Template:LIMSpec/Information privacy - Revision history

Shawndouglas: NIST tweaks

2023-03-14T22:37:08Z

NIST tweaks

← Older revision		Revision as of 22:37, 14 March 2023
Line 24:		Line 24:
	\| style="background-color:white;" \|'''36.2''' The system should be provisioned with enough security to automatically enforce verification mechanisms that prevent personally identifiable information in the system from being compromised.		\| style="background-color:white;" \|'''36.2''' The system should be provisioned with enough security to automatically enforce verification mechanisms that prevent personally identifiable information in the system from being compromised.
	\|-		\|-
	\| style="padding:5px; width:500px;" \|[https://www.law.cornell.edu/cfr/text/45/164.514 45 CFR Part 164.514]<br />[https://www.acmg.net/ACMG/Medical-Genetics-Practice-Resources/Genetics_Lab_Standards/ACMG/Medical-Genetics-Practice-Resources/Genetics_Lab_Standards.aspx ACMG Technical Standards for Clinical Genetics Laboratories C5.5]<br />[https://elss.cap.org/elss/ShowProperty?nodePath=/UCMCON/Contribution%20Folders/DctmContent/education/OnlineCourseContent/2017/LAP-TLTM/misc/lam.pdf CAP Laboratory Accreditation Manual]<br />[https://www.wada-ama.org/en/resources/world-anti-doping-program/international-standard-protection-privacy-and-personal WADA International Standard for the Protection of Privacy and Personal Information (ISPPPI) 10.3]		\| style="padding:5px; width:500px;" \|[https://www.law.cornell.edu/cfr/text/45/164.514 45 CFR Part 164.514]<br />[https://www.acmg.net/ACMG/Medical-Genetics-Practice-Resources/Genetics_Lab_Standards/ACMG/Medical-Genetics-Practice-Resources/Genetics_Lab_Standards.aspx ACMG Technical Standards for Clinical Genetics Laboratories C5.5]<br />[https://elss.cap.org/elss/ShowProperty?nodePath=/UCMCON/Contribution%20Folders/DctmContent/education/OnlineCourseContent/2017/LAP-TLTM/misc/lam.pdf CAP Laboratory Accreditation Manual]<br />[https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/final NIST 800-53, Rev. 5, SI-19]<br />[https://www.wada-ama.org/en/resources/world-anti-doping-program/international-standard-protection-privacy-and-personal WADA International Standard for the Protection of Privacy and Personal Information (ISPPPI) 10.3]
	\| style="background-color:white;" \|'''36.3''' The system shall allow authorized individuals to de-identify select data in the system, including but not limited to names, geographic locations, dates, government-issued identification numbers, telephone numbers, email addresses, full-face photos, and other personal identifiers.		\| style="background-color:white;" \|'''36.3''' The system shall allow authorized individuals to de-identify select data in the system, including but not limited to names, geographic locations, dates, government-issued identification numbers, telephone numbers, email addresses, full-face photos, and other personal identifiers.
	\|-		\|-
	\| style="padding:5px; width:500px;" \|[https://www.law.cornell.edu/cfr/text/45/part-164/subpart-E 45 CFR Part 164 Subpart E]<br />[https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/final NIST 800-53, Rev. 5, AC-6]		\| style="padding:5px; width:500px;" \|[https://www.law.cornell.edu/cfr/text/45/part-164/subpart-E 45 CFR Part 164 Subpart E]<br />[https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/final NIST 800-53, Rev. 5, AC-6]<br />[https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/final NIST 800-53, Rev. 5, SI-19]
	\| style="background-color:white;" \|'''36.4''' The system shall be able to verify and ensure that users authorized to view de-identified data are also not a member of a role that permits access to information that re-identifies the data, i.e., segregate duties.		\| style="background-color:white;" \|'''36.4''' The system shall be able to verify and ensure that users authorized to view de-identified data are also not a member of a role that permits access to information that re-identifies the data, i.e., segregate duties.
	\|-		\|-

