It is the policy of UW–Madison that the units of the UW HCC and each unit within UW–Madison that is a business associate of a covered entity (hereafter collectively referred to as “units”) ensure the confidentiality, integrity, and availability of all protected health information by establishing the following documentation and procedural requirements.
- Access to information systems and applications by all users, including but not limited to workforce members, volunteers, business associates, contracted providers, consultants, and any other person or entity, is only authorized as described in UW-109 The Minimum Necessary Standard.
- The same levels of confidentiality that exist for hardcopy protected health information, business, and proprietary information apply to digital and/or electronic protected health information within the organization’s information systems and applications, and are extended even after termination or another conclusion of access.
- Additional restrictions on system access are included in UW-133 HIPAA Security Remote Access and UW-136 HIPAA Security System Configuration and Use.
- Role-based access authorization categories must be based on the criteria described in UW-109 The Minimum Necessary Standard.
- The user is granted access based on these pre-determined roles. When there is not a suitable pre-defined role, the business data custodian may authorize access.
- Access authorization, revocation of authorization, or other authorization decisions must be documented. See sections VII (Documentation Requirements) and VIII (Forms).
Workforce Clearance Procedure
- The level of access assigned to a user of the organization’s information systems and applications is based on the criteria described in UW-109 The Minimum Necessary Standard.
- Any access not specifically authorized is prohibited. When possible, technical means will be used to prevent unauthorized access.
Access Establishment and Modification
- Access to any of the organization’s information systems and applications will not be granted until:
- Training, as described in UW-137 HIPAA Privacy and Security Training, is completed.
- A signed Confidentiality and Information Access Agreement is on file. Forms and signatures may be electronic. See sections VII (Documentation Requirements) and VIII (Forms).
- Whenever new or expanded access to specific resources is requested:
- Access will not be granted until a System Access Request form is received, reviewed, and any additional approval is obtained.
- When reviewing a request for new access, the requestor’s current access should also be reviewed and modified to conform with the criteria described in UW-109 The Minimum Necessary Standard.
- Each user’s access must be periodically reviewed and modified to conform with the criteria described in UW-109 The Minimum Necessary Standard.
- The person who authorizes access should be different from the person who grants access.
Unique User Identification and Person or Entity Authentication
- Multi-factor authentication should be used when available.
- Access to the organization’s information systems and applications is controlled by requiring unique user login IDs and passwords for each individual user or entity.
- Users may not allow anyone for any reason to have access to any information system or application using another user’s unique user login ID and password.
- If a user believes their user login ID has been compromised, they are required to immediately report the incident as described in UW-131 Reporting of HIPAA Incidents and Notifications in the Case of Breaches of Unsecured PHI.
- When user login IDs and passwords are used to control access to the organization’s information systems and applications, the passwords must not be disclosed.
- Passwords are not displayed at any time, nor should they be stored in clear text in programming scripts.
- A user login ID and generic password are initially assigned for each user. The user login ID and password are forwarded to the user securely. Users are required to change the password upon first-time use.
- Minimum password requirements are described in the UW–Madison IT Password Standard. Units and information systems may require stronger passwords.
- Users are required to change passwords periodically.
- The information systems or applications are programmed to deny a user’s ability to use up to a pre-determined number of prior passwords whenever possible.
- The Human Resources Department (or other designated department), and a workforce member’s supervisor must ensure that the Change/Termination Checklist is processed upon completion and/or termination of the workforce member’s employment or other workforce relationship, or upon a change in job assignment or employment status. See sections VII (Documentation Requirements) and VIII (Forms).
- Each person responsible for a portion of the off-boarding or change process must complete their portion of the Change/Termination Checklist.
- A workforce member’s access rights must be terminated immediately upon notification, or if the change is scheduled, on the effective date of the change.
- The unit must document and maintain all of the following records for a period of at least six years, from the date of its creation or the date when it last was in effect, whichever is later:
- Records of authorization decisions. (See I. above)
- System Access Request Forms. (See III. above)
- Confidentiality and Information Access Agreement. (See III. above)
- Change/Termination Checklists. (See VI. above.)
- A description of the workforce members who are able to add, remove, or modify the access to some or all of the organization’s information systems.
Forms and signatures may be paper or electronic.
- Confidentiality and Information Access Agreement (template)
- System Access Request (template)
- Change/Termination Checklist (template)
Consequences for Noncompliance
Failing to comply with this policy may result in discipline for the individual(s) responsible for such noncompliance.
Further, the U.S.Department of Health and Human Services (HHS) Office for Civil Rights (OCR) is responsible for enforcing the HIPAA Privacy and Security Rules, and an individual’s noncompliance may result in institutional noncompliance and/or an investigation by OCR. OCR attempts to resolve investigations by obtaining voluntary compliance and entering into corrective action plans and resolution agreements. Failure to comply with HIPAA or cooperate with OCR in an investigation may result in civil and/or criminal penalties.