Many hospitals allow physicians access to all patient records, not just the patients they're treating, to be sure they have information needed in an emergency. Many organizations don't maintain audit logs of accesses to clinical data. Others have audit logs but haven't developed tools or procedures for systematically reviewing those logs for patterns of abuse. Vendors haven't put advanced security features on their systems because healthcare organizations haven't demanded them. Instead, vendors have focused development efforts in functional areas.
Information is protected against loss, destruction, tampering, and unauthorized use.
Hospital demonstrates respect for patient privacy and confidentiality. Accredited hospitals are required to comply with state and federal law and regulation. Accredited organizations can expect to see a more intense focus on information security in the survey process. If they are used, however, they must comply with the requirements that will be outlined in the final regulations. Currently, the Department of Health and Human Services proposes to adopt a cryptographically based digital signature as the standard.