HIPAA Security Survey Part II 09/29/2005

    

1). DISCLOSURE ACCOUNTING:

Per the Privacy Rule, individuals have the right to an accounting of the disclosures of their protected information by a covered entity or of the covered entity’s business associate.

    
1. Do you log disclosures as they occur, or only when an accounting of disclosures is requested?

As they occur


76
92%
When requested
8 10%

    
2. If you answered "as they occur", how?

Manually case-by case


45
58%
Electronically through a disclosure tracking system
37 48%

    
3. If you track disclosures electronically, Is it:

Home grown application


25
66%
Purchased software
11 29%
 
If purchased, identify the software
9 24%

    
4. Does your software collect data across your enterprise?

Yes


27
46%
No
32 54%
  59 100%

    
5. If a patient has disclosures at more than one site in your organization, do you perform an accounting of disclosures from:

The site that received the request for an accounting only?


21
28%
All locations that made disclosures on this patient?
54 72%

    

ROLE-BASED ACCESS TO PHI:

With role-based access control, an organization can electronically restrict the user to only PHI access that’s necessary to perform the job.

    
6. Does your organization control your employees’ access to PHI through a role–based access model?

Yes


69
85%
No
12 15%
  81 100%

    
7. If your organization has multiple job duties assigned to employees, and multiple systems available to employees, how is an employee’s access to PHI controlled? Do you:

Provide all access?


9
11%
Provide no access?
0 0%
Control access manually?
9 11%
Control access electronically?
67 85%

8. If you answered "manually", please explain how? If you answered "electronically", what electronic tools are being used to facilitate that control?
Respondent Number Response
1 Software / committee that reviews access and grants on individual basis
2 Security levels built into our main system and ancillary systems. Employees may have different levels of access in different systems, depending on their job functions.
3 Not sure - IT handles.
4 Employees have different passwords for each computer system - so if the information for both jobs is in the same computer system, they have all access - if the jobs require different computer systems, access is controlled by password or electronically
5 Each employee is given access to the information that they need for each application that they use. It is not unusual for them to be able to access more than they need to, but for most applications, they cannot access everything.
6 Password driven systems.
7 manual logs and lists
8 Unique user IDs matched to access through our software at the system administrator level.
9 A request by the employees manager goes to the administrator of each system needed by the employee. We hope to have an electronic tool that will be controlled by our Lawson HR system sometime next year.
10 authentication; password controls
11 Not sure of the software name.
12 Practice mgt system allow us to designate particular tasks to a particular user (Misys Tiger). On main system with Outlook, etc, restrictions are set by user re: what can be done, viewed, etc. by our IT person with our direction.
13 Computerized Physician Order Entry
14 Access codes are provided through MIS
15 The IT department must grant access through desktop icons, passwords, all approved by the employee's manager.
16 Through policies and procedures
17 Each application requires the employee to have a username and password
18 system software
19 Per system based on the role-based models.
20 Completes a acess authorization signed off by department director and VP
21 We have multiple systems. Employee role based classification is reviewed on each system for access approval
22 LOG-INS & PASSWORDS FOR SPECIFIC AREAS OF DATABASES
23 Permissions given to systems at security level for assigned jobs.
24 We use both manual and electronic contols. Electronically, we provide access to all info needed to perform the job function. Manually we monitor via policy that the employee only uses their access to obtain the minimum necessary info to perform his/her job.
25 menu and security keys
26 #6 = partially, working on single sign-on technology #8 = the major software applications have this capability built into them
27 via the job description
28 IS manager takes care of this, I cannot explain.
29 Managed through STAR
30 Not sure IT does it. The Information Owner must fill out a form on hire and change of duites and IT allows access at delegated by Information Owner.
31 We are installing Cerner hospital wide solution with its multiple levels electronically
32 Manual: Job descriptions; physical access; staff monitoring Electronically: pass words; restricted access to certain programs

    
9. Is your organization interested in participating in organized functions surrounding HIPAA Privacy, such as conference call or meetings in a central location?

Yes


37
47%
No
41 53%
  78 100%