ASTM E2147-01(2009)
(Specification)Standard Specification for Audit and Disclosure Logs for Use in Health Information Systems
Standard Specification for Audit and Disclosure Logs for Use in Health Information Systems
ABSTRACT
This specification describes the security requirements involved in the development and implementation of audit and disclosure logs used in health information systems. It specifies how to design an access audit log to record all access to patient identifiable information maintained in computer systems, and includes principles for developing policies, procedures, and functions of health information logs to document all disclosure of confidential health care information to external users for use in manual and computer systems. This specification provides for two main purposes, namely: to define the nature, role, and function of system access audit logs and their use in health information systems as a technical and procedural tool to help provide security oversight; and to identify principles for establishing a permanent record of disclosure of health information to external users and the data to be recorded in maintaining it.
SIGNIFICANCE AND USE
Data that document health services in health care organizations are business records and must be archived to a secondary but retrievable medium. Audit logs should be retained, at a minimum, according to the statute governing medical records in the geographic area.
The purpose of audit access and disclosure logs is to document and maintain a permanent record of all authorized and unauthorized access to and disclosure of confidential health care information in order that health care providers, organizations, and patients and others can retrieve evidence of that access to meet multiple needs. Examples are clinical, organizational, risk management, and patient rights' needs.
Audit logs designed for system access provide a precise capability for organizations to see who has accessed patient information. Due to the significant risk in computing environments by authorized and unauthorized users, the audit log is an important management tool to monitor, access retrospectively. In addition, the access and disclosure log becomes a powerful support document for disciplinary action. Audit logs are essential components to comprehensive security programs in health care.
Organizations are accountable for managing the disclosure of health information in a way that meets legal, regulatory, accreditation and licensing requirements and growing patient expectations for accountable privacy practices. Basic audit trail procedures should be applied, manually if necessary, in paper patient record systems to the extent feasible. Security in health information systems is an essential component to making progress in building and linking patient information. Successful implementation of large scale systems, the use of networks to transmit data, growing technical capability to address security issues and concerns about the confidentiality, and security provisions of patient information drive the focus on this topic. (See Guide E 1384.)
Consumer fears about confidentiality of health info...
SCOPE
1.1 This specification is for the development and implementation of security audit/disclosure logs for health information. It specifies how to design an access audit log to record all access to patient identifiable information maintained in computer systems and includes principles for developing policies, procedures, and functions of health information logs to document all disclosure of health information to external users for use in manual and computer systems. The process of information disclosure and auditing should conform, where relevant, with the Privacy Act of 1974 (1).
1.2 The first purpose of this specification is to define the nature, role, and function of system access audit logs and their use in health information systems as a technical and procedural tool to help provide security oversight. In concert with organizational confidentiality and security policies and procedures, permanent audit logs can clearly identify all system application users who access patient identifiabl...
General Information
Relations
Standards Content (Sample)
NOTICE: This standard has either been superseded and replaced by a new version or withdrawn.
Contact ASTM International (www.astm.org) for the latest information
Designation:E2147 −01(Reapproved 2009) An American National Standard
Standard Specification for
Audit and Disclosure Logs for Use in Health Information
Systems
This standard is issued under the fixed designation E2147; the number immediately following the designation indicates the year of
original adoption or, in the case of revision, the year of last revision. A number in parentheses indicates the year of last reapproval. A
superscript epsilon (´) indicates an editorial change since the last revision or reapproval.
1. Scope computer-based patient record coexist in parallel, security
oversight and access management should address both envi-
1.1 This specification is for the development and implemen-
ronments.
tation of security audit/disclosure logs for health information.
It specifies how to design an access audit log to record all
1.4 The second purpose of this specification is to identify
access to patient identifiable information maintained in com-
principles for establishing a permanent record of disclosure of
puter systems and includes principles for developing policies,
health information to external users and the data to be recorded
procedures, and functions of health information logs to docu-
in maintaining it. Security management of health information
ment all disclosure of health information to external users for
requires a comprehensive framework that incorporates man-
use in manual and computer systems. The process of informa-
dates and criteria for disclosing patient health information
tion disclosure and auditing should conform, where relevant,
found in federal and state laws, rules and regulations and
with the Privacy Act of 1974 (1).
ethical statements of professional conduct. Accountability for
such a framework should be established through a set of
1.2 The first purpose of this specification is to define the
standardprinciplesthatareapplicabletoallhealthcaresettings
nature, role, and function of system access audit logs and their
and health information systems.
use in health information systems as a technical and procedural
tool to help provide security oversight. In concert with orga-
1.5 Logs used to audit and oversee health information
nizational confidentiality and security policies and procedures,
access and disclosure are the responsibility of each health care
permanentauditlogscanclearlyidentifyallsystemapplication
organization, data intermediary, data warehouse, clinical data
users who access patient identifiable information, record the
repository, third party payer, agency, organization or corpora-
nature of the patient information accessed, and maintain a
tion that maintains or provides, or has access to individually-
permanent record of actions taken by the user. By providing a
identifiable data. Such logs are specified in and support policy
precise method for an organization to monitor and review who
on information access monitoring and are tied to disciplinary
hasaccessedpatientdata,auditlogshavethepotentialformore
sanctions that satisfy legal, regulatory, accreditation and insti-
effective security oversight than traditional paper record envi-
tutional mandates.
