Overview

Purpose

To create and conduct periodic reviews of audit trails of Information Systems activities.

Scope and Applicability

This policy applies to Information Systems containing or accessing ePHI or other Sensitive information.

Policy Statement

Reasonable and appropriate procedures shall be established and maintained to conduct periodic reviews of Information Systems activity.

Procedures

General

Procedures shall be implemented to regularly review records of information system activity, such as audit logs, access reports, and security incident tracking reports.

The type and frequency of auditing mechanisms to be implemented shall be based on the following factors:

Confidentiality of the information;
The importance of the Availability of the Information System;
Connectivity with other systems and the resulting degree of risk;
Findings from the audit process.

Proactive audits are to be performed periodically with the intent of sampling the data to identify possible inappropriate use or activity.

Incident based audits shall be performed when identified events trigger the need for an audit.

Auditable Events

Hardware, software, and/or procedural mechanisms should be implemented that record and examine activity in information systems that contain or use ePHI.

Audits should be established and conducted for system level events and for application level events. Procedures should be implemented for monitoring log-in attempts and reporting discrepancies.

As appropriate, auditable events should include:

Access or modification of ePHI and other Sensitive information; Successful and failed authentication attempts;
Use of audit software programs or utilities;
Information System start-up or shutdown;
Use of privileged accounts, such as system administrators;
Security incidents.

Content of Audit Records

When feasible, Information System activity auditing mechanisms should generate the following information:

Date and time of activity;
Description of attempted or completed activity;
Identification of user performing activity;
Origin of activity, such as IP address or workstation ID.

Audit logs should be configured to capture and retain sufficient history to meet regulatory requirements and security objectives.

Enforcement & Exception Handling

Failure to comply with this policy, associated procedures and guidelines may result in disciplinary actions up to and including termination of employment or termination of contracts. Legal actions also may be taken for violations of applicable regulations and laws.

Request for exceptions to this policy must be submitted in writing. Prior to official approval of any exception from the Director of Cybersecurity and Compliance, this policy must continue to be observed.

Definitions

ePHI – Protected Health Information that is stored in electronic format.

Information System – Means any combination of information technology and people’s activities that support operational, management and decision making processes. A system normally includes hardware, software, information, data, applications, communications, and people.

AI.io Incorporated Workforce Member – Means employees and other persons whose conduct, in the performance of their work, is under the direct control of the organization, whether or not they are paid by the organization. This includes full and part time employees, contractors, affiliates, associates, students, volunteers, and staff from third party entities who provide services.

Distribution

This policy should be distributed to applicable AI.io Incorporated Workforce Members. Recipients of this policy must acknowledge their receipt and understanding of this policy by referring any questions or problems with the policy within ten days of the issue date to the Director of Cybersecurity and Compliance. If no questions or problems are stated, it will be assumed that the policy has been read and understood.

Applicable Regulations