laws may vary, they generally assume that legal relatives are the most appropriate surrogate decision-makers. If, however, a patient has previously, while capable of consenting, selected a person to act as her decision-maker and executed a legal document known as a durable power of attorney for health care or health care proxy, then that designated individual should provide informed consent.In Washington State, a statute specifies the order of priority of authorized decision-makers as follows: guardian, holder of durable power of attorney; spouse or state registered partner; adult children; parents; and adult brothers and sisters. If the patient is a minor, other consent provisions may apply, such as: court authorization for a person with whom the child is in out-of-home placement; the person(s) that the child’s parent(s) have given a signed authorization to provide consent; or, a competent adult who represents that s/he is a relative responsible for the child’s care and signs a sworn declaration stating so. Health care providers are required to make reasonable efforts to locate a person in the highest possible category to provide informed consent. If there are two or more persons in the same category, e.g., adult children, then the medical treatment decision must be unanimous among those persons. A surrogate decision-maker is required to make the choice she believes the patient would have wanted, which may not be the choice the decision-maker would have chosen for herself in the same circumstance. This decision-making standard is known as substituted judgment. If the surrogate is unable to ascertain what the patient would have wanted, then the surrogate may consent to medical treatment or non-treatment based on what is in the patient's best interest.Laws on surrogate decision-making are slowly catching up with social changes. Non-married couples (whether heterosexual or same sex) have not traditionally been recognized in state law as legally authorized surrogate decision-makers. This lack of recognition has left providers in a difficult legal position, encouraging them to defer to the decision-making of a distant relative over a spouse-equivalent unless the relative concurs. Washington law, for example, now recognizes spouses and domestic partners registered with the state as having the same priority status. Parental decision-making and minor children. A parent may not be permitted in certain situations to consent to non-treatment of his or her minor child, particularly where the decision would significantly impact and perhaps result in death if the minor child did not receive treatment. Examples include parents who refuse medical treatment on behalf of their minor children because of the parents’ social or religious views, such as Jehovah’s Witnesses and Christian Scientists. The decision-making standard that generally applies to minor patients in such cases is known as the best interest standard. The substituted judgment standard may not apply because the minor patient never had decision-making capacity and therefore substituted judgment based on the minor’s informed choices is not able to be determined. It is important to note that minors may have greater authority to direct their own care depending on their age, maturity, nature of medical treatment or non-treatment, and may have authority to consent to specific types of treatment. For example, in Washington State, a minor may provide his or her own informed consent for treatment of mental health conditions, sexually transmitted diseases, and birth control, among others. Depending on the specific facts, a health care provider working with the provider’s institutional representatives could potentially legally provide treatment of a minor under implied consent for emergency with documentation of that determination, assume temporary protective custody of the child under child neglect laws, or if the situation is non-urgent, the provider could seek a court order to authorize treatment. Advance directivesThe term advance directive refers to several different types of legal documents that may be used by a patient while competent to recor

People lead busy lives. Many individuals find it easy to lose track of just how much food and drink they have consumed throughout the day. This assignment will provide you with an opportunity to track and reflect on your nutritional intake. The results may surprise you!For this assignment, use the Nutritional Intake Worksheet (below) to:Familiarize yourself with the 2015-2020 USDA Dietary Guidelines for an adult.Track all of the food and beverages you consume for a 3-day period.Analyze your nutritional intake compared to the USDA Dietary Guidelines.Answer a series of self-evaluation questions.

