HIPAA Security Auditing

Layout for printing

Policy Number:

UW-126

Old Policy Number:

8.3

Responsible Office:

Office of Compliance

University Policy

Rationale/​Purpose:

In enacting HIPAA, Congress mandated the establishment of federal standards for the privacy of individually identifiable health information. Under the patchwork of laws existing prior to adoption of HIPAA and the Privacy Rule, personal health information could be distributed—without either notice or authorization—for reasons that had nothing to do with a patient's medical treatment or health care reimbursement. For example, unless otherwise forbidden by state or local law, without the Privacy Rule patient information held by a health plan could, without the patient’s permission, be passed on to a lender who could then deny the patient's application for a home mortgage or a credit card, or to an employer who could use it in personnel decisions. The Privacy Rule establishes a federal floor of safeguards to protect the confidentiality of medical information. State laws that provide stronger privacy protections apply over and above the federal privacy standards.

Definitions:

Business associate

A person or entity not affiliated with UW–Madison that performs or assists in performing, for or on behalf of any unit in the UW–Madison health care component (UW HCC), business support functions/services that involve the use of protected health information (PHI).

Audit

Internal process of reviewing information system access and activity (e.g., log-ins, file accesses, and security incidents). An audit may be done as a periodic event, as a result of a potential breach, patient complaint, or suspicion of employee wrongdoing. Audit activities also take into consideration information system risk assessment results.

Audit controls

Technical mechanisms that track and record computer/system activities.

Audit logs

Records of activity maintained by the system which provide:

• The date and time of significant activity;
• The origin of significant activity;
• The identification of user performing significant activity; and
• A description of attempted or completed significant activity.

Audit trail

To monitor information operations to determine if a security violation occurred by providing chronological audit logs that relate to an operating system, an application, or user activities. Audit trails help provide:

• Individual accountability for activities such as unauthorized access of electronic protected health information (ePHI);
• Reconstruction of an unusual occurrence of events such as an intrusion into the system to alter information; and

• Problem analysis such as an investigation into a slowdown in a system’s performance.

  An audit trail identifies who (login) did what (create, read, modify, delete, add, etc.) to what (data) and when (date, time).

Electronic protected health information (ePHI)

Any individually identifiable health information protected by HIPAA that is transmitted by or stored in electronic media.

Protected health information (PHI)

Health information or health care payment information, including demographic information collected from an individual, which identifies the individual or can be used to identify the individual. Protected health information does not include student records held by educational institutions or employment records held by employers.

Trigger event

An activity that may be indicative of a security breach that requires further investigation.

UW–Madison health care component (UW HCC)

Those units of UW–Madison that have been designated by the university as part of its health care component under HIPAA. See UW-100 Designation of UW–Madison Health Care Component for a listing of these units.

Workforce

Employees, volunteers, trainees, and other persons whose conduct, in the performance of work for a covered entity, is under the direct control of such entity, whether or not they are paid by the covered entity.

Scope:

Applies to all members of the UW HCC.

Policy:

Policy Summary

1. UW–Madison, the units of the UW HCC, and each individual or unit within UW–Madison that is a business associate of a covered entity (hereafter collectively referred to as “units”) will audit access and activity of electronic protected health information applications, systems, and networks and address standards set forth by the HIPAA Security Rule to ensure compliance to safeguarding the privacy and security of such information.
2. The Security Rule requires covered entities to implement reasonable hardware, software, or procedural mechanisms that record and examine activity in information systems that contain or use electronic protected health information. Audit activities may be limited by application, system, or network auditing capabilities and resources. UW–Madison and each unit will make reasonable and good-faith efforts to safeguard information privacy and security through a well-thought-out approach to auditing that is consistent with available resources.

