§164.312(a)(2)(ii): Establish (and implement as needed) procedures for obtaining necessary electronic protected health information during an emergency.
Audit Inquiry
Does the entity have polices and procedures in place to provide access to ePHI during an emergency?
Does the entity provide access to ePHI during an emergency?
Obtain and review procedures related to emergency access. Evaluate the content in relation to the specified criteria to determine if an emergency access procedure is in place for obtaining necessary ePHI during an emergency.
Elements to review may include but are not limited to:
• Procedures in place to provide necessary access to ePHI during an emergency
• How access to initiate emergency access to ePHI is limited to appropriate personnel
• How access to ePHI is normalized once an emergency situation has passed
• Workforce members roles and responsibilities in the emergency access procedures
Obtain and review documentation demonstrating a list of workforce members with authority to initiate the emergency access procedures. Evaluate and determine if list of workforce members correlates with workforce members listed in the emergency access procedures. Obtain and review documentation demonstrating technical systems limiting emergency access initiation. Evaluate and determine whether technical systems have the capability to limit emergency access initiation to authorized workforce members only.
Required/Addressable
Required