Common use of Audit Capabilities Clause in Contracts

Audit Capabilities. 22 1. Auditing and logging capabilities will permit HCA to identify, and possibly reverse, 23 unauthorized or unintended changes to application. 24 2. Application must support the identification of the nature of each access and/or modification 25 through the use of logging. 26 3. Application must employ audit capabilities to sufficiently track details that can establish 27 accountability for each step or task taken in a clinical or operational process. 28 4. All audit logs must be protected from human alteration. 29 5. Access to logs must be limited to authorized users. 30 6. The application must employ basic query tools and reports to easily search logs. 31 7. OCHCA record retention policies must be followed. Currently OCHCA requires that this 32 period be at least six years from the time the record was initiated. 33 8. Logging and auditing functionality must include the following: 34 a. Record of who did what to which object, when and on which system. 35 b. Successful/unsuccessful log-in and log-out of users. 36 c. Add, modify and delete actions on data/files/objects. 37 d. Read/view actions on data classified as restricted/confidential. 1 e. Changes to user accounts or privileges (creation, modification, deletion). 2 f. Switching to another users access or privileges after logging in (if applicable).

Audit Capabilities. 22 1. Auditing and logging capabilities will permit HCA to identify, and possibly reverse, 23 unauthorized or unintended changes to application. 24 2. Application must support the identification of the nature of each access and/or modification 25 through the use of logging. 26 3. Application must employ audit capabilities to sufficiently track details that can establish 27 accountability for each step or task taken in a clinical or operational process. 28 4. All audit logs must be protected from human alteration. 29 5. Access to logs must be limited to authorized users. 30 6. The application must employ basic query tools and reports to easily search logs. 31 7. OCHCA record retention policies must be followed. Currently OCHCA requires that this 32 period be at least six years from the time the record was initiated. 33 8. Logging and auditing functionality must include the following: 34 a. Record of who did what to which object, when and on which system. 35 b. Successful/unsuccessful log-in and log-out of users. 36 c. Add, modify and delete actions on data/files/objects. 37 d. Read/view actions on data classified as restricted/confidential.. Page 3 of 10 EXHIBIT B X:\CONTRACTS - 2018 -\2018-2020\CH\SDX01 DIRECT DIGITAL RADIOLOGY SVCS FY 18-20 TB.DOC SDX01CHKK20 1 e. Changes to user accounts or privileges (creation, modification, deletion). 2 f. Switching to another users access or privileges after logging in (if applicable).