Policy Details

1. General

   1. Responsibility for auditing information system access and activity is assigned at two levels:
      1. The UW–Madison HIPAA security officer is responsible for:
         1. Auditing resources and facilities that are managed at the campus level. This includes, but is not limited to, the campus-level security awareness and training program. See section VI. below.
         2. Security controls and backup for audit logs of resources and facilities the UW–Madison HIPAA security officer is responsible for auditing. See section V. below.
         3. Arranging for or coordinating external audits and other external resources to assist in audits at all levels. See section VII. below regarding external audits.
         4. Advising the HIPAA security coordinator of each unit, and arranging for additional auditing support for the unit as warranted.
      2. The HIPAA security coordinator of a unit is responsible for:
         1. Auditing resources and facilities that are managed by the HIPAA security coordinator’s unit, including any unit-level security awareness and training.
         2. Security controls and backup for audit logs of resources and facilities the HIPAA security coordinator is responsible for auditing. See section V. below.
         3. Assisting the UW–Madison HIPAA security officer in campus-level audits on matters related to the HIPAA security coordinator’s unit.
         4. Jointly auditing resources and facilities that are shared by multiple units and are jointly managed by the participants, with the HIPAA security coordinator of one unit selected to lead the audit-related activities and the HIPAA security coordinators of other participating units assisting the selected leader. The selected leader will also coordinate security controls and backup for audit logs of such resources and facilities. See section V. below.
   2. The UW–Madison HIPAA privacy officer, UW–Madison chief information officer (CIO), and other UW–Madison campus leaders provide leadership support for the UW–Madison HIPAA security officer so that resources can be identified and audits can be accomplished. The CIO or IT director of the unit or other unit leaders provide the corresponding leadership support for the HIPAA security coordinator of their unit.
   3. The auditing procedures at both the campus level and the unit level are the same, with the exception of the general differences described in I.1 and I.2 above, and any specific language included below.
   4. The responsible individual, as defined in I.1 above, needs to:
      1. Assign the task of generating reports for audit activities to the person responsible for the application, system, or network.
      2. Assign the task of reviewing the audit reports to the person responsible for the application, system, or network, or to any other person determined to be appropriate for the task.
      3. Organize and provide oversight to a team structure charged with audit compliance activities (e.g., parameters, frequency, sample sizes, report formats, evaluation, follow-up, etc.)
   5. The auditing processes need to address access and activity at the following levels:
      1. User: User-level audit trails generally monitor and log commands directly initiated by the user, identification and authentication attempts, and files and resources accessed.
      2. Application: Application-level audit trails generally monitor and log user activities, including data files opened and closed, specific actions, and printing reports.
      3. System: System-level audit trails generally monitor and log user activities, applications accessed, and other system-defined specific actions.
      4. Network: Network-level audit trails generally monitor information on what is operating, penetrations, and vulnerabilities.
   6. The responsible individual, as defined in section I.1 above, and their supporting leadership need to determine the systems or activities that will be tracked or audited by:
      1. Focusing efforts on areas of greatest risk and vulnerability as identified in the information systems risk assessment and ongoing risk management processes.
      2. Maintaining confidentiality, integrity, and availability of electronic protected health information applications and systems.
      3. Assessing the appropriate scope of system audits based on the size of the resource or facility and the needs of the campus or unit by asking:
         1. What information/electronic protected health information is at risk?
         2. What systems, applications, or processes are vulnerable to unauthorized or inappropriate access?
         3. What activities should be monitored (create, read, update, delete)?
         4. What information should be included in the audit record?
      4. Assessing available organizational resources.
   7. The responsible individual, as defined in section I.1 above, and their supporting leadership need to identify “trigger events” or criteria that raise awareness of questionable conditions of viewing of confidential information. At a minimum, trigger events will include:
      1. Patient complaints.
      2. Employee complaints.
      3. Suspected breaches of patient confidentiality. 
      4. High-risk or problem-prone events (e.g., VIP admissions).
   8. The responsible individual, as defined in section I.1. above, and their supporting leadership need to determine auditing frequency by reviewing past experience, current and projected future needs, and industry trends and events. The UW–Madison HIPAA security officer will provide advice on the suitable range of audit frequency by unit. The unit will determine its ability to generate, review, and respond to audit reports using internal resources, and may request additional resources or assistance. The units and UW–Madison recognize that failure to address automatically generated audit logs, trails, and reports through a systematic review process may be more detrimental to the organization than not auditing at all (e.g., state/federal licensing and accrediting agencies).
   9. The UW–Madison HIPAA security officer, UW-Madison IT security staff, the HIPAA security coordinator of a unit, the unit’s IT security staff, or their designees are authorized to select and use auditing tools that are designed to detect network vulnerabilities and intrusions. Such tools are explicitly prohibited by others without the explicit authorization of the UW–Madison HIPAA security officer. These tools may include, but are not limited to:
      1. Scanning tools and devices.
      2. War dialing software.
      3. Password cracking utilities.
      4. Network “sniffers.”
      5. Passive and active intrusion detection systems.
   10. Audit documentation/reporting tools need to address, at a minimum, the following data elements:
       1. Application, system, network, department, or user audited
       2. Audit type
       3. Individual/department responsible for audit
       4. Date(s) of audit
       5. Reporting responsibility/structure for review audit results
       6. Conclusions
       7. Recommendations
       8. Actions
       9. Assignments
       10. Follow-up
   11. The process for review of audit logs, trails, and reports needs to include:
       1. A description of the activity as well as the rationale for performing the audit.
       2. Identification of which workforce members or department/unit will be responsible for review (workforce members should not review audit logs that pertain to their own system activity).
       3. The frequency of the auditing process.
       4. Determination of significant events requiring further review and follow-up.
       5. Identification of appropriate reporting channels for audit results and required follow-up. The procedures in UW-131 Notification and Reporting in the Case of Breach of Unsecured Protected Health Information may be used to report a single event.
   12. Vulnerability testing software may be used to probe the network to identify what is running (e.g., operating system or product versions in place), if publicly-known vulnerabilities have been corrected, and whether the system can withstand attacks aimed at circumventing security controls.
       1. Testing may be carried out internally or provided through an external third-party vendor. Whenever possible, a third-party auditing vendor should not be providing the organization IT oversight services (e.g., vendors providing IT services should not be auditing their own services; there should be a separation of duties).
       2. Testing is to be done on a routine basis (e.g., annually).

