2014-141 Health - NC HIE to oversee, administer and operate electronic health information exchange network

Browse Search

Network and for any other individuals'use of the HIE Network by use of any security credential received or obtained, directly or indirectly, lawfully or unlawfully, from the Participant or its Authorized Users. (c) Participant will use and maintain reasonable and appropriate administrative, technical and physical safeguards to protect the confidentiality, integrity, and availability of Patient Information and to prevent the acquisition, access, Disclosure or use of Patient Information through the HIE Network other than for Permitted Purposes or as required by Applicable Law. To that end,Participant agrees to: (i) Establish role-based access standards reasonably designed to enable each Authorized User to access such Patient Information through the HIE Network as is necessary for the performance of his or her authorized activities. These standards shall ensure that Authorized Users access Disclose or use only the Minimum Necessary amount of Patient Information reasonably required to carry out the authorized purpose. (ii) Establish policies and procedures that provide for appropriate: (i) identification and authentication of its Authorized Users; (ii) security audit controls and documentation to guard against unauthorized access to Patient Information; and (iii) protection against any type of virus or malicious software designed to disrupt the operation of,destroy or damage its or NC HIE's System or the HIE Network. (d) Participant shall have in place written User Access Policies that govern its Authorized Users' ability to access, Disclose and use Patient Information through the HIE Network using such Participant's System. Such Policies shall be consistent with this Agreement. Participant agrees to provide to NC HIE,upon reasonable request,copies or detailed summaries of its User Access Policies. (e) Participant is responsible for establishing a means to inform its Authorized Users of notices, changes, information and restrictions applicable to the use and Disclosure of Patient Information through the HIE Network under this Agreement. Participant shall require that all of its Authorized Users comply with the applicable requirements of this Agreement and Applicable Law and shall promptly take appropriate action in the event that Participant knows, or reasonably should have known, of a violation of the Agreement by an Authorized User. Participant will be responsible for any breach of this Agreement by an Authorized User. Participant agrees that notices provided to Participant will be effective as to Authorized Users and the Participant will secure Authorized Users agreement to the foregoing. (f) Participants shall provide periodic reports to NC HIE upon request about the security measures implemented for using the HIE Network, including any material security incidents that have arisen since any prior report. A "material security incident" is one that results in unauthorized acquisition, access, use, disclosure, modification, destruction of Patient Information, or interference with NC HIE's or Participant's System operations. Security incidents that are not material include,but are not limited to,pings on a firewall,attempts to log onto a system with an invalid security credential, malware, and denial-of-service attacks that do not result in a server being taken off-line. (g) NC HIE,in its discretion,may deny access to Patient Information through the HIE Network to any Participant or Authorized User it reasonably believes has acquired, 7