Enterprise-Wide Policy and Procedure

The ZZZ Health care system recently adds quite a few new applications to the Electronic Health Record (EHR) system. The applications that we have been able to implement our Computer-Assisted Coding, where Natural Language Text Processing (NLP) will be used. The ZZZ hospital will also be using voice recognition along with some data capture applications, which will provide the capability of document imaging. An enterprise-wide policy is required to ensure that all employees consistently perform their duties, standard protocols and procedures help keep things going smoothly, and staff can know how to manage various job situations.

Title: Data Management (Data collection, storage and Maintenance)
Organization: ZZZ Hospital
Owner: Alpa Vashi Version# 1
Effective date: 3/29/21 Revise /Retired date:
Approver: Privacy & Security Officer Pages
Policy Statement:
The ZZZ Hospital implements appropriate physical, technical, administrative, and operational security controls to protect ZZZ Hospital information, computing system/device, medical devices, and electronic media from unauthorized access, theft, damage, or destruction. These security controls are implemented per applicable law, accreditation requirement, and business practice.
Purpose:
To describe the appropriate use of hospital Data, information, networks, medical and computing systems/devices, and electronic media necessary administrative, technical, an operational safeguard to protect the confidentiality, integrity and availability of ZZZ Hospital’s information that are created, stored, processed or transmitted by ZZZ hospital.
Scope/ Coverage:
This policy applies to all departments and staff from ZZZ Hospital, project contractors, and vendors.
Corrective / Disciplinary action:
Following the applicable policy of ZZZ Hospital, applies corrective/disciplinary action against individuals found, after an investigation by their respective employer or contracting party, to violate this data management (collection, use and maintenance) policy.
Procedure:
A. Data collection
a. Personal health data should be obtained only by fair and lawful means, and, if applicable, with the knowledge or consent of the pertinent individual
b. Data should be obtained only for specific, lawful purposes.
c. Data must be accurate and up to date and must be readily available.
d. Data capture, validation, and processing should be automated wherever possible.
B. Data storage
a. Data must protect by law, contractual agreement, or business stipulations.
b. All data must be restricted and only access to member based on requirement of their job function.
c. Data encryption mechanism to secure data must apply.
d. Data back must complete daily basis in midnight.
e. All staff to utilize their badge access while working in a physical building.
f. Need to secure all laptops and electronic devices with a strong password and assign tag number.
g. External detachable storage e.g., any USB attachable storage devices Encryption required.
C. Maintenance of health care data
a. Departments must take Inventory of data and action to prevent data loss.
b. Understand data sensitivity.
c. Follow record retention policies and procedure.
d. ZZZ Hospital implement reasonable measures to detect and prevent unauthorized changes to hardware and software.
e. Departments must take action to prevent data loss.
f. Updating and maintaining Confidential /restricted information data flow into and out of ZZZ hospital.
g. Establishing data protect practice like document shredding, secure lock.