Access Controls The system providing access to PHI COUNTY discloses to 20 CONTRACTOR or CONTRACTOR creates, receives, maintains, or transmits on behalf of COUNTY 21 must use role based access controls for all user authentications, enforcing the principle of least privilege.
Audit Controls a. System Security Review. CONTRACTOR must ensure audit control mechanisms that record and examine system activity are in place. All systems processing and/or storing PHI COUNTY discloses to CONTRACTOR or CONTRACTOR creates, receives, maintains, or transmits on behalf of COUNTY must have at least an annual system risk assessment/security review which provides assurance that administrative, physical, and technical controls are functioning effectively and providing adequate levels of protection. Reviews should include vulnerability scanning tools.
Testing Procedures Testing will be conducted by an outside certified Agency in such a way to ensure maximum accuracy and reliability by using the techniques, chain of custody procedures, equipment and laboratory facilities which have been approved by the U.S. Department of Health and Human Services. All employees notified of a positive controlled substance or alcohol test result may request an independent test of their split sample at the employee’s expense. If the test result is negative the Employer will reimburse the employee for the cost of the split sample test.