password protected for both sending and receiving any PHI, PII and/or FTI. Must utilize an access management function that restricts IV.M Operations Phase - access to varying levels of system Privacy and Security functionality and information. Must restrict access to information on a privilege” basis (e.g., “least users who are permitted inquiry IV.M Operations - privileges only will not be permitted Privacy and Security to modify information). Must restrict access to specific system functions and information based on an individual user profile, including inquiry only capabilities. Access to all functions must be IV.M Operations Phase - restricted to specified staff, with Privacy and Security approval of the State. Must restrict unsuccessful attempts to access system functions to attempts, with a system function that automatically prevents further IV.M Operations Phase - access attempts and records those Privacy and Security occurrences. Must provide for the physical safeguarding of its data processing facilities and the systems and information housed within those facilities. The DMA must provide IV.M Operations - the State with access to data Privacy and Security facilities on request. Must restrict perimeter access to equipment sites, processing areas, and storage areas through a key card or other comparable system, as well as provide accountability control to record access attempts, IV.M Operations Phase - including attempts of unauthorized Privacy and Security access.
password protected for both sending and receiving any PHI, PII and/or FTI. IV.M Operations Phase - Privacy and Security Must utilize an access management function that restricts access to varying levels of system functionality and information. IV.M Operations - Privacy and Security Must restrict access to information on a “least privilege” basis (e.g., users who are permitted inquiry privileges only will not be permitted to modify information). IV.M Operations Phase - Privacy and Security Must restrict access to specific system functions and information based on an individual user profile, including inquiry only capabilities. Access to all functions must be restricted to specified staff, with approval of the State. IV.M Operations Phase - Privacy and Security Must restrict unsuccessful attempts to access system functions to attempts, with a system function that automatically prevents further access attempts and records those occurrences. IV.M Operations - Privacy and Security Must provide for the physical safeguarding of its data processing facilities and the systems and information housed within those facilities. The DMA must provide the State with access to data facilities on request. IV.M Operations Phase - Privacy and Security Must restrict perimeter access to equipment sites, processing areas, and storage areas through a key card or other comparable system, as well as provide accountability control to record access attempts, including attempts of unauthorized access.
Revised%20Attachment%20B%20-%20Business%20and%20Technical%20Requirements%20Matrix.docx