When it comes to electronic security in your pharmacy, you can never be too careful.
The U.S. Department of Health and Human Services (HHS) requires health care organizations, including pharmacies, to comply with set technical safeguard standards. These technical safeguards include multiple guidelines, and in this first article of our series about security we’re focusing on audit controls.
Audit controls help you ensure that you’re staying compliant; they can prevent violations; and they can identify the error or perpetrator when a violation does occur.
HHS standards require that you have audit controls in place to monitor activity on your electronic systems that contain or use protected health information.
Most electronic systems contain some level of audit controls, and even audit reports. But does your computer system include everything necessary? Do you have policies and procedures in place to address the reports? Here are some ways to ensure that your audit controls are effective, efficient and HHS-approved.
Know what you need to record
First, keep records of electronic activity on your computer system.
Records help you ensure that all activity on your electronic system is appropriate. They can help with system troubleshooting, policy enforcement, compliance with the Security Rule, reducing risk of security incidents, monitoring employee activity and more.
To make sure you’re keeping correct records, first complete a risk analysis for your pharmacy. Then, you’ll be able to identify what you need to monitor to best protect your business.
Review regularly
Have a policy in place for reviewing your computer system audit trail. Make sure these reviews are frequent and comprehensive, as they can help you detect issues before they become problems.
If you have audit log, but fail to review it, this can be used to prove that you had the capability of knowing an incident was occurring, but failed to act.
Try to make your reviews as close to real time as possible, too. You don’t want to find something too late to correct the problem.
Know how you’ll review
You can choose to manually review your audit trail, or to use a third-party audit tool to detect anomalies. If the scope of your electronic system or your audit trail is extensive, an audit tool might be particularly useful in digging through the large amount of data.
Act on inconsistencies
If you spot something out of the ordinary in your records, such as an employee logged onto a workstation for days at a time, or unauthorized users attempting to access your system, it’s important to immediately investigate. Make sure employees are aware of consequences of abusing their access to any electronic health information, and that you follow through when you discover inappropriate behavior.
Document everything
The Health Insurance Portability and Accountability Act (HIPAA) requires that you maintain proof that you’ve been conducting audits for at least the past six years, so hold on to your policies, procedures and past audit reports to stay compliant and to protect your business.
Although there are no specific implementation requirements for audit controls from HHS, it’s up to you to determine what kinds of audit control mechanisms are best for your pharmacy. Take the time to ensure your audit logs are comprehensive, and are used to protect and improve your system.
Follow our series!
Stay up-to-date with our series on electronic security. Each installment discusses a different aspect of electronic security for pharmacies.
Pharmacy Electronic Security Part 1: Audit Controls
Pharmacy Electronic Security Part 2: Integrity
Pharmacy Electronic Security Part 3: Person Authentication
Pharmacy Electronic Security Part 4: Transmission Security
