According to the ITlaw wiki:
An *immutable audit log* is a tamper-resistant
<http://itlaw.wikia.com/wiki/Tamper-resistant> recording
<http://itlaw.wikia.com/wiki/Recording> of how a system
<http://itlaw.wikia.com/wiki/System> has been used.
tamper-resistant is do-able
... but it also says:
A system with immutable audit capabilities would, for instance,
immediately and permanently record <http://itlaw.wikia.com/wiki/Record>
who authored <http://itlaw.wikia.com/wiki/Author>, changed, or accessed
<http://itlaw.wikia.com/wiki/Access> information
<http://itlaw.wikia.com/wiki/Information>; who posed queries
<http://itlaw.wikia.com/wiki/Queries> to the system
<http://itlaw.wikia.com/wiki/System>, what the queries
<http://itlaw.wikia.com/wiki/Queries> were, and what the responses were;
and who shared information
<http://itlaw.wikia.com/wiki/Information_sharing> with whom, and when.
This means no individual could inappropriately access
<http://itlaw.wikia.com/wiki/Access> information
<http://itlaw.wikia.com/wiki/Information> or query
<http://itlaw.wikia.com/wiki/Query> the system
<http://itlaw.wikia.com/wiki/System> and then hide the fact from an
after-the-fact audit <http://itlaw.wikia.com/wiki/Audit>. Inspection of
the audit logs <http://itlaw.wikia.com/wiki/Audit_log> can also be
controlled in a way that would require multiple parties to unlock the
logs <http://itlaw.wikia.com/wiki/Audit_log>, so as to make those logs
<http://itlaw.wikia.com/wiki/Audit_log> tamper resistant
<http://itlaw.wikia.com/wiki/Tamper_resistant> as well
and I'm not sure 'who shared information
<http://itlaw.wikia.com/wiki/Information_sharing> with whom, and when'
is do-able.
AndyD
On 11/01/2013 11:39, Dan Covill wrote:
On Thu, Jan 10, 2013 at 10:14 AM, Ken Dibble <[email protected]>
wrote:
> I'm researching health data security issues and came across a
requirement
> for "immutable" electronic audit trails.
Ken:
If you google "HIPAA immutable audit" you'll get plenty of info,
including a paper on exactly what the legal requirement is.
Dan
[excessive quoting removed by server]
_______________________________________________
Post Messages to: [email protected]
Subscription Maintenance: http://mail.leafe.com/mailman/listinfo/profox
OT-free version of this list: http://mail.leafe.com/mailman/listinfo/profoxtech
Searchable Archive: http://leafe.com/archives/search/profox
This message:
http://leafe.com/archives/byMID/profox/[email protected]
** All postings, unless explicitly stated otherwise, are the opinions of the
author, and do not constitute legal or medical advice. This statement is added
to the messages for those lawyers who are too stupid to see the obvious.
