Encryption or limited ability to link patients with data must be used where indicated by A.1. 7. The system must be capable of reproducing a paper record which contains all documented information that is stored within the electronic record including the dates that the information was entered and the identity of the author of the entry. Uninterruptable power supply is advisable. An inventory control should be maintained for all equipment and media currently in use. When physicians dispose of their office computer hardware, all patient information must first be eliminated.
Programs are available which erase data to the level of 'military standards'.
NO 1.There are clear objectives for the purpose and use of the data base. 2.Sensitive data and linkages are identified and appropriate security in place. 3.Staff working with system signs formal agreement of confidentiality. 4.Staff working with system are provided with pre-employment training relative to security. 5.Specific written policies describe the measures to be taken regarding prevention of security breach.