HIPAA | Security Policies & Procedures

Oklahoma State University
Center for Health Sciences

Security Policies & Proceduress

Title: Access Establishment and Modification	Policy: SEC 04.03
Category: HIPAA Compliance	Authority: 45 CFR § HIPAA Section: 164.308 (a) (4) (ii) (C)
Standard: Information Access Management	Responsibility: Health Care Components
Effective Date: 04/20/2005	Page 1 of 1
Approved by: OSU Legal Counsel	Revised:

Purpose	Access Establishment and Modification
Policy	Access to protected health information is granted based on documented methods of job related needs. Reference Access Authorization OSU Confidentiality Agreement
CHS Procedure	Practice Management and Electronic Medical Records Notification to provide access occurs as stated in the Access Authorization Policy. Job function determines group. Practice Management groups are selected and assigned by the Compliance Office or designated area of responsibility. If anyone needs permissions outside of their group, it must be justified and approved by the Compliance Office. These extra permissions are then documented. Changes to group access levels or creation of new groups requires approval by the Compliance Office.
SWC and UHS Procedure	Refer to SEC 04.02 Procedures