• There are no items in your cart
We noticed you’re not on the correct regional site. Switch to our AMERICAS site for the best experience.
Dismiss alert

ASTM E 2147 : 2001 : R2013

Superseded
Superseded

A superseded Standard is one, which is fully replaced by another Standard, which is a new edition of the same Standard.

View Superseded by
superseded

A superseded Standard is one, which is fully replaced by another Standard, which is a new edition of the same Standard.

Standard Specification for Audit and Disclosure Logs for Use in Health Information Systems (Withdrawn 2017)
Available format(s)

Hardcopy , PDF

Superseded date

12-09-2020

Language(s)

English

Published date

01-03-2013

CONTAINED IN VOL. 14.01, 2018 Defines the security requirements involved in the development and implementation of audit and disclosure logs used in health information systems.

1.1This specification is for the development and implementation of security audit/disclosure logs for health information. It specifies how to design an access audit log to record all access to patient identifiable information maintained in computer systems and includes principles for developing policies, procedures, and functions of health information logs to document all disclosure of health information to external users for use in manual and computer systems. The process of information disclosure and auditing should conform, where relevant, with the Privacy Act of 1974 (1).2

1.2The first purpose of this specification is to define the nature, role, and function of system access audit logs and their use in health information systems as a technical and procedural tool to help provide security oversight. In concert with organizational confidentiality and security policies and procedures, permanent audit logs can clearly identify all system application users who access patient identifiable information, record the nature of the patient information accessed, and maintain a permanent record of actions taken by the user. By providing a precise method for an organization to monitor and review who has accessed patient data, audit logs have the potential for more effective security oversight than traditional paper record environments. This specification will identify functionality needed for audit log management, the data to be recorded, and the use of audit logs as security and management tools by organizational managers.

1.3In the absence of computerized logs, audit log principles can be implemented manually in the paper patient record environment with respect to permanently monitoring paper patient record access. Where the paper patient record and the computer-based patient record coexist in parallel, security oversight and access management should address both environments.

1.4The second purpose of this specification is to identify principles for establishing a permanent record of disclosure of health information to external users and the data to be recorded in maintaining it. Security management of health information requires a comprehensive framework that incorporates mandates and criteria for disclosing patient health information found in federal and state laws, rules and regulations and ethical statements of professional conduct. Accountability for such a framework should be established through a set of standard principles that are applicable to all health care settings and health information systems.

1.5Logs used to audit and oversee health information access and disclosure are the responsibility of each health care organization, data intermediary, data warehouse, clinical data repository, third party payer, agency, organization or corporation that maintains or provides, or has access to individually-identifiable data. Such logs are specified in and support policy on information access monitoring and are tied to disciplinary sanctions that satisfy legal, regulatory, accreditation and institutional mandates.

1.6Organizations need to prescribe access requirements for aggregate data and to approve query tools that allow auditing capability, or design data repositories that limit inclusion of data that provide potential keys to identifiable data. Inferencing patient identifiable data through analysis of aggregate data that contains limited identifying data elements such as birth date, birth location, and family name, is possible using software that matches data elements across data bases. This allows a consistent approach to linking records into longitudinal cases for research purposes. Audit trails can be designed to work with applications which use these techniques if the query functions are part of a defined retrieval application but often standard query tools are not easily audited. This specification applies to the disclosure or transfer of health information (records) individually or in batches.

1.7This specification responds to the need for a standard addressing privacy and confidentiality as noted in Public Law 104–191 (2), or the Health Insurance Portability and Accountability Act of 1996 (3).

Committee
E 31
DevelopmentNote
Supersedes ASTM PS 115 (01/2003)
DocumentType
Standard
Pages
6
ProductNote
Reconfirmed 2013
PublisherName
American Society for Testing and Materials
Status
Superseded
SupersededBy
Supersedes

ASTM E 2369 : 2012 Standard Specification for Continuity of Care Record (CCR) (Withdrawn 2021)
ASTM E 2473 : 2005 : R2011 Standard Practice for the Occupational/Environmental Health View of the Electronic Health Record (Withdrawn 2020)
ASTM E 2538 : 2006 : R2011 Standard Practice for Defining and Implementing Pharmacotherapy Information Services within the Electronic Health Record (EHR) Environment and Networked Architectures (Withdrawn 2020)
ASTM E 2457 : 2007 : R2013 Standard Terminology for Healthcare Informatics (Withdrawn 2022)

CFR 42(PTS1-399) : OCT 2017 PUBLIC HEALTH - PUBLIC HEALTH SERVICE, DEPARTMENT OF HEALTH AND HUMAN SERVICES
CFR 21(PTS1-99) : 0 FOOD AND DRUGS - FOOD AND DRUG ADMINISTRATION, CHAPTER 1 DEPARTMENT OF HEALTH AND HUMAN SERVICES - PARTS 1-99

View more information
£62.61
Excluding VAT

Access your standards online with a subscription

Features

  • Simple online access to standards, technical information and regulations.

  • Critical updates of standards and customisable alerts and notifications.

  • Multi-user online standards collection: secure, flexible and cost effective.