MedStack Technology Compliance Policies

Logging and monitoring

Log events automatically on all operational systems

• admin activity
• user activity
• exceptions
• faults
• information security events
• remote access, logins and logouts
• privilege escalation (such as sudo and su)
• actions that require administrator access
• changes to accounts (such as passwords)
• changes to system settings

Log service activity on all systems that handle PHI

• Examples of activity to log
  • HTTP activity
  • Database activity

Protect the logs

• Store on a central log server.
• Require administrator access to view logs at a customer level.
• Require superadmin access to view all logs.
• Do not permit services that ship logs to modify or delete logs.
• Back up the logs.

Retain logs until whichever comes first

• For information security logs
  • for at least six months
  • longer if they are needed for an active investigation
• For non-information security logs
  • An appropriate time
  • until the affected customer is no longer under contract

Synchronize the clocks of servers

• using ntp

Enforcement

• Responsible party: All managers and supervisors
• sanctions: standard

References