Access control procedures

[Insert name of organisation]

[Insert date adopted]

  1. Introduction

Technical access controls are built into information systems by IT system suppliers. To ensure confidential information is protected, this functionality must be supported by operational and managerial controls put in place by the organisation.

  1. Purpose

The Access Control Proceduresset out how [insert organisation name] willallocate, manage and remove access rights to computer systemsholding patient information so that only authorised personnel have access to use and share information held within those systems; and they aim to ensure that access rights are used appropriately by the organisation’s staff.

  1. Scope

These procedures relate to access controls for computer-based information systems managed by the organisation to store patient identifiable data. They therefore cover the allocation, management and removal of user accounts and the guidelines provided to staff to ensure they use the organisation -managed system appropriately.

  1. Summary of technical access controls

The organisation computer system has the following technical controls in place [you will need to obtain this information from your IT system supplier]:

[For example,the different types of user profile available; the type of secure logon procedures in place; audit trails; the password management system in use (i.e. how many characters, periodic enforcement of changes, whether passwords are displayed in clear text when entered), who has access to encrypted data and back-up tapes, etc].

  1. Responsibility for user access management

The organisation has assigned responsibility for managing user access rights to the system to [insert name or post], who hasadministrator rights allowing access to sensitive areas (for example, passwords). The unnecessary allocation anduse of administrator rights is often found to be a major contributing factor to the vulnerability ofsystems that have been breached, therefore allocation of administrator rights to other staff can only be authorised by [insert name of senior member of the organisation].

  1. General

Each user is identified by a unique user ID so that users can be linked to and maderesponsible for their actions. The use of group IDs is only permitted where they aresuitable for the work carried out (e.g. training accounts [insert other valid reason]).During their induction to the system each user is given a copy of guidelines for staff on use of the system (see page 4) and their userlogin details, and is required to sign to indicate that they understand the conditions of access.A record is kept of all users given access to the system.

  1. New permanent staff

When a new employee/contractor joins the organisation [insert name or post of responsible person]arrangesaccessto the system.

  1. Locum staff

Temporary access is granted on a need to use basis. Such logons are granted by [insert name or post] and are recorded and reported in the usual way. Temporary logons are identified by a specific login (starting TEMP**** [insert alternative])and aretime limited and deleted or suspended immediately when no longer required.

  1. Change of user requirements

Changes to requirements will normally relate to an alteration to the level of access usedor suspension of an account, e.g. if the user is on long-term leave, a locum who returns to the organisation from time to time [insert other possible reasons]. Requests aremade to [insert name or post] anda record is kept of all changes.

  1. Password management

The organisation systemhas the following password protection features [insert text /delete as appropriate]:

  • Users must change their password after the first logon;
  • Users must select complex passwords [insert type, e.g. minimum 6 characters, alphanumeric, special characters, etc];
  • Users must change their passwords periodically [insert time frequency];
  • Prevention of password reuse [insert limitation,e.g. user cannot reuse one of their last 3 passwords];
  • Users may change their password at their own request.
  1. Forgotten password

Where a user has forgotten his/her password, areplacement should be requested from [insert name or post], who issues a temporary, single use, password which requires the user to reset their password to one they are more likely to remember.

  1. Removal of users

As soon as an individual leaves the organisation, all his/her system logonsare revoked.As part of the employee termination process line managers inform [insert name or post] of all leavers and their date of leaving. This also applies to self-employed contractors such as associates.

  1. Review of access rights

[Insert name or post] reviews all access rights on a regular basis, but in any event at least once a year. The review is designed to positively confirm all system users.Any lapsed or unwanted logons, which are identified, are disabled immediately and deleted unless positively reconfirmed.

  1. Monitoring compliance with access rights

The management of access rights is subject to regular compliance checks to ensure that this procedure is being followed and that staff are complying with their duty to use their access rights in an appropriate manner. Areas considered in the compliance check include whether:

  • Only staff regularly working in the organisation are registered as active users on the system;
  • Allocation of administrator rights is restricted;
  • Access rights are regularly reviewed;
  • There is any evidence of staff sharing their access rights;
  • Staff are appropriately logging out of the organisation system.
  1. Approval

These procedures have been approved by the undersigned, and they will be reviewed on at least an annual basis and will take into account changes made to the technical access controls in systems by system suppliers.

Name
Date approved
Review date

GUIDELINES ON THE APPROPRIATE USE OF COMPUTER SYSTEMS

[You may wish to edit and copy this section and provide it as a handout to each member of staff]

These guidelines apply to all staff including permanent, temporary, and locum members of staff.

