Workforce Security II

The second Workforce Security task is to implement procedures to determine that the access to a workforce member to EPHI is appropriate. This task is addressable. In the previous task you had to create a procedure to authorize and/or supervise workforce members that work with EPHI. This task requires that you create a procedure that determines whether access to EPHI is appropriate for specific workforce members. For instance, an office administration type of employee may have no need to have access to EPHI while a nursing supervisor may need a broad range of access to EPHI while a specific nurse may only be authorized to access EPHI of only their patients. A list of employment positions and their need for access to EPHI would generally satisfy this task.

Remember that you must regularly review your policies and procedures to insure they continue to comply with the rule. As you add/change/remove positions they should be reviewed. Also, as employees change positions a process should be in place where by their access to EPHI is reviewed and adjusted accordingly.