HIPAA Security System Access

Layout for printing
Policy Number:
UW-132
Old Policy Number:
8.9
Responsible Office:
Office of Compliance

University Policy

Rationale/​Purpose:

In enacting HIPAA, Congress mandated the establishment of Federal standards for the privacy of individually identifiable health information. Under the patchwork of laws existing prior to adoption of HIPAA and the Privacy Rule, personal health information could be distributed—without either notice or authorization—for reasons that had nothing to do with a patient's medical treatment or health care reimbursement. For example, unless otherwise forbidden by State or local law, without the Privacy Rule patient information held by a health plan could, without the patient’s permission, be passed on to a lender who could then deny the patient's application for a home mortgage or a credit card, or to an employer who could use it in personnel decisions. The Privacy Rule establishes a Federal floor of safeguards to protect the confidentiality of medical information. State laws which provide stronger privacy protections apply over and above the new Federal privacy standards.

Definitions:
Business data custodian
A university official having direct operational-level responsibility for the management of one or more types of data. They are charged with providing authorization for access to institutional data. 
Electronic protected health information (ePHI)
Any individually identifiable health information protected by HIPAA that is transmitted by or stored in electronic media.
Minimum necessary information
Protected health information that is the minimum necessary to accomplish the intended purpose of the access, acquisition, use, disclosure, or request. The “minimum necessary information” principle applies to all protected health information in any form. 
Protected health information (“PHI”)
Health information or health care payment information, including demographic information collected from an individual, which identifies the individual or can be used to identify the individual. PHI does not include student records held by educational institutions or employment records held by employers. 
Role
The category or class of person or persons doing a type of job, defined by a set of similar or identical responsibilities.
User
A person or entity who has access to the organization’s information systems. This includes workforce members, business associates, external research collaborators, and other external persons or entities of all kinds. 
Workforce
Employees, volunteers, trainees, and other persons whose conduct, in the performance of work for a covered entity, is under the direct control of such entity, whether or not they are paid by the covered entity.
Scope:

Applies to all members of the UW-Madison Health Care Component.

Policy:

Policy Summary

It is the policy of the University of Wisconsin-Madison (UW-Madison) that the units of the UW-Madison Health Care Component and each unit within UW-Madison that is a Business Associate of a covered entity, (hereafter collectively referred to as “units,”) ensure the confidentiality, integrity, and availability of all protected health information (PHI) by establishing the following documentation and procedural requirements.

  1. Access to information systems and applications by all users, including but not limited to workforce members, volunteers, business associates, contracted providers, consultants, and any other person or entity, is only authorized as described in UW-109 The Minimum Necessary Standard.
  2. The same levels of confidentiality that exist for hard copy PHI, business, and proprietary information apply to digital and/or electronic protected health information (ePHI) within the organization’s information systems and applications, and are extended even after termination or other conclusion of access.
  3. Additional restrictions on system access are included in UW-133 HIPAA Security Remote Access and UW-136 HIPAA Security System Configuration and Use.

