Orange County NC Website
Browse       Search
Policy 28: Policy on Electronic Information System Activity Review and Auditing <br /> North State Medical Transport <br /> Policy on Electronic Information System Activity Review and Auditing <br /> Purpose <br /> The Health Insurance Portability and Accountability Act of 1996 (HIPAA) requires North <br /> State Medical Transport to monitor and audit its electronic information system used to create, <br /> receive, maintain or transmit electronic protected health information ("e-PHI") so that quality <br /> assurance procedures will detect and address problems with the system. North State Medical <br /> Transport needs to identify the specific actions that have taken place such as timing and <br /> completion of back-up procedures, tracking server file access, and tracking power interruptions <br /> and other unusual events that could compromise our system and threaten the integrity of e- <br /> PHI. <br /> Scope <br /> This policy applies to all North State Medical Transport staff members who are <br /> responsible for monitoring and maintaining our electronic information system or are <br /> responsible for its security. The policy also applies to staff members assisting with the audit <br /> and review process. The HIPAA Compliance Officer shall have overall responsibility for <br /> monitoring, maintaining, and overseeing the security of our electronic information system and <br /> conducting audits. <br /> Procedure <br /> 1. The HIPAA Compliance Officer will develop procedures to document the creation, <br /> receipt, maintenance and transmission of e-PHI within the information system. <br /> 2. The HIPAA Compliance Officer will review the records of information system activities, <br /> including a review of audit logs, security incident tracking reports, back-up records, etc., <br /> as necessary. <br /> 3. Uses and disclosures need not be documented for purposes of an audit trail if the use is <br /> made entirely within the internal information system and the use did not involve any <br /> outside parties. <br /> 4. Disclosures that are required to be accounted for under HIPAA shall be recorded and <br /> tracked. Generally all non-patient authorized disclosures that are not related to <br /> treatment, payment and healthcare operations will be accounted for. An accounting of <br /> these disclosures must include: <br />