Scribd Logo
Upload

Welcome to Scribd!

  • 39 views

    Appendix 1 (For Clinical Departments) Information Security and Privacy Compliance Audit Requirements

    Uploaded by

    Hui Lok SZE
    This document contains the results of an information security and privacy compliance audit of the Ambulatory Medical Centre/Day Medical Centre department at Tuen Mun Hospital. It consists of 11 items that were assessed, including the proper handling of medical records, personal computers, printed materials, and disposal of confidential documents. All 11 items were found to comply with the requirements, with measures in place such as protected storage of records, password protection of computers, and secure disposal of sensitive materials. The audit was conducted by Wong Ngai Kit on January 5, 2023.

    Copyright:

    © All Rights Reserved
    Download as DOC, PDF, TXT or read online from Scribd

    Appendix 1 (For Clinical Departments) Information Security and Privacy Compliance Audit Requirements

    Uploaded by

    Hui Lok SZE
    39 views4 pages
    This document contains the results of an information security and privacy compliance audit of the Ambulatory Medical Centre/Day Medical Centre department at Tuen Mun Hospital. It consists of 11 items that were assessed, including the proper handling of medical records, personal computers, printed materials, and disposal of confidential documents. All 11 items were found to comply with the requirements, with measures in place such as protected storage of records, password protection of computers, and secure disposal of sensitive materials. The audit was conducted by Wong Ngai Kit on January 5, 2023.

    Original Title

    Untitled

    Copyright

    © © All Rights Reserved

    Available Formats

    DOC, PDF, TXT or read online from Scribd

    Did you find this document useful?

    Is this content inappropriate?

    This document contains the results of an information security and privacy compliance audit of the Ambulatory Medical Centre/Day Medical Centre department at Tuen Mun Hospital. It consists of 11 items that were assessed, including the proper handling of medical records, personal computers, printed materials, and disposal of confidential documents. All 11 items were found to comply with the requirements, with measures in place such as protected storage of records, password protection of computers, and secure disposal of sensitive materials. The audit was conducted by Wong Ngai Kit on January 5, 2023.

    Copyright:

    © All Rights Reserved
    Download as DOC, PDF, TXT or read online from Scribd
    Download as doc, pdf, or txt
    39 views4 pages

    Appendix 1 (For Clinical Departments) Information Security and Privacy Compliance Audit Requirements

    Uploaded by

    Hui Lok SZE
    This document contains the results of an information security and privacy compliance audit of the Ambulatory Medical Centre/Day Medical Centre department at Tuen Mun Hospital. It consists of 11 items that were assessed, including the proper handling of medical records, personal computers, printed materials, and disposal of confidential documents. All 11 items were found to comply with the requirements, with measures in place such as protected storage of records, password protection of computers, and secure disposal of sensitive materials. The audit was conducted by Wong Ngai Kit on January 5, 2023.

    Copyright:

    © All Rights Reserved
    Download as DOC, PDF, TXT or read online from Scribd
    Download as doc, pdf, or txt
    You are on page 1of 4

    Appendix 1 (For Clinical Departments)

    Information Security and Privacy Compliance Audit Requirements

    Cluster: KEC Attn: Mr. Wilkin NG, EAII (MRD)


    Hospital: TKOH Email: wilkin.ng@ha.org.hk
    Dept/Ward: AMB/DMC

    Compliance Audit Undertaken By:

    Name/Rank: Wong Ngai Kit/ WM Signature:

    Contact No.: 22081765 Date: 5/1/2023

    Note: Confidential / Sensitive Personal Data:


    a) ID number + personal data / contact or clinical data or photo
    b) Name + personal data / contact or clinical data or photo
    c) Photo + personal data / contact or clinical data

    Wards/ Departments

    # Assessment Item Details Yes/No/ Remarks


    N/A
    1. Notice of patients a) “Notice to Patients” is posted on the Y
    relevant notice boards to inform
    patients on the collection / use of
    personal data, and their rights of
    accessing / correcting the personal
    data.

    2. Public display a) Observe all public means (e.g. notice Y


    boards, posters) to ensure that it does
    not contain unnecessary confidential
    patient / staff personal data.
    b) All appreciation cards and letters which Y
    have personal identifiable information
    (PII) should have the PII covered while
    displaying in public areas. The original
    purpose of the cards is considered

    Rev 4.0 18 Jun 2015 1


    # Assessment Item Details Yes/No/ Remarks
    N/A
    normally for viewing by staff, not for
    general public.

    3. Placement of a) Medical records are kept at designated Y


    medical records or secured places, and are protected
    from unauthorized access.
    b) No medical records are left on counter Y
    tops, tables or bed side unattended or
    without cover.
    c) Medical record forms which are placed Y
    at the bed end are properly covered.
    d) There is a mechanism for safe keeping Y
    of medical records.

    4. Transportation of a) The medical records and personal Y


    medical records records transported within and outside
    the institutions are covered.

    5. Personal a) No patient personal data is displayed on Y


    Computers computer screen unattended or being
    viewed by unauthorized persons (shall
    be safeguarded by screen saver or user-
    logout).
    b) PCs are not attached with any Y
    removable devices (shall only allow
    HA or Cluster IT endorsed secure
    devices such as secure USBs).

    c) Files inside PCs such as the PC desktop Y


    shall be protected by encryption or
    password protection for confidential
    patient data / staff information.

    6. Disposal of a) Confidential documents are disposed Y


    confidential in a secure manner such as using
    documents confidential waste paper/ document

    Rev 4.0 18 Jun 2015 2


    # Assessment Item Details Yes/No/ Remarks
    N/A
    collection bags separated from office
    paper waste.
    7. Printing and use of a) The printing of gum labels are confined
    gum labels to a few workstations which have the
    actual need.
    b) Gum label with HKID and name Y
    should not be used for just identifying
    personal belongings in order to avoid
    unnecessary exposure. (e.g. gum labels
    with HKID should not be put on to the
    personal belongings such as cups /
    flasks).

    8. Recycled papers a) Paper used in printers or fax machines Y


    in wards or common area do not
    contain confidential patient / staff
    personal data.

    9. Disposal of Printer a) The printer cartridges retained PII used Y


    Cartridge (thermal for Clinical Data printing (e.g. GCR,
    ribbon) endoscopy printer) should be disposed
    in confidential collection bags
    separated from paper or other wastes.

    10. Disposal of VCD, a) Optical Discs and hard disks shall not Y
    CD & Medical be disposed as ordinary communal
    Hard Disk waste and must be properly disposed
    by shredding and degaussing.
    11. Handling of a) Designated devices were used for Y
    clinical photos and capturing photos/image recording in
    image recordings the department.
    b) The designated devices are kept at Y
    secured places and are protected from
    unauthorized, accidental access and
    inappropriate use.

    Rev 4.0 18 Jun 2015 3


    # Assessment Item Details Yes/No/ Remarks
    N/A
    c) A master logbook is kept to track the Y
    recording, duplicating, borrowing,
    returning and final disposal of all the
    data.

    Rev 4.0 18 Jun 2015 4

    You might also like