Shawndouglas: Added new item

2023-03-14T21:05:00Z

Added new item

← Older revision		Revision as of 21:05, 14 March 2023
Line 32:		Line 32:
	\| style="padding:5px; width:500px;" \|[https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/final NIST 800-53, Rev. 5, SI-19(7)]		\| style="padding:5px; width:500px;" \|[https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/final NIST 800-53, Rev. 5, SI-19(7)]
	\| style="background-color:white;" \|'''36.5''' The system should use validated algorithms to de-identify data in the system and be validated to use those algorithms.		\| style="background-color:white;" \|'''36.5''' The system should use validated algorithms to de-identify data in the system and be validated to use those algorithms.
			\|-
			\| style="padding:5px; width:500px;" \|[https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/final NIST 800-53, Rev. 5, PT-4 and PT-4(3)]
			\| style="background-color:white;" \|'''36.6''' The system should provide tools or mechanisms for recording the consent—and revocation of consent—of individuals who wish to allow—or disallow—their personally identifiable information to be processed, stored, and otherwise managed.
	\|-		\|-
	\|}		\|}
	\|}		\|}

Shawndouglas: NIST tweak

2023-03-14T20:57:57Z

NIST tweak

← Older revision		Revision as of 20:57, 14 March 2023
Line 8:		Line 8:
	! style="color:brown; background-color:#ffffee; width:700px;"\| Requirement		! style="color:brown; background-color:#ffffee; width:700px;"\| Requirement
	\|-		\|-
	\| style="padding:5px; width:500px;" \|[https://www.law.cornell.edu/cfr/text/45/part-164/subpart-E 45 CFR Part 164 Subpart E]<br />[https://www.acmg.net/ACMG/Medical-Genetics-Practice-Resources/Genetics_Lab_Standards/ACMG/Medical-Genetics-Practice-Resources/Genetics_Lab_Standards.aspx ACMG Technical Standards for Clinical Genetics Laboratories G17.2]<br />[https://www.astm.org/e1578-18.html ASTM E1578-18 S-5-1]<br />[https://elss.cap.org/elss/ShowProperty?nodePath=/UCMCON/Contribution%20Folders/DctmContent/education/OnlineCourseContent/2017/LAP-TLTM/misc/lam.pdf CAP Laboratory Accreditation Manual]		\| style="padding:5px; width:500px;" \|[https://www.law.cornell.edu/cfr/text/45/part-164/subpart-E 45 CFR Part 164 Subpart E]<br />[https://www.acmg.net/ACMG/Medical-Genetics-Practice-Resources/Genetics_Lab_Standards/ACMG/Medical-Genetics-Practice-Resources/Genetics_Lab_Standards.aspx ACMG Technical Standards for Clinical Genetics Laboratories G17.2]<br />[https://www.astm.org/e1578-18.html ASTM E1578-18 S-5-1]<br />[https://elss.cap.org/elss/ShowProperty?nodePath=/UCMCON/Contribution%20Folders/DctmContent/education/OnlineCourseContent/2017/LAP-TLTM/misc/lam.pdf CAP Laboratory Accreditation Manual]<br />[https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/final NIST 800-53, Rev. 5, PT-2 and PT-2(2)]
	\| style="background-color:white;" \|'''36.1''' The system shall comply with privacy protection compliance like that found in HIPAA provisions.		\| style="background-color:white;" \|'''36.1''' The system shall comply with privacy protection compliance like that found in HIPAA provisions.
	\|-		\|-
Line 18:		Line 18:
	[https://www.astm.org/e1578-18.html ASTM E1578-18 S-5-2]<br />		[https://www.astm.org/e1578-18.html ASTM E1578-18 S-5-2]<br />
	[https://ichgcp.net/ ICH GCP 2.11]<br />		[https://ichgcp.net/ ICH GCP 2.11]<br />
			[https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/final NIST 800-53, Rev. 5, PT-2 and PT-2(2)]<br />
	[https://www.wadsworth.org/regulatory/clep/clinical-labs/laboratory-standards NYSDOH CLEP Clinical Laboratory Standards of Practice, General Systems Standards]<br />		[https://www.wadsworth.org/regulatory/clep/clinical-labs/laboratory-standards NYSDOH CLEP Clinical Laboratory Standards of Practice, General Systems Standards]<br />
	[https://www.wada-ama.org/en/resources/world-anti-doping-program/international-standard-laboratories-isl WADA International Standard for Laboratories (ISL) 5.3.8.3]<br />		[https://www.wada-ama.org/en/resources/world-anti-doping-program/international-standard-laboratories-isl WADA International Standard for Laboratories (ISL) 5.3.8.3]<br />
	[https://www.wada-ama.org/en/resources/world-anti-doping-program/international-standard-protection-privacy-and-personal WADA International Standard for the Protection of Privacy and Personal Information (ISPPPI) (throughout)]		[https://www.wada-ama.org/en/resources/world-anti-doping-program/international-standard-protection-privacy-and-personal WADA International Standard for the Protection of Privacy and Personal Information (ISPPPI) (throughout)]
	\| style="background-color:white;" \|'''36.2''' The system should be provisioned with enough security to prevent personally identifiable information in the system from being compromised.		\| style="background-color:white;" \|'''36.2''' The system should be provisioned with enough security to automatically enforce verification mechanisms that prevent personally identifiable information in the system from being compromised.
	\|-		\|-
	\| style="padding:5px; width:500px;" \|[https://www.law.cornell.edu/cfr/text/45/164.514 45 CFR Part 164.514]<br />[https://www.acmg.net/ACMG/Medical-Genetics-Practice-Resources/Genetics_Lab_Standards/ACMG/Medical-Genetics-Practice-Resources/Genetics_Lab_Standards.aspx ACMG Technical Standards for Clinical Genetics Laboratories C5.5]<br />[https://elss.cap.org/elss/ShowProperty?nodePath=/UCMCON/Contribution%20Folders/DctmContent/education/OnlineCourseContent/2017/LAP-TLTM/misc/lam.pdf CAP Laboratory Accreditation Manual]<br />[https://www.wada-ama.org/en/resources/world-anti-doping-program/international-standard-protection-privacy-and-personal WADA International Standard for the Protection of Privacy and Personal Information (ISPPPI) 10.3]		\| style="padding:5px; width:500px;" \|[https://www.law.cornell.edu/cfr/text/45/164.514 45 CFR Part 164.514]<br />[https://www.acmg.net/ACMG/Medical-Genetics-Practice-Resources/Genetics_Lab_Standards/ACMG/Medical-Genetics-Practice-Resources/Genetics_Lab_Standards.aspx ACMG Technical Standards for Clinical Genetics Laboratories C5.5]<br />[https://elss.cap.org/elss/ShowProperty?nodePath=/UCMCON/Contribution%20Folders/DctmContent/education/OnlineCourseContent/2017/LAP-TLTM/misc/lam.pdf CAP Laboratory Accreditation Manual]<br />[https://www.wada-ama.org/en/resources/world-anti-doping-program/international-standard-protection-privacy-and-personal WADA International Standard for the Protection of Privacy and Personal Information (ISPPPI) 10.3]