Final Project: Incident Response Exercise & ReportYour TaskYou have been assigned to work incident clean-up as part of the Sifers-Grayson Blue Team. Your task is to assist in analyzing and documenting the incident described below. The Blue Team has already created a set of enterprise architecture diagrams (see figures 1-4) to help with your analysis of the incident and preparation of the incident report as required by the company’s contracts with the federal government. After completing their penetration tests, the Red Team provided Sifers-Grayson executives with a diagram showing their analysis of the threat environment and potential weaknesses in the company’s security posture for the R&D DevOps Lab (see figure 5).Your DeliverableComplete and submit the Incident Report form found at the end of this file. Consult the “Notes to Students” for additional directions regarding completion of the form.Overview of the IncidentSifers-Grayson hired a cybersecurity consulting firm to help it meet the security requirements of a contract with a federal agency. The consulting firm’s Red Team conducted a penetration test and was able to gain access to the engineering center’s R&D servers by hacking into the enterprise network through an unprotected network connection (see figure 2). The Red Team proceeded to exfiltrate files from those servers and managed to steal 100% of the design documents and source code for the AX10 Drone System. The Red Team also reported that it had stolen passwords for 20% of the employee logins using keylogging software installed on USB keys that were left on the lunch table in the headquarters building employee lounge (see Figure 3). The Red Team also noted that the Sifers-Grayson employees were quite friendly and talkative as they opened the RFID controlled doors for the “new folks” on the engineering staff (who were actually Red Teamers).The Red Team continued its efforts to penetrate the enterprise and used a stolen login to install malware over the network onto a workstation connected to a PROM burner in the R&D DevOps lab (See Figure 3). This malware made its way onto a PROM that was then installed in an AX10-a test vehicle undergoing flight trials at the Sifers-Grayson test range (See Figures 1 and 4). The malware “phoned home” to the Red Team over a cellular connection to the R&D center. The Red Team took control of the test vehicle and flew it from the test range to a safe landing in the parking lot at Sifers-Grayson headquarters.BackgroundSifers-Grayson is a family owned business headquartered in Grayson County, Kentucky, USA. The company’s physical address is 1555 Pine Knob Trail, Pine Knob, KY 42721. The president of the company is Ira John Sifers, III. He is the great-grandson of one of the company’s founders and is also the head of the engineering department. The chief operating officer is Michael Coles, Jr. who is Ira John’s great nephew. Mary Beth Sifers is the chief financial officer and also serves as the head of personnel for the company.Recent contracts with the Departments of Defense and Homeland Security have imposed additional security requirements upon the company and its R&D DevOps and SCADA labs operations. The company is now required to comply with NIST Special Publication 800-171 Protecting Controlled Unclassified Information in Nonfederal Information Systems and Organizations. The company must also comply with provisions of the Defense Federal Acquisition Regulations (DFARS) including section 252-204-7012 Safeguarding Covered Defense Information and Cyber Incident Reporting. These requirements are designed to ensure that sensitive technical information, provided by the federal government and stored on computer systems in the Sifers-Grayson R&D DevOps and SCADA labs, is protected from unauthorized disclosure. This information includes software designs and source code. The contract requirements also mandate that Sifers-Grayson report cyber incidents to the federal government in a timely manner.SCADA LABThe SCADA lab was originally setup in 1974. It has been upgraded and rehabbed several times since then. The most recent hardware and software upgrades were completed three years ago after the lab was hit with a ransomware attack that exploited several Windows XP vulnerabilities. At that time, the engineering and design workstations were upgraded to Windows 8.1 professional. A second successful ransomware attack occurred three months ago. The company paid the ransom in both cases because the lab did not have file backups that it could use to recover the damaged files (in the first case) and did not have system backups that it could use to rebuild the system hard drives (in the second case).The SCADA Lab is locked into using Windows 8.1. The planned transition to Windows 10 is on indefinite hold due to technical problems encountered during previous attempts to modify required software applications to work under the new version of the operating system. This means that an incident response and recovery capability for the lab must support the Windows 8.1 operating system and its utilities.R&D DEVOPS LABThe R&D DevOps Lab was built in 2010 and is used to develop, integrate, test, support, and maintain software and firmware (software embedded in chips) for the company’s robots, drones, and non-SCADA industrial control systems product lines. The workstations in this lab are running Windows 10 and are configured to receive security updates per Microsoft’s monthly schedule.ENTERPRISE IT OPERATIONSThe company uses a combination of Windows 10 workstations and laptops as the foundation of its enterprise IT capabilities. The servers in the data center and the engineering R&D center are built upon Windows Server 2012.Issues Summary:Newly won government contracts now require compliance with DFARS §252.204-7008, 7009, and 7012Derivative requirements include:Additional Contractual Requirements for Lab Operations include:Notes to Students:1.Your final deliverable should be professionally