Standards and Guidelines for Electronic Medical Record Systems in ...

· Users on special function accounts that perform privileged functions (system administrator,
security administrator, etc.) should change their password at least every 30 days.
· The EMR system should have a timed lock-out/screen blanking mechanism, which
automatically engages after no more than ten minutes of inactivity or when manually
invoked.
· Confidential information residing on a fixed disk should exist in encrypted form to avoid
compromise by unauthorized persons. EMR systems may have built-in encryption protocols.
· The system may enforce that the same password is not reused by a given account for a
period of one year.
· The EMR system shall terminate a login session and disable a user account after a maximum
of three consecutive invalid login attempts.
Audit Trails
An audit trail/audit log is a chronological sequence of audit records, each of which contains
evidence directly pertaining to and resulting from the execution of a business process or system
function.
The EMR systems must log audit trails as evidence of user transactions within the system. Audit
trail records should be captured for all levels of access. These records, at a minimum, must include
the following:
1. Date and time of the event
2. User ID or name
3. Type of event and the success or failure of that event
Defined significant security events must be logged and include:
1. Multiple failed logons;
2. Access at unusual times or from unusual locations
3. Sudden unexpected increases in volume
4. Significant computer system events (e.g., configuration updates, system crashes)
Audit logs will be reviewed frequently to allow detection of unauthorized events before a
significant loss has occurred.
Standards and Guidelines for Electronic Medical Records Systems in Kenya 30