Policy Detail

  1. Access Authorization
    1. Role based access authorization categories must be based on the criteria described in UW-109 The Minimum Necessary Standard.
    2. The user is granted access based on these pre-determined roles. When there is not a suitable pre-defined role, the Business Data Custodian may authorize access.
    3. Access authorization, revocation of authorization, or other authorization decisions must be documented. See sections (VII) Documentation Requirements, and (VIII) Forms.
  2. Workforce Clearance Procedure
    1. The level of access assigned to a user of the organization’s information systems and applications is based on the criteria described in UW-109 The Minimum Necessary Standard.
    2. Any access not specifically authorized is prohibited. When possible, technical means will be used to prevent unauthorized access.
  3. Access Establishment and Modification
    1. Access to any of the organization’s information systems and applications will not be granted until:
      1. Training, as described in UW-137 HIPAA Privacy and Security Training, is completed.
      2. A signed "Confidentiality and Information Access Agreement” is on file. Forms and signatures may be electronic. See sections (VII) Documentation Requirements, and (VIII) Forms.
    2. Whenever new or expanded access to specific resources is requested:
      1. Access will not be granted until a "System Access Request" form is received, reviewed, and any additional approval is obtained.
      2. When reviewing a request for new access, the requestor’s current access should also be reviewed and modified to conform with the criteria described in UW-109 The Minimum Necessary Standard.
    3. Each user’s access must be periodically reviewed and modified to conform with the criteria described in UW-109 The Minimum Necessary Standard.
    4. The person who authorizes access should be different from the person who grants access.
  4. Unique User Identification and Person or Entity Authentication
    1. Multi-factor authentication should be used when available.
    2. Access to the organization’s information systems and applications is controlled by requiring unique User Login ID’s and password for each individual user or entity.
    3. Users may not allow anyone for any reason to have access to any information system or application using another user’s unique User Login ID and password.
    4. If a user believes their User Login ID has been compromised, they are required to immediately report the incident as described in UW-131 Reporting of HIPAA Incidents and Notifications in the Case of Breaches of Unsecured PHI.
  5. Password Management
    1. When User Login IDs and passwords are used to control access to the organization’s information systems and applications, the passwords must not be disclosed.
    2. Passwords are not displayed at any time, nor should they be stored in clear text in programming scripts.
    3. A User Login ID and generic password is initially assigned for each user. The User Login ID and password are forwarded to the user securely. Users are required to change the password upon first-time use.
    4. Minimum password requirements are described in the UW-Madison Password Standard. Units and information systems may require stronger passwords.
    5. Users are required to change passwords periodically.
    6. The information systems or applications are programmed to deny a user’s ability to use up to a pre-determined number of prior passwords whenever possible.
  6. Change/Termination Procedures
    1. The Human Resources Department (or other designated department), and a workforce member’s supervisor must ensure that the “Change/Termination Checklist” is processed upon completion and/or termination of the workforce member’s employment or other workforce relationship, or upon a change in job assignment or employment status. See sections (VII) Documentation Requirements, and (VIII) Forms.
    2. Each person responsible for a portion of the off-boarding or change process must complete their portion of the “Change/Termination Checklist.”
    3. A workforce member’s access rights must be terminated immediately upon notification, or if the change is scheduled, on the effective date of the change.
  7. Documentation Requirements
    1. The unit must document and maintain all of the following records for a period of at least six years, from the date of its creation or the date when it last was in effect, whichever is later.
      1. Records of authorization decisions. (See I. above)
      2. System Access Request Forms. (See III. above)
      3. Confidentiality and Information Access Agreement. (See III. above)
      4. Change/Termination Checklists. (See VI. above.)
      5. A description of the workforce members who are able to add, remove, or modify the access to some or all of the organization’s information systems.

  8. Forms

    Forms and signatures may be paper or electronic.

    1. Confidentiality and Information Access Agreement (template)
    2. System Access Request (template)
    3. Change/Termination Checklist (template)

Consequences for Non-Compliance

Failing to comply with this policy may result in discipline for the individual(s) responsible for such non-compliance.

Further, the US Department Health and Human Services (HHS) Office for Civil Rights (OCR) is responsible for enforcing the HIPAA Privacy and Security Rules, and an individual’s non-compliance may result in institutional non- compliance and/or an investigation by OCR. OCR attempts to resolve investigations by obtaining voluntary compliance and entering into Corrective Action Plans and Resolution Agreements. Failures to comply with HIPAA or cooperate with OCR in an investigation may result in civil and/or criminal penalties.

Related UW-Madison Policies:
Related UW–Madison Documents, Web Pages, or Other Resources:

Additional information may be found at www.compliance.wisc.edu/hipaa

External References:

Policy Administration

Approval Authority:
Vice Chancellor for Legal Affairs
Policy Manager:
HIPAA Security Coordinator
Contact:
HIPAA Security Officer -- Dharvesh Naraine, naraine@wisc.edu, (608) 262-1664
Effective Date:
02-21-2018
Revised Dates:

02-21-2018: Effective date of the revised policy: 02-21-2018.
03-26-2020: Effective date of the revised policy: 03-26-2020.

Retrieved:
12-04-2021 02:15:53