Preventing unauthorised system access

Whenever you leave your desktop computer unattended, get into the habit of locking it so that information cannot be accessed by unauthorised persons. To quickly lock your computer, press Ctrl, Alt and Delete together and then select “lock computer”, this will then require you to input your password before information and applications can be accessed again. When leaving your work station for the day, log out of the system entirely and close down the computer

Password management

For good password management:

  • Use at least 6 [insert alternative number specific to the organisation] alphanumeric characters, a mixture of large and small case and ideally add some special characters such as an underscore (_), a hyphen (-), a dollar sign ($), a pound sign (£), a question mark (?), a forward slash (/), a hash sign (#) or a star (*) to further increase security;
  • Choose a password that cannot be guessed and avoid using the names of children, partners, pets, your car registration number or football team etc;
  • Use phrases to help you make a complex and more secure password. For instance; ‘One day I will visit the US’ can become ‘o-d-i-w-v-t-u-s’ by using the first letter of each word. Then change some of the letters for numbers or special characters, for example, change the letter o to a zero, change the letter i to a forward slash, etc;
  • Change your password regularly or immediately if you suspect someone may have guessed it;
  • Never share your passwords with anyone, not even your closest colleague. If you suspect someone may know it, change it immediately.

Remember:

  • Always keep your password secret;
  • Always ensure no one is watching as you enter your password;
  • Never share a password and never ever attempt to gain access to a system using someone else’s password.

Personal use of IT equipment

IT facilities such as the Internet and email have been provided by the organisation primarily for business purposes. This organisation permits/does not permit [delete as appropriate] the personal use of these facilities [limited to lunch breaks and after work hours - delete if personal use is not permitted].

Excessive personal use or inappropriate use of the IT systems is a disciplinary offence and may lead to dismissal.

  • Excessive personal use includes: carrying on a business using the organisation’s email and other IT facilities [insert other examples].
  • Inappropriate use includes:accessing or downloading pornographic or offensive images and material, or sending harassing or offensive emails, [insert other examples].

Appropriate use of email

Junk emails and chain letters sent via email are known as Spam. Don’t keep them or forward them to other users – delete them!

  • Never reply to a junk email even if there is a link to an unsubscribe facility. If you do reply, it just confirms that yours is a valid email address and will result in you receiving even more junk mail.
  • You are expected to manage your email in a professional manner. Email at work is primarily provided for work purposes. In this organisation, staff may/may not [delete as appropriate] use the system for personal mail [provided it is not excessive - delete if personal use is not permitted].

Audit trails and reporting security breaches

Nearly all of the activity you perform on a computer can be tracked. Our system suppliers record and enable us to review Internet usage logs. Emails are routinely backed up on the organisation’s computer servers. Recorded information will be used to aid an investigation where breaches of security, the law or these guidelinesare suspected. This information is kept confidential, but when used helps to explain innocent situations more often than exposing security breaches.

Information security breaches might involve unauthorised use of equipment or unauthorised access to data. Any breach of security, however small, wastes time and often requires work to be repeated and could be a potential risk to the organisation or individuals. If you know or suspect that a breach of information security has occurred, please inform the information governance lead [insert name].

Unlicensed software and computer viruses

You should never use software that hasn’t been authorised by the organisation on your work computer.The main reasons why you should never do this are:

  • The risk of infection to your computer, other computers and the network from malicious code embedded in the software. The risk applies to all programs and games downloaded from the Internet, on CD or any other storage media. Malicious code includes computer viruses and spyware, and the effects will vary depending on which has been downloaded. Some malicious code will just waste time while another can destroy data or even allow a malicious user to gain access to your computer.
  • The likelihood of breaching copyright and licensing laws. The organisation has to pay for a license for the software used on its systems. If you install software without authorisation this process is by-passed and you put the organisation at risk of legal action from the owner of the software. If you are installing so-called free software it could be an illegal copy, or it could be trial software with an expiry date. Even if neither of these things apply, the software is likely to be for single personal use and require a license for corporate use.
  • The download may interfere with patient management or other software causing them to run more slowly or not work at all.

If you find some software you think theorganisation could benefit from, please inform the information governance lead [insert name], and NEVER install it yourself!

Malicious code may also be contained within email attachments. The organisation has an anti-virus system that will catch most incoming viruses on emails, but always be cautious of email attachments from people you don’t know and never install unauthorised software.

Approval

These guidelines have been approved by the undersigned and will be reviewed on an annual basis.

Name
Date approved
Review date

Access control procedures Page 1 of 6 Printed 13 September 2018