Unauthorized or inappropriate access to ePHI can compromise the confidentiality, integrity, and availability of your practice’s ePHI. Unauthorized disclosure, loss, or theft of ePHI can lead to medical identity theft. Accurate ePHI may not be available when needed, which can adversely impact your healthcare professionals’ ability to diagnose and treat their patients. Examples of Safeguards: Below are some potential safeguards to use against possible threats/vulnerabilities. NOTE: The safeguards you choose will depend on the degree of risk and the potential harm that the threat/vulnerability poses to you and the individuals who are the subjects of the ePHI. Implement procedures for the authorization and/or supervision of workforce members who work with electronic protected health information or in locations where it might be accessed. [45 CFR §164.308(a)(3)(ii)(A)] Establish processes to ensure that individuals requiring access to organizational information and information systems sign appropriate access agreements prior to being granted access; and periodically review and update the signed access agreements. [NIST SP 800-53 PS-6] Develop procedures to: Specify authorized users of the information system, group and role membership, and account privileges for each account. Create, enable, modify, disable, and remove accounts. Notify account managers when accounts are no longer required, access requirements change, workforce members are terminated, information system or need-to-know changes. Associate access authorizations and other attributes with each information system account. [NIST SP 800-53 AC-2] A25 - §164.308(a)(3)(ii)(A) Addressable Do your practice’s policies and procedures for access authorization address the of those who are not members of its workforce? Yes No If no, please select from the following: Cost Practice Size
Unauthorized or inappropriate access to ePHI can compromise the confidentiality, integrity, and availability of your practice’s ePHI. Unauthorized disclosure, loss, or theft of ePHI can lead to medical identity theft. Accurate ePHI may not be available when needed, which can adversely impact your healthcare professionals’ ability to diagnose and treat their patients. Examples of Safeguards: Below are some potential safeguards to use against possible threats/vulnerabilities. NOTE: The safeguards you choose will depend on the degree of risk and the potential harm that the threat/vulnerability poses to you and the individuals who are the subjects of the ePHI. Implement procedures for the authorization and/or supervision of workforce members who work with electronic protected health information or in locations where it might be accessed. [45 CFR §164.308(a)(3)(ii)(A)] Establish processes to ensure that individuals requiring access to organizational information and information systems sign appropriate access agreements prior to being granted access; and periodically review and update the signed access agreements. [NIST SP 800-53 PS-6] Develop procedures to: Specify authorized users of the information system, group and role membership, and account privileges for each account. Create, enable, modify, disable, and remove accounts. Notify account managers when accounts are no longer required, access requirements change, workforce members are terminated, information system or need-to-know changes. Associate access authorizations and other attributes with each information system account. [NIST SP 800-53 AC-2] A25 - §164.308(a)(3)(ii)(A) Addressable Do your practice’s policies and procedures for access authorization address the of those who are not members of its workforce? Yes No If no, please select from the following: Cost Practice Size