General controls

• Record who did what to which object, when, and on which system.

• Record what events each system is capable of logging.

General events to capture

• Machine startup and shutdown; startup and shutdown of audit function.

• Successful/unsuccessful login and logout of users; denial of service events.

• Add, modify, and delete actions on all data/files/objects; plus read/view actions on data classified as restricted.

• Use of all privileged accounts and utilities.

• Changes to user accounts or privileges (creation, modification, deletion).

• Automatic logout of a user after exceeding a locally defined time of inactivity or excessive login attempts.

• Switching to another user's access or privileges after logging in.

• Software or hardware modification.

• All access to security files, attributes, or parameters; any action to circumvent security controls including access to anti-virus software.

Operation events to capture

• Login attempts with failed identification or authentication, also known as failed login attempts.

• Changes of the time or date of the system clock.

• Emergency mode operation.

• Detection of a virus.

• Detectable hardware and software errors; log failure and restart events.

• Changes to log files (creation, deletion, and configuration).

Communication events to capture

• Network link failures.

• Device connection failure due to device identification or authentication failure (also known as a failed connection attempt).

• Network and device connections dropped.

• Data integrity verification failure for information transmitted over a network.

• Message authentication failure for information transmitted over a network.

• Overrides of network abnormality alarms and alerts.

• IP addresses of successful and unsuccessful connections.

• Changes to network security configuration (e.g. firewalls).

Content of audit trails

• Date, time, type, and any applicable error condition of event.

• The ID of the user who caused the event.

• The application that created the audit event.

• The application(s) responsible for executing the event.

• The component or workstation that initiated the event, and where the event happened.

• Description of the event, which may include before and after images.

Monitoring

• Follow-up on suspicious events such as intrusion attempts, authorized accesses at unusual times, and unusual changes to infrastructure devices.

• Identify, investigate, report, and respond to inappropriate activity.

• Ensure that audit requirements and activities do not unduly disrupt critical business processes.

• Identify the individuals performing event analyses. Each shall be independent from those setting audit trail rules. Ensure they are available and that they record who, what, when, where, and why sensitive information is released. Rules-of-evidence integrity must be maintained.

• Document all event capturing and analysis procedures, requirements, and responsibilities, including when to involve inforensics specialists.

• Develop a process to ensure that users comply with access control procedures, including strong password creation and protections.

• Audit all user activity where risk levels warrant.

• Employ event analysis support tools and/or e-intelligent methods of correlating log data to detect suspicious activity and reduce volume.

Maintenance and storage of audit trails

• Audit trails must be managed only by authorized staff.

• Audit trail retention will vary depending upon legal requirements and business need. PHI and audit trails must be archived for six years. Other federal laws and regulations may stipulate other retention periods; always use the most stringent guideline when the data is covered by more than one policy, law, or regulation.

• Audit trail records management retention and disposal rules must be documented.

• President
• Provost
• Executive Vice President and Treasurer
• Chancellors
• Vice Presidents
• Deans
• Directors/Department Heads/Chairs

• Principal Investigators
• Faculty
• Business Office Staff
• Administrative and Professional Staff
• Clerical and Service Staff
• All Employees
• Undergraduate Students
• Graduate Students

Protected Healthcare Information

Health information in any form that can be connected to a patient. Health information includes the individual's past, present, or future physical or mental health or condition, the provision of health care to the individual, or the past, present, or future payment for the provision of health care to the individual.