Shawndouglas at 16:32, 6 January 2023

2023-01-06T16:32:40Z

← Older revision		Revision as of 16:32, 6 January 2023
Line 23:		Line 23:
	\| style="background-color:white;" \|'''36.2''' The system should be provisioned with enough security to prevent personally identifiable information in the system from being compromised.		\| style="background-color:white;" \|'''36.2''' The system should be provisioned with enough security to prevent personally identifiable information in the system from being compromised.
	\|-		\|-
	\| style="padding:5px; width:500px;" \|[https://www.law.cornell.edu/cfr/text/45/164.514 45 CFR Part 164.514]<br />[https://www.acmg.net/ACMG/Medical-Genetics-Practice-Resources/Genetics_Lab_Standards/ACMG/Medical-Genetics-Practice-Resources/Genetics_Lab_Standards.aspx ACMG Technical Standards for Clinical Genetics Laboratories C5.5]<br />[https://elss.cap.org/elss/ShowProperty?nodePath=/UCMCON/Contribution%20Folders/DctmContent/education/OnlineCourseContent/2017/LAP-TLTM/misc/lam.pdf CAP Laboratory Accreditation Manual]<br />		\| style="padding:5px; width:500px;" \|[https://www.law.cornell.edu/cfr/text/45/164.514 45 CFR Part 164.514]<br />[https://www.acmg.net/ACMG/Medical-Genetics-Practice-Resources/Genetics_Lab_Standards/ACMG/Medical-Genetics-Practice-Resources/Genetics_Lab_Standards.aspx ACMG Technical Standards for Clinical Genetics Laboratories C5.5]<br />[https://elss.cap.org/elss/ShowProperty?nodePath=/UCMCON/Contribution%20Folders/DctmContent/education/OnlineCourseContent/2017/LAP-TLTM/misc/lam.pdf CAP Laboratory Accreditation Manual]<br />[https://www.wada-ama.org/en/resources/world-anti-doping-program/international-standard-protection-privacy-and-personal WADA International Standard for the Protection of Privacy and Personal Information (ISPPPI) 10.3]
	[https://www.wada-ama.org/en/resources/world-anti-doping-program/international-standard-protection-privacy-and-personal WADA International Standard for the Protection of Privacy and Personal Information (ISPPPI) 10.3]
	\| style="background-color:white;" \|'''36.3''' The system shall allow authorized individuals to de-identify select data in the system, including but not limited to names, geographic locations, dates, government-issued identification numbers, telephone numbers, email addresses, full-face photos, and other personal identifiers.		\| style="background-color:white;" \|'''36.3''' The system shall allow authorized individuals to de-identify select data in the system, including but not limited to names, geographic locations, dates, government-issued identification numbers, telephone numbers, email addresses, full-face photos, and other personal identifiers.
	\|-		\|-