ronments. This specification will identify functionality needed
for audit log management, the data to be recorded, and the use
1.6 Organizations need to prescribe access requirements for
of audit logs as security and management tools by organiza-
aggregate data and to approve query tools that allow auditing
tional managers.
capability, or design data repositories that limit inclusion of
datathatprovidepotentialkeystoidentifiabledata.Inferencing
1.3 Intheabsenceofcomputerizedlogs,auditlogprinciples
patient identifiable data through analysis of aggregate data that
can be implemented manually in the paper patient record
contains limited identifying data elements such as birth date,
environment with respect to permanently monitoring paper
birth location, and family name, is possible using software that
patient record access. Where the paper patient record and the
matches data elements across data bases. This allows a
consistent approach to linking records into longitudinal cases
This specification is under the jurisdiction of ASTM Committee E31 on
for research purposes. Audit trails can be designed to work
Healthcare Informatics and is the direct responsibility of Subcommittee E31.25 on
with applications which use these techniques if the query
Healthcare Data Management, Security, Confidentiality, and Privacy.
Current edition approved Sept. 1, 2009. Published September 2009. Originally
functions are part of a defined retrieval application but often
approved in 2001. Last previous edition approved in 2001 as E2147 – 01. DOI:
standard query tools are not easily audited. This specification
10.1520/E2147-01R09.
applies to the disclosure or transfer of health information
The boldface numbers in parentheses refer to the list of references at the end of
this standard. (records) individually or in batches.
Copyright © ASTM International, 100 Barr Harbor Drive, PO Box C700, West Conshohocken, PA 19428-2959. United States
E2147−01 (2009)
1.7 This specification responds to the need for a standard 3.1.6 authorization, n—the mechanism for obtaining con-
addressing privacy and confidentiality as noted in Public Law sent for the use and disclosure of health information.
104–191 (2), or the Health Insurance Portability and Account- (CPRI, AHIMA)
ability Act of 1996 (3).
3.1.7 certificate, n—certificate means that a Certificate Au-
thority (CA) states a given correlation or given properties of
2. Referenced Documents
persons or IT-systems as true. If the certificate is used to
2.1 ASTM Standards:
confirm that a key belongs to its owner, it is called key
E1384 Practice for Content and Structure of the Electronic
certificate. If the certificate is used to confirm roles (qualifica-
Health Record (EHR)
tions), it is called authentication certificate.
E1633 SpecificationforCodedValuesUsedintheElectronic
3.1.8 confidential, n—status accorded to data or information
Health Record
indicating that it is sensitive for some reason, and therefore, it
E1762 Guide for Electronic Authentication of Health Care
needs to be protected against theft, disclosure, or improper use,
Information
and must be disseminated only to authorized individuals or
E1869 Guide for Confidentiality, Privacy, Access, and Data
organizations with an approved need to know. Private infor-
Security Principles for Health Information Including Elec-
mation, which is entrusted to another with the confidence that
tronic Health Records
unauthorized disclosure which would be prejudicial to the
E1902 Specification for Management of the Confidentiality
individual will not occur (6). (E1869; CPRI)
and Security of Dictation, Transcription, and Transcribed
Health Records (Withdrawn 2011)
3.1.9 database, n—a collection of data organized for rapid
E1986 Guide for Information Access Privileges to Health
search and retrieval. (Webster’s, 1993)
Information
3.1.10 database security, n—refers to the ability of the
2.2 Other Health Informatics Standards:
system to enforce security policy governing access, creation,
Health Level Seven (HL7) Version 2.2
modification, or destruction of information. Unauthorized cre-
ANSI ASC X12 Version 3, Release 3
ation of information is an important threat.
ISO/TEC 15408
3.1.11 disclosure, n—to access, release, transfer, or other-
3. Terminology
wise divulge health information to any internal or external user
or entity other than the individual who is the subject of such
3.1 Definitions:
information. (E1869)
3.1.1 access, n—the provision of an opportunity to ap-
proach, inspect, review, retrieve, store, communicate with, or 3.1.12 health information, n—any information, whether oral
make use of health information resources (for example, hard-
or recorded in any form or medium that is created or received
ware,software,systemsorstructure)orpatientidentifiabledata by a health care provider, a health plan, health, researcher,
and information, or both. (E1869)
public health authority, instructor, employer, school or univer-
sity, health information, service or other entity that creates,
3.1.2 audit log, n—a record of actions, for example, cre-
receives, obtains, maintains, uses or transmits health informa-
ation, queries, views, additions, deletions, and changes per-
tion; a health oversight agency, a health information service
formed on data.
organization; or, that relates to the past, present, or future
3.1.3 audit trail, n—a record of users that is documentary
physical or mental health or condition of an individual, the
evidence of monitoring each operation of individuals on health
provision of health care to an individual, or the past, present or
information. Audit trails may be comprehensive or specific to
future payments for the provision of health care to a protected
the individual and information (4). For example, an audit trail
individual; and, that identifies the individual with respect to
maybearecordofallactionstakenbyanyoneonaparticularly
whichthereisareasonablebasistobelievethattheinformation
sensitive file (5).
can be used to identify the individual (3).
