Albato

Least Privilege Access (7.1.2)

Limiting Access to Cardholder Data (7.1)

Access Control System Restrictions (7.2)

Defining Access Needs (7.1.1)

Change management policies are established that include procedures for tracking, testing, approving, and communicating changes. Policies are reviewed annually.

All system change requests are formally documented, including a description of the change, justification, and affected systems or components.

Separate application environments are maintained and utilized when making changes to the platform, and changes are made to development and test environments prior to being promoted to production.

System change requests are reviewed and approved by management to ensure alignment with business objectives and security requirements.

All system changes, including their review, approval, and evidence of adherence to the Change Management Policy, are documented in Jira to maintain a centralized and auditable record.

ePHI Protection 9 - Are there mechanisms in place to protect ePHI from unauthorized modification or deletion?

ePHI Access 2 - Does each user with access to ePHI and systems with ePHI access have a unique set of credentials for login?

ePHI Protection 1 - Is encryption enabled for confidential, private, and ePHI data as it is accessed within an EHR (in transit)?

Explains proportional application of DORA based on entity type.