2. Audit Requests for Specific Cause

   1. A request may be made for an audit for a specific cause. The request may come from a variety of sources including, but not limited to, Human Resources, Risk Management, the UW–Madison HIPAA privacy officer, the UW–Madison HIPAA security officer, or a member of either the UW–Madison administration or the unit’s administration.
   2. A request for an audit for a specific cause must include the time frame, frequency, and nature of the request. The request must be reviewed and approved by the UW–Madison HIPAA privacy officer or UW–Madison HIPAA security officer.
   3. A request for an audit as a result of a patient concern is to be initiated by the UW–Madison HIPAA privacy officer or UW–Madison HIPAA security officer. Under no circumstances and at no time should detailed audit information be shared with the patient. UW–Madison is not obligated to provide a detailed listing of those workforce members who use a patient’s protected health information for treatment, payment, or health care operations.
      1. Should the audit disclose that a workforce member has accessed a patient’s protected health information inappropriately, the minimum necessary/least privileged information should be shared with the HIPAA privacy coordinator of the unit and the workforce member’s supervisor or Human Resources Department to determine appropriate sanction/ corrective disciplinary action.
      2. Only de-identified information should be shared with the patient regarding the results of the investigative audit process. This information is to be communicated to the patient by the UW–Madison HIPAA privacy officer or designee, after seeking appropriate risk management or legal counsel.

3. Evaluation and Reporting of Audit Findings

   1. Audit information that is routinely gathered must be reviewed in a timely manner by the individual/department responsible for the activity/process (e.g., weekly, monthly, quarterly, etc.).
   2. The reporting process must allow for meaningful communication of the audit findings to those departments/units sponsoring the activity.
      1. Significant findings are to be reported immediately in a written format. The procedures in UW-131 Notification and Reporting in the Case of Breach of Unsecured Protected Health Information may be used to report a single event.
      2. Routine findings are to be reported to the sponsoring leadership structure in a written report format.
   3. Reports of audit results must be limited to internal use on a minimum necessary/need-to-know basis. Audit results are not to be disclosed externally without the approval of legal counsel or the UW–Madison HIPAA privacy officer.
   4. Generic security audit information may be included in organizational reports. Individually-identifiable patient protected health information must not be included in the reports.
   5. Whenever indicated through evaluation and reporting, appropriate corrective actions must be undertaken. These actions are to be documented and shared with the responsible and sponsoring departments/units.

4. Auditing Business Associate or Vendor Access and Activity

   1. Periodic monitoring of business-associate and vendor information system activity must be carried out to ensure that access and activity are appropriate for privileges granted and necessary to the arrangement between UW–Madison and the external agency.
   2. If it is determined that the business associate or vendor has exceeded the scope of access privileges, UW-Madison must reassess the business relationship. See UW-116 Managing Arrangements with Business Associates of the University of Wisconsin-Madison.
   3. If it is determined that a business associate has violated the terms of the HIPAA business associate agreement/addendum, UW–Madison must take immediate action to remediate the situation. Continued violations may result in the discontinuation of the business relationship.

5. Audit Log Security Controls and Backup

   1. Audit logs are to be protected from unauthorized access or modification, so the information they contain will be available to evaluate a security incident. Generally, system administrators should not have access to the audit trails or logs created on their systems.
   2. Whenever possible, audit trail information is to be stored on a separate system to minimize the impact auditing may have on the audited system and to prevent access to audit trails by those with system administrator privileges. This is done to apply the security principle of “separation of duties” to protect audit trails from hackers. Audit trails maintained on a separate system would not be available to hackers who may break into the network and obtain system administrator privileges. A separate system would allow UW–Madison to detect hacking security incidents.
   3. Audit logs maintained within an application are to be backed up as part of the application’s regular backup procedure.
   4. UW–Madison will audit internal backup, storage, and data recovery processes to ensure that the information is readily available in the manner required. Auditing of data backup processes will be carried out:
      1. On a periodic basis (recommend at least annually) for established practices and procedures.
      2. More often for newly developed practices and procedures (e.g., weekly, monthly, or until satisfactory assurance of reliability and integrity has been established).