3.1.4 authentication, n—the provision of assurance of the
3.1.13 information, n—data to which meaning is assigned,
claimed identity of an entity, receiver or object.
according to context and assumed conventions. (E1869)
(E1762, E1869, CPRI)
3.1.14 transaction log, n—a record of changes to data,
3.1.5 authorize, v—the granting to a user the right of access
especially to a data base, that can be used to reconstruct the
to specified data and information, a program, a terminal or a
data if there is a failure after the transaction occurs, in other
process. (E1869)
words, a means of ensuring data integrity and availability.
3.1.15 user, n—a person authorized to use the information
For referenced ASTM standards, visit the ASTM website, www.astm.org, or
contained in an information system as specified by their job
contact ASTM Customer Service at service@astm.org. For Annual Book of ASTM
Standards volume information, refer to the standard’s Document Summary page on
function. The patient may be designated an authorized user by
the ASTM website.
statute or institutional policy. A user also may refer to internal
The last approved version of this historical standard is referenced on
and external systems that draw data from an application.
www.astm.org.
Available from HL7, Mark McDougall, Executive Director, 900 Victors Way,
3.1.16 user identification (user ID), n—the combination
Suite 122, Ann Arbor, MI 48108.
name/number biometric assigned and maintained in security
Available from American National Standards Institute (ANSI), 25 W. 43rd St.,
4th Floor, New York, NY 10036, http://www.ansi.org. proceduresforidentifyingandtrackingindividualuseractivity.
E2147−01 (2009)
3.1.17 view—a designated configuration for data/ signoff, health record access to view, and receipt of patient
information extracted from information system(s) and pre- health record content from external provider/practitioner.
sented through a workstation.
5.1.1 Health record content (transformation/translation via
interfaces, interface engines, gateways between heterogeneous
4. Significance and Use
applications) should be maintained in the “before” and “after”
form. For example, laboratory reports/data translated from
4.1 Data that document health services in health care
laboratory forwarded to clinical repository storage.
organizations are business records and must be archived to a
secondary but retrievable medium. Audit logs should be
5.2 Other database tables are needed to link the items in 5.1
retained, at a minimum, according to the statute governing
and 5.1.1 to satisfy inquiries and to produce useful reports.
medical records in the geographic area.
Including unique user identification, for example, number, user
name, work location, and employee status (permanent, con-
4.2 The purpose of audit access and disclosure logs is to
tract,temporary)providesessentialuserinformation.Whilethe
document and maintain a permanent record of all authorized
audit log is a complete entity, data may be extracted from other
and unauthorized access to and disclosure of confidential
systems for use in the audit log application.
health care information in order that health care providers,
organizations, and patients and others can retrieve evidence of
5.3 The following functions should be performed when
that access to meet multiple needs. Examples are clinical,
auditing:
organizational, risk management, and patient rights’ needs.
5.3.1 Audits should identify and track individual users’
4.3 Audit logs designed for system access provide a precise
access, including authentication and signoff, to a specific
capability for organizations to see who has accessed patient
patient’s or provider’s data. This function should be done in
information. Due to the significant risk in computing environ-
realtimeandcapturedinauditlogs.Inthepaperpatientrecord,
ments by authorized and unauthorized users, the audit log is an
at a minimum, keep a permanent charge copy of all external
important management tool to monitor, access retrospectively.
releases.Forexample,anauditcanbeauthorizedbythepatient
In addition, the access and disclosure log becomes a powerful
or guardian, provided by law, or granted in an emergency. This
support document for disciplinary action. Audit logs are
may be a computer file.
essential components to comprehensive security programs in
5.3.2 Record or report type of access (authentication, si-
health care.
gnoff, queries, views, additions, deletions, changes). Complete
records of the type of access and all actions performed on the
4.4 Organizations are accountable for managing the disclo-
data should be maintained. All changes to an individual
sureofhealthinformationinawaythatmeetslegal,regulatory,
patient’s or provider’s computer based health information
accreditation and licensing requirements and growing patient
should be retrievable. Changes, additions, and deletions to a
expectationsforaccountableprivacypractices.Basicaudittrail
patient’shealthinformationshouldbereportedtotheguardian/
procedures should be applied, manually if necessary, in paper
custodian/steward of patient/health information/medical re-
patient record systems to the extent feasible. Security in health
information systems is an essential component to making cords.
progress in building and linking patient information. Success-
5.3.3 Record and maintain breach access flag. Flags should
ful implementation of large scale systems, the use of networks
notify a security administrator and the guardian/custodian/
to transmit data, growing technical capability to addre
...
Questions, Comments and Discussion
Ask us and Technical Secretary will try to provide an answer. You can facilitate discussion about the standard in here.