Source: https://knowledgebase.apexsql.com/hipaa-compliance-checklist-apexsql-audit/
Timestamp: 2019-04-22 00:32:04+00:00

Document:
The Health Insurance Portability and Accountability Act (HIPAA) is a regulatory standard enacted by the US Congress to protect and safeguard healthcare information.
“The Health Insurance Portability and Accountability Act of 1996 (HIPAA; Pub.L. 104–191, 110 Stat. 1936, enacted August 21, 1996) was enacted by the United States Congress and signed by President Bill Clinton in 1996. It has been known as the Kennedy–Kassebaum Act or Kassebaum-Kennedy Act after two of its leading sponsors. Title I of HIPAA protects health insurance coverage for workers and their families when they change or lose their jobs. Title II of HIPAA, known as the Administrative Simplification (AS) provisions, requires the establishment of national standards for electronic health care transactions and national identifiers for providers, health insurance plans, and employers.
§ 164.308 (a)(1)(i) Security management process. Implement policies and procedures to prevent, detect, contain, and correct security violations.
Supports – Centralized consolidation Archival or audit trials, using predefined and custom-built reports covering all major types of activities Full oversight of who changed, what, where and when. Complete auditing of data transfer, access, and changes. Also audit of system access and configuration changes.
§164.308(a)(1)(ii)(D) Information system activity review: Implement procedures to regularly review records of information system activity, such as audit logs, access reports, and security incident tracking reports.
Supports – ApexSQL Audit comprises real-time information and reporting of all activities performed on the server/database level, including what individual performed each action.
§164.308(a)(3)(ii)(C) Termination procedures: Implement procedures for terminating access to electronic protected health information when the employment of a workforce member ends.
§164.308 (a)(4)(i) Information access management. Implement policies and procedures for authorizing access to electronic protected health information that are consistent with the applicable requirements of subpart E of this part.
§164.308 (a)(4)(ii)(A) Isolating health care clearinghouse functions. If a health care clearinghouse is part of a larger organization, the clearinghouse must implement policies and procedures that protect the electronic protected health information of the clearinghouse from unauthorized access by the larger organization.
Supports – Comprehensive auditing and reporting for all types of login/user privileges, access rights, privileges, and access policies to detect security violations.
§164.308(a)(5)(ii)(C) Log-in monitoring. Procedures for monitoring log-in attempts and reporting discrepancies.
Supports – ApexSQL Audit monitors in real-time all access and attempted to access, whether by individuals or by other systems, with ability to trigger alerts and inform the personnel in charge immediately.
Supports – Allows users to periodically and frequently review control procedures as part of automated audits and reports procedures to regularly review audit trails to identify and mitigate security incidents as they occur.
§164.308(a)(7)(ii)(B) Disaster recovery plan. Establish (and implement as needed) procedures to restore any loss of data.
Supports – Investigate audit trail with changes including before/after values.
§164.312(a)(2)(i) Unique user identification. Assign a unique name and/or number for identifying and tracking user identity.
Supports – Comprehensive audits for all database activity is presented in detailed reports. Real time configurable alerts are available.
§164.312(d) Person or entity authentication. Implement procedures to verify that a person or entity seeking access to electronic protected health information is the one claimed.
§164.316(b)(1)(ii) If an action, activity or assessment is required by this subpart to be documented, maintain a written (which may be electronic) record of the action, activity, or assessment.
Supports – Full auditing of who, what, and where. Comprehensive reports and real, time configurable alerts are available for HIPAA compliance feedback. All data is archived in a central repository database.
§164.316(b)(2)(i) Time limit. Retain the documentation required by paragraph (b)(1) of this section for 6 years from the date of its creation or the date when it last was in effect, whichever is later.
§164.316(b)(2)(ii) Availability. Make documentation available to those persons responsible for implementing the procedures to which the documentation pertains.

References: § 164

§164

§164

§164

§164

§164

§164

§164

§164

§164

§164

§164