Information Security Management
The Data Security Team manages 120,000 requests annually, ensuring robust user administration for 97 applications. Services include providing and revoking user access, creating and maintaining IDs for non-users, and managing physician master records in various systems. The team is responsible for HIPAA compliance, conducting audits, and troubleshooting registrations. Our security framework includes defining roles, managing identities, and overseeing detailed access methodologies. Comprehensive policies are in place for provisioning, de-provisioning, and securing sensitive data across institutional platforms.
Information Security Management
E N D
Presentation Transcript
Information SecurityManagement 2008 Programs
Data Security • The data security team processes 120,000 requests per year and is staffed with five FTE. • Each task could be anything from a simple question to an S/OLAR with access requests to 15 separate applications. • Provide some type of user administration for 97 applications • The following is a list of services • Provide users with access to systems • Remove users access to systems • Create, Maintain, Remove ID’s for non-users such as auto-logins (kiosks), vendors, etc. • Maintain physician master records in Cerner, SMS, and other downstream systems • Maintain BAA HIPAA contracts for vendors • IHIE & VPN download from pulse • Maintain applications and routing in SOLAR • Pulse registration troubleshooting while maintaining CDS • Assist in the investigation of HIPAA audits and incidents • Badges to South Campus and Data Centers • Set up framework for granting groups of users similar access (NT Groups) • Audit response and research
Research Access Methodology • Own the data and who has access to it • Design what tokens (transactions) get assigned to which roles • Define the roles and how they are allocated to individuals • Test, approve design, & approve access MGR Users Data Custodians IRB OLAR Ticket Cerner Application Security Data Security • Expert on Security Design and Development • Develop Profiles, Security Classes, Groups • Consult with others to design working security • Maintain updates from custodians • Manage User Identity’s & match to predefined access • Receive approved requests to create new users ID’s • Give access or remove access to/from users • Provisioning and De-provisioning
Research Access - OLAR • Where to get the OLAR • http://pulse.clarian.org/portal/intranet/home/content?url=/ClarianWebForms/IS/online_access_request_internal.doc • General instructions are on this site • What access do I ask for if I’m doing research? • Cerner for physician notes and drugs • Careweb has other medical record information • What do I do when the project ends or I’m not longer doing research? • Notify the IRB by completing an OLAR that says to remove your access