6. Workforce Training, Education, Awareness, and Responsibilities

   1. Workforce members are provided training, education, and awareness on safeguarding the privacy and security of businesses' and patients' protected health information. UW–Madison’s commitment to auditing access and activity of the information applications, systems, and networks is communicated through new employee orientation, ongoing training opportunities and events, and applicable policies.
   2. Workforce members are made aware of responsibilities with regard to privacy and security of information as well as applicable sanctions/corrective disciplinary actions should the auditing process detect a workforce member’s failure to comply with organizational policies. See UW-125 HIPAA Security Oversight; UW-137 HIPAA Privacy and Security Training; UW-138 Responding to Employee Noncompliance with Policies and Procedures Relating to the HIPAA Privacy and Security Rules and UW-139 Responding to Student Noncompliance with Policies and Procedures Relating to the HIPAA Privacy and Security Rules.

7. External Audits of Information Access and Activity

   Information system audit information and reports gathered from contracted external audit firms, business associates, and vendors are to be evaluated, and appropriate corrective action steps taken as indicated. Prior to contracting with an external audit firm, UW–Madison will:

   1. Outline the audit responsibility, authority, and accountability.
   2. Choose an audit firm that is independent of other organizational operations.
   3. Ensure technical competence of the audit firm staff.
   4. Require the audit firm’s adherence to applicable codes of professional ethics.
   5. Obtain a signed HIPAA-compliant business associate agreement.
   6. Assign organizational responsibility for supervision of the external audit firm.

Consequences for Noncompliance

Failing to comply with this policy may result in discipline for the individual(s) responsible for such noncompliance.

Further, the U.S. Department of Health and Human Services (HHS) Office for Civil Rights (OCR) is responsible for enforcing the HIPAA Privacy and Security Rules, and an individual’s noncompliance may result in institutional noncompliance and/or an investigation by OCR. OCR attempts to resolve investigations by obtaining voluntary compliance and entering into corrective action plans and resolution agreements. Failure to comply with HIPAA or cooperate with OCR in an investigation may result in civil and/or criminal penalties.

Related UW-Madison Policies:

UW-100 Designation of UW-Madison Health Care Component

UW-116 Managing Arrangements with Business Associates of the University of Wisconsin-Madison

UW-117 Managing Business Associate Arrangements When the University of Wisconsin-Madison is the Business Associate

UW-118 Use of and Safeguards for Protected Health Information by UW-Madison Internal Business Support Personnel

UW-124 HIPAA Security Risk Management

UW-125 HIPAA Security Oversight

UW-127 HIPAA Security Contingency Planning

UW-130 Destruction/Disposal of Protected Health Information

UW-131 Notification and Reporting in the Case of Breach of Unsecured Protected Health Information

UW-132 HIPAA Security System Access

UW-134 HIPAA Security Data Management and Backup

UW-135 HIPAA Security Facilities Management

UW-137 HIPAA Privacy and Security Training

UW-138 Responding to Employee Noncompliance with Polices and Procedures Relating to the HIPAA Privacy and Security Rules

UW-139 Responding to Student Noncompliance with Policies and Procedures Relating to the HIPAA Privacy and Security Rules

UW-520 Computer Logging Statement

UW-509 Information Incident Reporting and Response

UW-518 Vulnerability Scanning 

Related UW–Madison Documents, Web Pages, or Other Resources:

Additional information may be found at www.compliance.wisc.edu/hipaa

External References:

45 C.F.R. § 164.308(a)(1)(ii)(D) (HIPAA Security Rule – Information System Activity Review)

45 C.F.R. § 164.308(a)(5)(ii)(B) (HIPAA Security Rule – Protection from Malicious Software)

45 C.F.R. § 164.308(a)(5)(ii)(C) (HIPAA Security Rule – Log-in Monitoring)

45 C.F.R. § 164.308(a)(2) (HIPAA Security Rule – HIPAA Security Rule Periodic Evaluation)

45 C.F.R. § 164.308(b) (HIPAA Security Rule – Business Associate Contracts and other Arrangements)

45 C.F.R. § 164.312(b) (HIPAA Security Rule –Audit Controls

45 C.F.R. § 164.312(c)(2) (HIPAA Security Rule – Mechanism to Authenticate ePHI)

45 C.F.R. § 164.312(e)(2)(i) (HIPAA Security Rule – Integrity Controls)

45 CFR §164.316(a-b) (HIPAA Security Rule – Documentation)

HIPAA Collaborative of Wisconsin “Auditing Information System Activity”

Policy Administration

Approval Authority:

Vice Chancellor for Legal Affairs

Policy Manager:

HIPAA Privacy Officer

Contact:

HIPAA Privacy Officer -- Jack Talaska, JACK.TALASKA@WISC.EDU, (608) 265-4077

Effective Date:

06-09-2015

Revised Dates:

02-09-2015: Effective date of the revised policy: 02-09-2015.
03-26-2020: Effective date of the revised policy: 03-26-2020.

Retrieved:

12-02-2024 23:44:03