Home Forums Discussions Meaningful Use Lawyers, Guns and Money.....and Security

1 ?172.302(o) Access control. Assign a unique name and/or number for
identifying and tracking user identity and establish controls that permit only authorized users to access electronic health information.
2 ?172.302(p) Emergency access. Permit authorized users (who are authorized for emergency situations) to access electronic health information during an emergency.
3 ?172.302(q) Automatic log-off. Terminate an electronic session after a predetermined time of inactivity.
4 ?172.302(r) Audit Log.
(1) Record actions. Record actions related to electronic health information in accordance with the standard specified in ? 170.210(b).
(2) Generate audit log. Enable a user to generate an audit log for a specific time period and to sort entries in the audit log according to any of the elements specified in the standard at 170.210(b).
5 ?172.302(s) Integrity.
(1) Create a message digest in accordance with the standard specified in 170.210(c).
(2) Verify in accordance with the standard specified in 170.210(c) upon receipt of electronically exchanged health information that such information has not been altered.
(3) Detection. Detect the alteration of audit logs.
6 ?172.302(t) Authentication. Verify that a person or entity seeking access to electronic health information is the one claimed and is authorized to access such information.
7 ?172.302(u) General encryption. Encrypt and decrypt electronic health information in accordance with the standard specified in ? 170.210(a)(1), unless the Secretary determines that the use of such algorithm would pose a significant security risk for Certified EHR Technology.
8 ?172.302(v) Encryption when exchanging electronic health information. Encrypt and decrypt electronic health information when exchanged in accordance with the standard specified in ? 170.210(a)(2).
9 ?172.302(w) Disclosures. Certification criterion made optional.
Record disclosures made for treatment, payment, and health care operations in accordance with the standard specified in ? 170.210(e).