formatted and should not exceed 10 pages. The goal is to be clear and concise in your reporting of your analysis of this incident.2.You may include annotated diagrams if necessary to illustrate your analysis and/or make your point(s). You may use the figures in this assignment as the foundation for diagrams in your final report (no citations required).3.Use the NIST Incident Handling Process (see Table 1) to guide your incident analysis.4.You may assume that the company has implemented one or more of the IT products that you recommended in your Case Studies for this course. You may also assume that the company is using the incident response guidance documents that you wrote for your labs and that the associated operating systems utilities are in use (e.g. you can assume that system backups are being made, etc.).DOCUMENT YOUR ASSUMPTIONS about people, processes, and technologies as if they were fact. But, don’t change any of the factual information provided in the incident report from the Red Team.Use the incident report form that appears at the end of this file. Copy it to a new MS Word document. After you perform your incident analysis, fill in the required information, attach the file to your assignment folder entry, and submit it for grading as your final project.For section 1 of the form, use your own name but provide reasonable but fictitious information for the remaining fields.For section 2 of the form, assign IP addresses in the following ranges to any servers, workstations, or network connections that you need to discuss.R&D Center 10.10.150.0/24Test Range 10.10.148.0/24Corporate Headquarters 10.10.155.0/24For sections 2, 3, and 5, you should use and interpret information provided in this file (Overview, Background, Issues Summary). You may use a judicious amount of creativity, if necessary, to fill in any missing information.For section 4 of the form you may provide a fictitious cost estimate based upon $100 per hour for IT staff to perform “clean-up” activities. Reasonable estimates are probably in the range of 150 to 300 person hours. What’s important is that you document how you arrived at your cost estimate.Discuss the contract requirements and derivative requirements for cybersecurity at Sifers-Grayson in 3 to 5 paragraphs under “Section 6 General Comments.”Words for the Wise …Do not let “perfection” be a barrier to completing this assignment. It’s more importation to be on-time and provide SOME analysis in a professional format than to find and document every single possible vulnerability. Figure 1. Overview of Sifers-Grayson Enterprise IT ArchitectureFigure 2. Combined Network and Systems Views:Sifers-Grayson Headquarters, R&D Center, and Data Center Figure 3. Combined Network and Systems View for Sifers-Grayson R&D DevOps Lab Figure 4. Combined Communications and Systems Views for Sifers-Grayson Test Range Figure 5. Threat Landscape for Sifers-Grayson R&D DevOps Lab NIST Incident Handling Checklist by PhaseDetection and Analysis1.Determine whether an incident has occurred1.1Analyze the precursors and indicators1.2Look for correlating information1.3Perform research (e.g., search engines, knowledge base)1.4As soon as the handler believes an incident has occurred, begin documenting the investigation and gathering evidence2.Prioritize handling the incident based on the relevant factors (functional impact, information impact, recoverability effort, etc.)3.Report the incident to the appropriate internal personnel and external organizationsContainment, Eradication, and Recovery4.Acquire, preserve, secure, and document evidence5.Contain the incident6.Eradicate the incident6.1Identify and mitigate all vulnerabilities that were exploited6.2Remove malware, inappropriate materials, and other components6.3If more affected hosts are discovered (e.g., new malware infections), repeat the Detection and Analysis steps (1.1, 1.2) to identify all other affected hosts, then contain (5) and eradicate (6) the incident for them7.Recover from the incident7.1Return affected systems to an operationally ready state7.2Confirm that the affected systems are functioning normally7.3If necessary, implement additional monitoring to look for future related activityPost-Incident Activity8.Create a follow-up report9.Hold a lessons learned meeting (mandatory for major incidents, optional otherwise)Source: NIST SP 800-61r2Cichonski, P., Millar, T., Grance, T., & Scarfone, K. (2012). Computer security incident handling guide (NIST SP 800-62 rev. 2). http://dx.doi.org/10.6028/NIST.SP.800-61r2 Contact Information for the Incident Reporter and HandlerIncident DetailsCause of the Incident (e.g., misconfigured application, unpatched host)Cost of the IncidentBusiness Impact of the IncidentGeneral Comments– Name– Role– Organizational unit (e.g., agency, department, division, team) and affiliation– Email address– Phone number– Location (e.g., mailing address, office room number)– Status change date/timestamps (including time zone): when the incident started, when the incident was discovered/detected, when the incident was reported, when the incident was resolved/ended, etc.– Physical location of the incident (e.g., city, state)– Current status of the incident (e.g., ongoing attack)– Source/cause of the incident (if known), including hostnames and IP addresses– Description of the incident (e.g., how it was detected, what occurred)– Description of affected resources (e.g., networks, hosts, applications, data), including systems’ hostnames, IP addresses, and function– If known, incident category, vectors of attack associated with the incident, and indicators related to the incident (traffic patterns, registry keys, etc.)– Prioritization factors (functional impact, information impact, recoverability, etc.)– Mitigating factors (e.g., stolen laptop containing sensitive data was using full disk encryption)– Response actions performed (e.g., shut off host, disconnected host from network)– Other organizations contacted (e.g., software vendor)