Shawndouglas: Spacing issues

2023-01-06T16:32:18Z

Spacing issues

← Older revision		Revision as of 16:32, 6 January 2023
Line 27:		Line 27:
	\| style="background-color:white;" \|'''36.3''' The system shall allow authorized individuals to de-identify select data in the system, including but not limited to names, geographic locations, dates, government-issued identification numbers, telephone numbers, email addresses, full-face photos, and other personal identifiers.		\| style="background-color:white;" \|'''36.3''' The system shall allow authorized individuals to de-identify select data in the system, including but not limited to names, geographic locations, dates, government-issued identification numbers, telephone numbers, email addresses, full-face photos, and other personal identifiers.
	\|-		\|-
	\| style="padding:5px; width:500px;" \|[https://www.law.cornell.edu/cfr/text/45/part-164/subpart-E 45 CFR Part 164 Subpart E]<br />		\| style="padding:5px; width:500px;" \|[https://www.law.cornell.edu/cfr/text/45/part-164/subpart-E 45 CFR Part 164 Subpart E]<br />[https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/final NIST 800-53, Rev. 5, AC-6]
	[https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/final NIST 800-53, Rev. 5, AC-6]
	\| style="background-color:white;" \|'''36.4''' The system shall be able to verify and ensure that users authorized to view de-identified data are also not a member of a role that permits access to information that re-identifies the data, i.e., segregate duties.		\| style="background-color:white;" \|'''36.4''' The system shall be able to verify and ensure that users authorized to view de-identified data are also not a member of a role that permits access to information that re-identifies the data, i.e., segregate duties.
	\|-		\|-

Shawndouglas: Updated for 2022.

2022-05-05T20:48:56Z

Updated for 2022.

