Audit Capabilities. Auditing and logging capabilities will permit HCA to identify, and possibly reverse, unauthorized or unintended changes to application. • Application must support the identification of the nature of each access and/or modification through the use of logging. • Application must employ audit capabilities to sufficiently track details that can establish accountability for each step or task taken in a clinical or operational process. • All audit logs must be protected from human alteration. • Access to logs must be limited to authorized users. • The application must employ basic query tools and reports to easily search logs. • OCHCA record retention policies must be followed. Currently OCHCA requires that this period be at least six years from the time the record was initiated. • Logging and auditing functionality must include the following: ♦ Record of who did what to which object, when and on which system. ♦ Successful/unsuccessful log-in and log-out of users. ♦ Add, modify and delete actions on data/files/objects. ♦ Read/view actions on data classified as restricted/confidential. ♦ Changes to user accounts or privileges (creation, modification, deletion). ♦ Switching to another users access or privileges after logging in (if applicable).
Audit Capabilities. Auditing and logging capabilities will permit HCA to identify, and possibly reverse, unauthorized or unintended changes to application. County of Orange Health Care Agency Page 41 MA-042-17011367 • Application must support the identification of the nature of each access and/or modification through the use of logging. • Application must employ audit capabilities to sufficiently track details that can establish accountability for each step or task taken in a clinical or operational process. • All audit logs must be protected from human alteration. • Access to logs must be limited to authorized users. • The application must employ basic query tools and reports to easily search logs. • OCHCA record retention policies must be followed. Currently OCHCA requires that this period be at least six years from the time the record was initiated. • Logging and auditing functionality must include the following: ♦ Record of who did what to which object, when and on which system. ♦ Successful/unsuccessful log-in and log-out of users. ♦ Add, modify and delete actions on data/files/objects. ♦ Read/view actions on data classified as restricted/confidential. ♦ Changes to user accounts or privileges (creation, modification, deletion). ♦ Switching to another users access or privileges after logging in (if applicable).
Audit Capabilities. 22 1. Auditing and logging capabilities will permit HCA to identify, and possibly reverse, 23 unauthorized or unintended changes to application.
24 2. Application must support the identification of the nature of each access and/or modification 25 through the use of logging.
26 3. Application must employ audit capabilities to sufficiently track details that can establish 27 accountability for each step or task taken in a clinical or operational process.
28 4. All audit logs must be protected from human alteration.
29 5. Access to logs must be limited to authorized users.
30 6. The application must employ basic query tools and reports to easily search logs.
31 7. OCHCA record retention policies must be followed. Currently OCHCA requires that this 32 period be at least six years from the time the record was initiated.
33 8. Logging and auditing functionality must include the following:
34 a. Record of who did what to which object, when and on which system.
35 b. Successful/unsuccessful log-in and log-out of users.
36 c. Add, modify and delete actions on data/files/objects.
37 d. Read/view actions on data classified as restricted/confidential.
1 e. Changes to user accounts or privileges (creation, modification, deletion).
2 f. Switching to another users access or privileges after logging in (if applicable).
Audit Capabilities. 5 a. Audit and logging capabilities will permit HCA to identify, and possibly reverse, 6 unauthorized or unintended changes to data resulting from error or misconduct.
7 b. Application will support the identification of the nature of each access and/or 8 modification through the use of logging.
9 c. Application will employ audit capabilities to sufficiently track details that can establish 10 accountability for each step or task taken in the clinical or operational processes.
11 d. All audit logs will be protected from alteration.
12 e. Audit/logging functionality will comply with NIST Special Publication 800-92, Guide 13 to Computer Security Log Management.
14 f. Access to logs must be limited to authorized users.
15 g. HCA requires that all transactions need to be available for reporting and auditing for a 16 least seven (7) years from the time the record was initiated.
17 h. Auditing functionality must include the following:
18 1) Record who did what to which object, when and on which system,
19 2) Successful/unsuccessful log-in and log-out of users,
20 3) Add, modify, print, and delete actions on data/files/objects,
21 4) Read/view actions on data classified as restricted/confidential,
22 5) Changes to user accounts or privileges (creation, modification, deletion),
23 6) Switching to another users access or privileges after logging in,
24 7) Any action to circumvent security controls,
25 8) Changes of time/date of the system clock,
26 9) Detection of hardware and software errors, and
27 10) Changes to log files.
Audit Capabilities. Auditing and logging capabilities will permit HCA to identify, and possibly reverse, unauthorized or unintended changes to application. Application must support the identification of the nature of each access and/or modification through the use of logging. Application must employ audit capabilities to sufficiently track details that can establish accountability for each step or task taken during operational process. All audit logs must be protected from human alteration. Access to logs must be limited to authorized users. The application must employ basic query tools and reports to easily search logs. Logging and auditing functionality must include the following: Record of who did what to which object, when and on which system. Successful/unsuccessful log-in and log-out of users. Changes to user accounts or privileges (creation, modification, deletion).
Audit Capabilities. 5 a. Audit and logging capabilities will permit HCA to identify, and possibly reverse, 6 unauthorized or unintended changes to data resulting from error or misconduct.
7 b. Application will support the identification of the nature of each access and/or 8 modification through the use of logging.
9 c. Application will employ audit capabilities to sufficiently track details that can establish 10 accountability for each step or task taken in the clinical or operational processes.
11 d. All audit logs will be protected from alteration.
Audit Capabilities. Auditing and logging capabilities will permit HCA to identify, and possibly reverse, unauthorized or unintended changes to application. • Application must support the identification of the nature of each access and/or modification through the use of logging. • Application must employ audit capabilities to sufficiently track details that can establish accountability for each step or task taken in a clinical or operational process. • All audit logs must be protected from human alteration. • Access to logs must be limited to authorized users. • The application must employ basic query tools and reports to easily search logs. DocuSign Envelope ID: 32AC7F38-40B4-4FD7-9103-57D01A9AA5C7 • OCHCA record retention policies must be followed. Currently OCHCA requires that this period be at least six years from the time the record was initiated. • Logging and auditing functionality must include the following: ♦ Record of who did what to which object, when and on which system. ♦ Successful/unsuccessful log-in and log-out of users. ♦ Add, modify and delete actions on data/files/objects. ♦ Read/view actions on data classified as restricted/confidential. ♦ Changes to user accounts or privileges (creation, modification, deletion). ♦ Switching to another users access or privileges after logging in (if applicable).
Audit Capabilities. Auditing and logging capabilities will permit HCA to identify, and possibly reverse, unauthorized or unintended changes to application. Application must support the identification of the nature of each access and/or modification through the use of logging. Application must employ audit capabilities to sufficiently track details that can establish accountability for each step or task taken in a clinical or operational process. All audit logs must be protected from human alteration. Access to logs must be limited to authorized users. The application must employ basic query tools and reports to easily search logs. OCHCA record retention policies must be followed. Currently OCHCA requires that this period be at least six years from the time the record was initiated. County of Orange, Health Care Agency Software Maint. & Data Hosting Services Page 41 of 50 Logging and auditing functionality must include the following: Record of who did what to which material object, when and on which system. Successful/unsuccessful log-in and log-out of users. Add, modify and delete actions on material data/files/objects. Read/view actions on data classified as restricted/confidential. Changes to user accounts or privileges (creation, modification, deletion). Switching to another users access or privileges after logging in (if applicable).
Audit Capabilities. Developer acknowledges that it is solely responsible for complying with audit requests, including with respect to logging, reporting of statistics, and third-party security assessments.
Audit Capabilities. 8 Protection from Malicious Code....................................................................................................................... 9 Remote Support Functionality .........................................................................................................................
