Source: http://customessaywriters.info/node/125531
Timestamp: 2019-10-20 06:39:51
Document Index: 197388134

Matched Legal Cases: ['§ 170', '§ 170', '§ 170', '§ 170', '§ 170', '§ 170']

Auditing actions on health information | customessaywriters.info- customessaywriters.info
Not required, but recommended: § 170.210(c)(2) A hashing algorithm with a security strength equal to or greater than SHA-2 as specified by NIST in
This criterion is an “abridged” version of § 170.315(d)(2) “auditable events and tamper resistance” as some of the capabilities included in § 170.315(d)(2) would likely not apply to a customessaywriters.info Module certified only to the applicable programming interface (“API”) criteria, such as recording the audit log status or encryption status of electronic health information locally stored on end-user devices by the technology. A developer may choose to certify either § 170.315(d)(2) or this criterion at § 170.315(d)(10) to meet the requirements of 2015 Edition privacy and security approach. [see also ]
To meet this provision for certification, the health IT must be set by default to record the actions and information specified. This is to ensure that at the point of installation or upgrade, the health IT will be set by default for a provider to record the actions and information specified in § 170.210(e)(1). [see also ]
Only those sections specified from section 7 (i.e., 7.2 through 7.4, 7.6, and 7.7) of ASTM E2147-01 are the minimum required for certification. [see also ]
Regarding the granularity of the information we expect to be recorded, this should be consistent with the guidance in Section 7.7 of ASTM E2147-01, which states the “granularity should be specific enough to clearly determine if data designated by federal or state law as requiring special confidentiality protection has been accessed.” And, more to the point, Section 7.7 goes on to state that “[s]pecific category of data content, such as demographics, pharmacy data, test results, and transcribed notes type, should be identified.” For example, the ability of the audit log to record that the user accessed a patient’s medication list would be sufficient for certification, and the audit log would not need to also record the specific medication. [see also ]
We intend that the actions and information can be captured in a manner that supports the forensic reconstruction of the sequence of changes to a patient’s chart. [see also ]
customessaywriters.info does not have to interpret the meaning of “limited.” To meet this provision, health IT would need to include a capability that allows only a limited set of users to have the privileges necessary to change when auditing is enabled or disabled. Generally, we would expect any general health IT user could perform such actions. [see also ]
This provision would not prohibit an organization from making a policy decision to delete or purge audit logs after a legal retention period. Rather it focuses only on the prohibition of health IT to delete an audit log as a condition of certification. [see also ]
This provision requires health IT to be able to determine whether activity outside of its control has in some way altered the audit log (e.g., that the operating system was exploited to modify the health IT’s database). [see also ]
Hashing is one method to detect whether an audit log has been altered. We encourage the use of hashing algorithms specified in FIPS 180-4 (Secure Hash Standard) to determine whether the audit log has been altered. [see also ]