Standards and Guidelines for Electronic Medical Record Systems in ...

A locally stored backup log should be maintained with the following information as minimum:
i. name of media used;
ii. Type of backup (e.g. full backup/incremental, differential, etc.);
iii. date the backup was performed;
iv. verification status (completed/failed);
v. who performed the backup (automated or by specific staff); and
vi. Location where the backup media is stored, date it was placed there, and who placed it
there.
(NB: See Annex F for a sample Backup Log)
Backup procedures should allow for daily backups, as well as, include the possibility for performing
day-to-day restorations or full data recovery.
The backup process should be automated wherever possible in order to ensure consistency.
Off-site backup media should be given the same level of physical and environmental protection that
is required for the primary site as defined in this document. This includes security during the
transportation of media and documentation between the facility and the off-site location.
A documented procedure should be in place that outlines the off-site backup process. At a minimum
this should include a list of who is authorized to send data off-site, to where, and who is authorized
to recall data.
Computer Virus and Spyware Control
1. All computer systems must have virus detection software installed and updated
regularly.
2. Antivirus software should be configured to scan all removable media when inserted
into the system for viruses.
Computer viruses are a significant threat to the integrity and confidentiality of data on computer
systems. A facility operating an EMR system should have a written procedure on how to update the
antivirus definition files, either automatically through the internet or periodically using remotely
downloaded files. A full virus scan should be performed routinely and each time virus definition
files are updated.
Standards and Guidelines for Electronic Medical Records Systems in Kenya 71