Difference between revisions of "Template:LIMSpec/Information privacy"

Revision as of 21:47, 15 November 2019


Regulation, Specification, or Guidance	Requirement
45 CFR Part 164 Subpart E ASTM E1578-18 S-5-1	36.1 The system shall comply with privacy protection compliance like that found in HIPAA provisions.
45 CFR Part 164.105 45 CFR Part 164 Subpart C 45 CFR Part 170.315 (d) ASTM E1578-18 S-5-2	36.2 The system should be provisioned with enough security to prevent personally identifiable information in the system from being compromised.
45 CFR Part 164.514	36.3 The system shall allow authorized individuals to de-identify select data in the system, including but not limited to names, geographic locations, dates, government-issued identification numbers, telephone numbers, email addresses, full-face photos, and other personal identifiers.
45 CFR Part 164 Subpart E NIST 800-53, Rev. 4, AC-6	36.4 The system shall be able to verify and ensure that users authorized to view de-identified data are also not a member of a role that permits access to information that re-identifies the data, i.e., segregate duties.

@@ Line 21: / Line 21: @@
    | style="background-color:white;" |'''36.3''' The system shall allow authorized individuals to de-identify select data in the system, including but not limited to names, geographic locations, dates, government-issued identification numbers, telephone numbers, email addresses, full-face photos, and other personal identifiers.
   |-
-   | style="padding:5px; width:500px;" |[https://www.law.cornell.edu/cfr/text/45/part-164/subpart-E 45 CFR Part 164 Subpart E]
+   | style="padding:5px; width:500px;" |[https://www.law.cornell.edu/cfr/text/45/part-164/subpart-E 45 CFR Part 164 Subpart E]<br />
+[https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf NIST 800-53, Rev. 4, AC-6]
    | style="background-color:white;" |'''36.4''' The system shall be able to verify and ensure that users authorized to view de-identified data are also not a member of a role that permits access to information that re-identifies the data, i.e., segregate duties.
   |-
 |}
 |}