← Older revision		Revision as of 20:48, 5 May 2022
Line 8:		Line 8:
	! style="color:brown; background-color:#ffffee; width:700px;"\| Requirement		! style="color:brown; background-color:#ffffee; width:700px;"\| Requirement
	\|-		\|-
	\| style="padding:5px; width:500px;" \|[https://www.law.cornell.edu/cfr/text/45/part-164/subpart-E 45 CFR Part 164 Subpart E]<br />[https://www.astm.org/~~Standards/E1578~~.~~htm~~ ASTM E1578-18 S-5-1]		\| style="padding:5px; width:500px;" \|[https://www.law.cornell.edu/cfr/text/45/part-164/subpart-E 45 CFR Part 164 Subpart E]<br />[https://www.acmg.net/ACMG/Medical-Genetics-Practice-Resources/Genetics_Lab_Standards/ACMG/Medical-Genetics-Practice-Resources/Genetics_Lab_Standards.aspx ACMG Technical Standards for Clinical Genetics Laboratories G17.2]<br />[https://www.astm.org/e1578-18.html ASTM E1578-18 S-5-1]<br />[https://elss.cap.org/elss/ShowProperty?nodePath=/UCMCON/Contribution%20Folders/DctmContent/education/OnlineCourseContent/2017/LAP-TLTM/misc/lam.pdf CAP Laboratory Accreditation Manual]
	\| style="background-color:white;" \|'''36.1''' The system shall comply with privacy protection compliance like that found in HIPAA provisions.		\| style="background-color:white;" \|'''36.1''' The system shall comply with privacy protection compliance like that found in HIPAA provisions.
	\|-		\|-
	\| style="padding:5px; width:500px;" \|		\| style="padding:5px; width:500px;" \|
			[https://www.law.cornell.edu/cfr/text/10/20.2106 10 CFR Part 20.2106 (d)]<br />
	[https://www.law.cornell.edu/cfr/text/45/164.105 45 CFR Part 164.105]<br />		[https://www.law.cornell.edu/cfr/text/45/164.105 45 CFR Part 164.105]<br />
	[https://www.law.cornell.edu/cfr/text/45/part-164/subpart-C 45 CFR Part 164 Subpart C]<br />		[https://www.law.cornell.edu/cfr/text/45/part-164/subpart-C 45 CFR Part 164 Subpart C]<br />
	[https://www.law.cornell.edu/cfr/text/45/170.315 45 CFR Part 170.315 (d)]<br />		[https://www.law.cornell.edu/cfr/text/45/170.315 45 CFR Part 170.315 (d)]<br />
	[https://www.astm.org/~~Standards/E1578~~.~~htm~~ ASTM E1578-18 S-5-2]		[https://www.astm.org/e1578-18.html ASTM E1578-18 S-5-2]<br />
			[https://ichgcp.net/ ICH GCP 2.11]<br />
			[https://www.wadsworth.org/regulatory/clep/clinical-labs/laboratory-standards NYSDOH CLEP Clinical Laboratory Standards of Practice, General Systems Standards]<br />
			[https://www.wada-ama.org/en/resources/world-anti-doping-program/international-standard-laboratories-isl WADA International Standard for Laboratories (ISL) 5.3.8.3]<br />
			[https://www.wada-ama.org/en/resources/world-anti-doping-program/international-standard-protection-privacy-and-personal WADA International Standard for the Protection of Privacy and Personal Information (ISPPPI) (throughout)]
	\| style="background-color:white;" \|'''36.2''' The system should be provisioned with enough security to prevent personally identifiable information in the system from being compromised.		\| style="background-color:white;" \|'''36.2''' The system should be provisioned with enough security to prevent personally identifiable information in the system from being compromised.
	\|-		\|-
	\| style="padding:5px; width:500px;" \|[https://www.law.cornell.edu/cfr/text/45/164.514 45 CFR Part 164.514]		\| style="padding:5px; width:500px;" \|[https://www.law.cornell.edu/cfr/text/45/164.514 45 CFR Part 164.514]<br />[https://www.acmg.net/ACMG/Medical-Genetics-Practice-Resources/Genetics_Lab_Standards/ACMG/Medical-Genetics-Practice-Resources/Genetics_Lab_Standards.aspx ACMG Technical Standards for Clinical Genetics Laboratories C5.5]<br />[https://elss.cap.org/elss/ShowProperty?nodePath=/UCMCON/Contribution%20Folders/DctmContent/education/OnlineCourseContent/2017/LAP-TLTM/misc/lam.pdf CAP Laboratory Accreditation Manual]<br />
			[https://www.wada-ama.org/en/resources/world-anti-doping-program/international-standard-protection-privacy-and-personal WADA International Standard for the Protection of Privacy and Personal Information (ISPPPI) 10.3]
	\| style="background-color:white;" \|'''36.3''' The system shall allow authorized individuals to de-identify select data in the system, including but not limited to names, geographic locations, dates, government-issued identification numbers, telephone numbers, email addresses, full-face photos, and other personal identifiers.		\| style="background-color:white;" \|'''36.3''' The system shall allow authorized individuals to de-identify select data in the system, including but not limited to names, geographic locations, dates, government-issued identification numbers, telephone numbers, email addresses, full-face photos, and other personal identifiers.
	\|-		\|-
	\| style="padding:5px; width:500px;" \|[https://www.law.cornell.edu/cfr/text/45/part-164/subpart-E 45 CFR Part 164 Subpart E]<br />		\| style="padding:5px; width:500px;" \|[https://www.law.cornell.edu/cfr/text/45/part-164/subpart-E 45 CFR Part 164 Subpart E]<br />
	[https://~~nvlpubs~~.nist.gov/~~nistpubs~~/~~SpecialPublications~~/~~NIST.SP.~~800-~~53r4.pdf~~ NIST 800-53, Rev. 4, AC-6]		[https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/final NIST 800-53, Rev. 5, AC-6]
	\| style="background-color:white;" \|'''36.4''' The system shall be able to verify and ensure that users authorized to view de-identified data are also not a member of a role that permits access to information that re-identifies the data, i.e., segregate duties.		\| style="background-color:white;" \|'''36.4''' The system shall be able to verify and ensure that users authorized to view de-identified data are also not a member of a role that permits access to information that re-identifies the data, i.e., segregate duties.
			\|-
			\| style="padding:5px; width:500px;" \|[https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/final NIST 800-53, Rev. 5, SI-19(7)]
			\| style="background-color:white;" \|'''36.5''' The system should use validated algorithms to de-identify data in the system and be validated to use those algorithms.
	\|-		\|-
	\|}		\|}
	\|}		\|}

