Re: [Hardhats-members] HIPAA Compliance

2006-04-04 Thread Kevin Toppenberg
First, give yourself the security key: DG SECURITY OFFICER Then, look in the DG SECURITY OFFICER MENU option. There are options there for managing this. I don't know how to set up the immediate notification. I think it happens through the mail system (which we don't use in our site). Select Se

Re: [Hardhats-members] HIPAA Compliance

2006-04-03 Thread Nancy Anthracite
I think his is the option. In the routine DGSEC1, it looks to me like it logs who views the record. I tried to sent the routine but it gets blocked as spam. Goes to show we need to teach those spam filters MUMPS. NUMBER: 576 NAME: DG SECURITY ENTER/EDIT MENU TEX

Re: [Hardhats-members] HIPAA Compliance

2006-04-03 Thread Greg Woodhouse
--- Mike Schrom <[EMAIL PROTECTED]> wrote: > Then what? Is there a log of access to that record? > Not being especially familiar with this portion of VistA, I can't give you a specific answer, but if an option is audited, then there is indeed a file containing a log of attempts to invoke that op

Re: [Hardhats-members] HIPAA Compliance

2006-04-03 Thread Nancy Anthracite
I believe a patient can be set as sensitive during registration as well. On Monday 03 April 2006 15:45, Kevin Toppenberg wrote: Setting a patient to sensitive is a standard menu option in the security menu tree. You enter the patient to be considered sensitive. Kevin On 4/3/06, Gregory Woodhou

Re: [Hardhats-members] HIPAA Compliance

2006-04-03 Thread Mike Schrom
Then what? Is there a log of access to that record? Kevin Toppenberg wrote: Setting a patient to sensitive is a standard menu option in the security menu tree. You enter the patient to be considered sensitive. Kevin On 4/3/06, Gregory Woodhouse <[EMAIL PROTECTED]> wrote: On Apr 3, 2006,

Re: [Hardhats-members] HIPAA Compliance

2006-04-03 Thread Kevin Toppenberg
Setting a patient to sensitive is a standard menu option in the security menu tree. You enter the patient to be considered sensitive. Kevin On 4/3/06, Gregory Woodhouse <[EMAIL PROTECTED]> wrote: > > > On Apr 3, 2006, at 6:55 AM, Gary Monger wrote: > > > This is a little out of my area, but pre

Re: [Hardhats-members] HIPAA Compliance

2006-04-03 Thread Gregory Woodhouse
On Apr 3, 2006, at 6:55 AM, Gary Monger wrote:This is a little out of my area, but pretty sure the “sensitive” patient record warning is part of the patient lookup routine.  Also the all the RPC calls are audited.  That makes sense. I've seen things like that done with identifiers, but Fileman does

RE: [Hardhats-members] HIPAA Compliance

2006-04-03 Thread Gary Monger
, 2006 3:59 PM To: hardhats-members@lists.sourceforge.net Subject: Re: [Hardhats-members] HIPAA Compliance     On Mar 31, 2006, at 11:25 AM, Mike Schrom wrote: In the VA hospital, some records opened in CPRS give us a warning about "Sensitive Patient Record" and the warning says

Re: [Hardhats-members] HIPAA Compliance

2006-03-31 Thread Gregory Woodhouse
On Mar 31, 2006, at 11:25 AM, Mike Schrom wrote:In the VA hospital, some records opened in CPRS give us a warning about "Sensitive Patient Record" and the warning says something about all access being monitored. I don't have any idea how it's implemented (or whether it's just a scare tactic!). I've

Re: [Hardhats-members] HIPAA Compliance

2006-03-31 Thread Mike Schrom
In the VA hospital, some records opened in CPRS give us a warning about "Sensitive Patient Record" and the warning says something about all access being monitored. I don't have any idea how it's implemented (or whether it's just a scare tactic!). I've never seen a warning in "blue screen" VistA

Re: [Hardhats-members] HIPAA Compliance

2006-03-31 Thread Gregory Woodhouse
On Mar 31, 2006, at 7:59 AM, Kevin Toppenberg wrote:So Auditing also tracks *viewing*?  I didn't know that. Kevin Incidentally, in my "dream" version of Fileman there would be no access to the underlying globals at all, so it wouldn't be possible to circumvent VistA security by going to the progra

Re: [Hardhats-members] HIPAA Compliance

2006-03-31 Thread Gregory Woodhouse
On Mar 31, 2006, at 7:59 AM, Kevin Toppenberg wrote:So Auditing also tracks *viewing*?  I didn't know that. Kevin Auditing tracks option use (that is, auditing of options), so if you use, say, Health Summary to view patient data, that could be audited (because it is an option). Gregory Woodhouse[E

Re: [Hardhats-members] HIPAA Compliance

2006-03-31 Thread Gregory Woodhouse
On Mar 31, 2006, at 9:16 AM, Marc Krawitz wrote: Greg - you mentioned that viewing patient data through the menu options can be audited. What about viewing through CPRS? In either case, how is this setup? Thanks, Marc I don't know CPRS well enough to say whether or not it has its own m

Re: [Hardhats-members] HIPAA Compliance

2006-03-31 Thread Marc Krawitz
Greg - you mentioned that viewing patient data through the menu options can be audited. What about viewing through CPRS? In either case, how is this setup? Thanks, Marc --- This SF.Net email is sponsored by xPML, a groundbreaking scripting l

Re: [Hardhats-members] HIPAA Compliance

2006-03-31 Thread Kevin Toppenberg
So Auditing also tracks *viewing*? I didn't know that. Kevin On 3/31/06, Gregory Woodhouse <[EMAIL PROTECTED]> wrote: > > > On Mar 31, 2006, at 7:42 AM, Kevin Toppenberg wrote: > > > Marc, > > > > > I have heard this asked before and the answer has been Yes. But I > > don't know that *viewing*

Re: [Hardhats-members] HIPAA Compliance

2006-03-31 Thread Gregory Woodhouse
On Mar 31, 2006, at 7:42 AM, Kevin Toppenberg wrote:Marc, I have heard this asked before and the answer has been Yes.  But I don't know that *viewing* of data can be tracked.  Is this truly a requirement of HIPAA EMR's?  And if so, I'd like others to show me how to do this. Kevin Certainly, optio

Re: [Hardhats-members] HIPAA Compliance

2006-03-31 Thread Kevin Toppenberg
Marc, I have heard this asked before and the answer has been Yes. But I don't know that *viewing* of data can be tracked. Is this truly a requirement of HIPAA EMR's? And if so, I'd like others to show me how to do this. Kevin On 3/31/06, Marc Krawitz <[EMAIL PROTECTED]> wrote: > This is prob