Page History

...

NCSA will track approvals and changes made to the applicable environment, keeping records for 6 years or from the inception of the program. Each step of the following workflows is approved by a member of the NCSA Health Care Component while logged in with their personal credentials, and each approval send sends emails to the approver and other relevant parties.

...

The building manager has the only physical key and can use it to allow access for emergency personnel or if the electronic access control mechanism is broken. In these cases, they log access after wards afterwards with a ticket assigned to the HIPAA liaison subject "Emergency Access for HIPAA Enclave". This tells who was let in, when, and why. No one is left unescorted if they are not part of the covered entity.

...

1. Request is submitted by the building manager on behalf of a staff member with the reason for the request.
2. The HIPAA liaison checks that they are in the covered entity and approves or rejects the request.
3. The building manager adds the person to the access control list.
4. The workflow is closed by the building manager. This sends an email to the building manager, HIPAA Liaison, the new staff member with access, and their manager.

The process for removing access can be triggered either via a role change from staff to non-staff (e.g., during the employee exit process), or at the request of the HIPAA liaison.

1. Request is submitted and goes to the HIPAA liaison for approval.
2. Building manager receives approved request and removes access.
3. Building manager closes the ticket. (If not closed within 24 hours or creation, Security Office is alerted). An email is sent to the person who lost access, their manager, the building manager, and the HIPAA liaison.

Providing Access for non-Emergency Maintenance

...

1. The building manager submits a request with a description of the maintenance request.
2. The HIPAA liaison approves or rejects the request.
3. If approved, the building manager submits a work order to F&S.
4. The building manager provides an escort(s) who is a part of the covered entity and who stays with the maintenance person while in the secured area.
5. After the work is completed, the building manager records when it was completed and by whom.
6. The workflow is closed by the building manager.

...