Shawndouglas at 21:47, 15 November 2019

2019-11-15T21:47:24Z

← Older revision		Revision as of 21:47, 15 November 2019
Line 21:		Line 21:
	\| style="background-color:white;" \|'''36.3''' The system shall allow authorized individuals to de-identify select data in the system, including but not limited to names, geographic locations, dates, government-issued identification numbers, telephone numbers, email addresses, full-face photos, and other personal identifiers.		\| style="background-color:white;" \|'''36.3''' The system shall allow authorized individuals to de-identify select data in the system, including but not limited to names, geographic locations, dates, government-issued identification numbers, telephone numbers, email addresses, full-face photos, and other personal identifiers.
	\|-		\|-
	\| style="padding:5px; width:500px;" \|[https://www.law.cornell.edu/cfr/text/45/part-164/subpart-E 45 CFR Part 164 Subpart E]		\| style="padding:5px; width:500px;" \|[https://www.law.cornell.edu/cfr/text/45/part-164/subpart-E 45 CFR Part 164 Subpart E]<br />
			[https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf NIST 800-53, Rev. 4, AC-6]
	\| style="background-color:white;" \|'''36.4''' The system shall be able to verify and ensure that users authorized to view de-identified data are also not a member of a role that permits access to information that re-identifies the data, i.e., segregate duties.		\| style="background-color:white;" \|'''36.4''' The system shall be able to verify and ensure that users authorized to view de-identified data are also not a member of a role that permits access to information that re-identifies the data, i.e., segregate duties.
	\|-		\|-
	\|}		\|}
	\|}		\|}

Shawndouglas: Created as needed.

2019-09-19T23:28:48Z

Created as needed.

New page

{|
| STYLE="vertical-align:top;"|
{| class="wikitable collapsible" border="1" cellpadding="10" cellspacing="0"
|-
! colspan="2" style="text-align:left; padding-left:20px; padding-top:10px; padding-bottom:10px;"|
|-
! style="color:brown; background-color:#ffffee; width:500px;"| Regulation, Specification, or Guidance
! style="color:brown; background-color:#ffffee; width:700px;"| Requirement
|-
| style="padding:5px; width:500px;" |[https://www.law.cornell.edu/cfr/text/45/part-164/subpart-E 45 CFR Part 164 Subpart E]<br />[https://www.astm.org/Standards/E1578.htm ASTM E1578-18 S-5-1]
| style="background-color:white;" |'''36.1''' The system shall comply with privacy protection compliance like that found in HIPAA provisions.
|-
| style="padding:5px; width:500px;" |
[https://www.law.cornell.edu/cfr/text/45/164.105 45 CFR Part 164.105]<br />
[https://www.law.cornell.edu/cfr/text/45/part-164/subpart-C 45 CFR Part 164 Subpart C]<br />
[https://www.law.cornell.edu/cfr/text/45/170.315 45 CFR Part 170.315 (d)]<br />
[https://www.astm.org/Standards/E1578.htm ASTM E1578-18 S-5-2]
| style="background-color:white;" |'''36.2''' The system should be provisioned with enough security to prevent personally identifiable information in the system from being compromised.
|-
| style="padding:5px; width:500px;" |[https://www.law.cornell.edu/cfr/text/45/164.514 45 CFR Part 164.514]
| style="background-color:white;" |'''36.3''' The system shall allow authorized individuals to de-identify select data in the system, including but not limited to names, geographic locations, dates, government-issued identification numbers, telephone numbers, email addresses, full-face photos, and other personal identifiers.
|-
| style="padding:5px; width:500px;" |[https://www.law.cornell.edu/cfr/text/45/part-164/subpart-E 45 CFR Part 164 Subpart E]
| style="background-color:white;" |'''36.4''' The system shall be able to verify and ensure that users authorized to view de-identified data are also not a member of a role that permits access to information that re-identifies the data, i.e., segregate duties.
|-
|}
|}