7. Ability to provide physical security safeguards of computing and access devices or any equipment containing private, secret, or confidential information or intellectual property of the organization. P5. Limit clinician documentation entry to only those practitioners who are associated with a specific patient within the system. TBD 8. Adhere to security, privacy and confidentiality requirements regulations, policies) when determining a method for the final disposition of information, regardless of source or media. Whether that disposition is archival, transfer to another organization, preservation for permanent storage, or destruction. P3. Full release of information functionality, including tracking receipts for requests, gathering electronic medical records from all facilities, and processing those files, the billing and collections associated with the release, and the actual distribution of the copies for the records. TBD 9. Ability to establish an audit program that defines a clear process for verifying whether sensitive security information is being handled in accordance with the organization’s policies and procedures, and compliant with applicable laws and business practices. P6. Employ a break-the-glass emergency access methodology to override access control measures designed to protect patient privacy and confidentiality. Utilize audit trails to monitor compliance with organization privacy policy and procedures. TBD Appendix B: HIM Practice Use Cases Sections below describe Use Cases developed from the harmonized HIM business requirements and HIM practices checklist (Appendix A) under information availability (A) principle as follows: episode of care record The following numbering convention was used to manage the Use A1.1: A – availability principle; 1– HIM Practice #1 as listed in the Checklist (Appendix A); 1 – number of the Use Case under HIM Practice #1. Information Governance Principle: Record Availability
Appendix D: HIT Standards for HIM Practices Business Requirements Standards Development Organizations HL7 ISO ASTM Information Availability 1. Maintain information in a manner that ensures timely, accurate, and efficient retrieval. EHRS FM R2 ISO/HL710781 ISO/IEEE IS 11073-10101 2004 ISO/IEEE IS 11073-10103 2014 ISO/IEEE IS 11073-10201 2004 ISO/IEEE IS 11073-10404 2010 ISO/IEEE IS 11073-10407 2010 ISO/IEEE IS 11073-10408 2010 -08a 2. Enable of requestor in information by ability to ensure the timeliness, accuracy (completeness and correctness), and efficiency of information availability. EHRS FM R2 CDA R2 ISO/HL710781 ISO IS 13606-1 2008 ISO IS 13606-2 ISO IS 13606-3 2009 E1633 -08a E2369-12 3. Ability to identify, locate, and retrieve the information required to support organization’s ongoing activities via queries and access to data across various systems. E1384-07 4. Ability to address multiple demands having the right information available at the right time for the right requestor. EHRS FM R2 ISO/HL710781 ISO IS 2008 ISO IS 13606-2 ISO IS 2009 ISO/TS TS 14265 2011 E1744-04 E2369-12 E2473 5. Ability to search for information in continually expanding volumes of information and multiple systems including multiple electronic and manual systems. ISO/TS TS 14265 2011 E2369-12 6. Ability to assemble information from disparate electronic systems, both internal and external to the actual or virtual location(s) of the organization. CDA R2
7. Ability to access information created with legacy hardware and software systems. In case of impending system obsolescence, information with organizational value should be migrated to currently supported hardware and/or converted into a machine-readable format. 8. Ability to maintain metadata services across all participating systems assigning structural and descriptive characteristics to information including data provenance information, e.g., authors and dates of creation, modification, sending, receipt, access, etc. EHRS FM R2 ISO/TS TS 17948 2014 9. Ability to manage both vendor relationships and employee turnover to maintain the workforce capabilities on the most current methods to access information. 10. To ensure levels of redundancy, failover, contingencies and other risk management practices to minimize risks of non-availability of information due to a disaster, system malfunction, or data corruption. Information Integrity 1. Maintain information in a manner that ensures confidence in its authenticity, timeliness, accuracy, and completeness. EHRS FM R2 ISO/HL710781 ISO/IEEE IS 2004 ISO/IEEE IS 11073-10103 2014 ISO/IEEE IS 11073-10201 2004 ISO/IEEE IS 11073-10404 2010 ISO/IEEE IS 11073-10407 2010 ISO/IEEE IS 11073-10408 2010 E1633 -08a 2. Ability to maintain integrity of information to comply with safety, quality of care, and compliance with applicable voluntary, regulatory and legal requirements. EHRS FM R2 ISO/HL710781