7. Ability to provide physical security P5. Limit clinician documentation entry to TBD safeguards of computing and access only those practitioners who are associated devices or any equipment containing with a specific patient within the system. private, secret, or confidential information or intellectual property of the organization. 8. Adhere to security, privacy and P3. Full release of information functionality, TBD confidentiality requirements including tracking receipts for requests, regulations, policies) when determining gathering electronic medical records from all a method for the final disposition of facilities, and processing those files, the information, regardless of source or billing and collections associated with the media. Whether that disposition is release, and the actual distribution of the archival, transfer to another copies for the records. organization, preservation for permanent storage, or destruction. 9. Ability to establish an audit program P6. Employ a break-the-glass emergency TBD that defines a clear process for verifying access methodology to override access whether sensitive security information control measures designed to protect patient is being handled in accordance with the privacy and confidentiality. Utilize audit organization’s policies and procedures, trails to monitor compliance with and compliant with applicable laws and organization privacy policy and procedures. business practices. Appendix B: HIM Practice Use Cases Sections below describe Use Cases developed from the harmonized HIM business requirements and HIM practices checklist (Appendix A) under information availability (A) principle as follows: episode of care record The following numbering convention was used to manage the Use A1.1: A availability principle; 1– HIM Practice #1 as listed in the Checklist (Appendix A); 1 – – number of the Use Case under HIM Practice #1. Information Governance Principle: Record Availability
7. Ability to provide physical security safeguards of computing and access devices or any equipment containing private, secret, or confidential information or intellectual property of the organization. P5. Limit clinician documentation entry to only those practitioners who are associated with a specific patient within the system. TBD 8. Adhere to security, privacy and confidentiality requirements regulations, policies) when determining a method for the final disposition of information, regardless of source or media. Whether that disposition is archival, transfer to another organization, preservation for permanent storage, or destruction. P3. Full release of information functionality, including tracking receipts for requests, gathering electronic medical records from all facilities, and processing those files, the billing and collections associated with the release, and the actual distribution of the copies for the records. TBD 9. Ability to establish an audit program that defines a clear process for verifying whether sensitive security information is being handled in accordance with the organization’s policies and procedures, and compliant with applicable laws and business practices. P6. Employ a break-the-glass emergency access methodology to override access control measures designed to protect patient privacy and confidentiality. Utilize audit trails to monitor compliance with organization privacy policy and procedures. TBD Appendix B: HIM Practice Use Cases Sections below describe Use Cases developed from the harmonized HIM business requirements and HIM practices checklist (Appendix A) under information availability (A) principle as follows: episode of care record The following numbering convention was used to manage the Use A1.1: A – availability principle; 1– HIM Practice #1 as listed in the Checklist (Appendix A); 1 – number of the Use Case under HIM Practice #1. Information Governance Principle: Record Availability
IHE_ITI_WP_HITStdsforHIMPratices_Rev1.0_PC_2015-06-19_Comment_Resolution_V2.docx