Deb Martin asked:
"I have a customer that would like to query the experts to find out how
others are protecting PII, OUO, and other sensitive records (excluding
classified records) in electronic records systems. This is for a large
organization with several thousand staff that are creating electronic
records. For instance:
- How are permissions managed on who can add/modify/delete/view
sensitive records?
- How are permissions kept up-to-date?
- How are permission changes documented when employees terminate
or change organizations?
- How is permission managed for IT and RIM support employees that
may have a need to access the records area, e.g., to develop programs,
file plans, etc. but shouldn't generally have a need to see the data?"
Deb,
For access to sensitive records by organizational staff, permission should
be role-based (e.g., all HR coordinators should have access to personnel
files, all medical staff should have access to medical records, only
law-enforcement/Security staff should have access to arrest records), and
managed through the organizationıs Active Directory (all employees should
be in Active Directory, with organizational affiliations and job titles).
There should be organizational procedures in place for managing the
information in Active Directory, including the processes for keeping the
information current. This should include review/deactivation of access
rights when an employee departs or changes organizations, and periodic
revalidation of access rights for all employees with access to sensitive
information.
There should also be an organizational procedure for how
records/information for departing employee are handled (e.g., manager
reassigns to another employee).
IT employees who create/maintain databases and applications usually have
full access to any sensitive information contained within them because
itıs not possible for them to perform ongoing activities without such
access.
Classified records are usually maintained within security walls so that
only cleared personnel whether IT or departmental have access.
Organizational policies and procedures should also address how individuals
with a need-to-know can be granted specific access rights over and above
those assigned based on their roles.
Pilar C. McAdam, CRM, ERMm
[log in to unmask]
Los Angeles, CA
>
List archives at http://lists.ufl.edu/archives/recmgmt-l.html
Contact [log in to unmask] for assistance
To unsubscribe from this list, click the below link. If not already present, place UNSUBSCRIBE RECMGMT-L or UNSUB RECMGMT-L in the body of the message.
mailto:[log in to unmask]
|
