The Definitive Guide to Complying with the HIPAA/HITECH Privacy and Security Rules

Chapter 21

Checklists

In this chapter, a list of policies and procedures is provided that a covered entity and a business associate should have implemented within their organizations. Along with the policies and procedures, most assessors or auditors will want to take a look at the documents included in the document request list provided.

21.1  Policies and Procedures

Covered entities and business associates should have policies and procedures that address the following:

1. Establishing and terminating users’ access to systems housing electronic protected health information (EPHI).
2. Emergency access to electronic information systems.
3. Inactive computer sessions (periods of inactivity).
4. Recording and examining activity in information systems that ...