Health Insurance Portability and Accountability Act (HIPAA) requires compliance audit to be conducted by the office of the inspector general at the U.S. Department of Health and Human Service (HHS) and here is a list of some of the information which can be sought by the HHS official if your organization is on an HIPAA audit:
The HHS officers can seek the policies and procedures responsible for:
- Establishing and terminating users’ access to systems housing electronic patient health information (ePHI).
- Emergency access to electronic information systems.
- Inactive computer sessions (periods of inactivity).
- Recording and examining activity in information systems that contain or use ePHI.
- Electronically transmitting ePHI.
- Preventing, detecting, containing and correcting security violations (incident reports).
- Regularly reviewing records of information system activity, such as audit logs, access reports and security incident tracking reports.
- Creating, documenting and reviewing exception reports or logs. Please provide a list of examples of security violation logging and monitoring.
- Monitoring systems and the network, including a listing of all network perimeter devices, i.e. firewalls and routers.
- Physical access to electronic information systems and the facility in which they are housed.
- Establishing security access controls; (what types of security access controls are currently implemented or installed in hospitals’ databases that house ePHI data?).
- Firewalls, routers and switches.
- Maintenance and repairs of hardware, walls, doors, and locks in sensitive areas.
- Terminating an electronic session and encrypting and decrypting ePHI.
- Password and server configurations.
- Anti-virus software.
- Network remote access.
HHS can also request to provide a list of all information systems that house ePHI data, as well as network diagrams, including all hardware and software that are used to collect, store, process or transmit ePHI, a list of terminated employees and all new recruits, authentication methods used to identify users authorized to access ePHI, a list of transmission methods used to transmit ePHI over an electronic communications network, a list of systems administrators, backup operators and users, a list of database security requirements and settings, a list of all Primary Domain Controllers (PDC) and servers (including Unix, Apple, Linux and Windows) and so on and so forth.
