Att 8 - Rules of Behavior - System Users

The purpose of this “Rules of Behavior for HEPTLC Agency Users” (ROB-AU) is to provide users of the web-based Hepatitis Testing and Linkage to Care Monitoring and Evaluation System (HEPTLC) guidelines for policies and practices related to HEPTLC data collection and reporting. All grantees using HEPTLC should review the topics discussed in this guide and sign it. Additional rules of behavior may be appended if required by state or local law or are otherwise necessary.

HEPTLC is a web-based software system for reporting hepatitis testing and linkage to care data. HEPTLC is made available to CDC grantees who are required to use it for data collection and reporting. Grantees are required to use HEPTLC, subsequently, they must develop rules for system users that comply with these guidelines.

The information presented within this Rules of Behavior document addresses:

The scope, boundaries, and applicability of the system rules
The governing law and policy applicable to the system
Statements of policy related to expected Agency Users’ behaviors and responsibilities
The broad range of consequences possible for policy violation
Descriptions of HEPTLC Agency Users’ responsibilities
A listing of any system-specific prohibited actions
The process for obtaining system help and a listing of additional resources
The process for publishing and acknowledging revisions
A formal acknowledgement and agreement mechanism (signature)

1.2 Legal, Regulatory, and Policy Requirements

HEPTLC is a part of the CDC System Enterprise Architecture and is held to a high standard of performance with regard to security. The following standards were applied to HEPTLC:

Standards Required by Law for Federal Systems

Clinger Cohen Act of 1996 (Public Law 104-106)
OMB Budget Circular A-130
Federal Information Security Management Act (FISMA)
HHS Information Security Program Policy
Executive Orders, Directives, Regulations, Publications, Guidance(s)
National Institute of Standards and Technology Special Publications 800 Series

Compliance Requirements Include filing/signing documents

Certification & Authentication process
CDC Capitol Planning Investment Control (CPIC)
OMB reporting
Enterprise Systems Catalogue
Complete ongoing processes regularly
Various service agreements that must be executed

With respect to these laws and regulations, prohibited uses include:

Access or using information inappropriately which is protected by the Privacy Act, or other federally mandated confidentiality provisions and/or by OMB Circular A-130, Management of Federal Information Resources.
Violating copyrights or software licensing agreements.

References

45 CFR 5, Freedom of Information Regulations
45 CFR 5b, Privacy Act Regulations
OMB Circular A-130, Appendix III, Security of Federal Automated Information Resources

1.3 Statement of System Policy

Each user is responsible for helping to prevent unauthorized use of, and access to, system resources. This duty includes complying with all stated policy requirements, taking due care and reasonable precautions when handling system data or using system resources, and in the management and protection of system authentication controls (passwords, certificates, etc.). When in doubt, users are strongly encouraged to contact their local HEPTLC System Administrator or the system help desk for assistance.

1.4 No Expectation of System Privacy (not data)

CDC or local agency system administrators may periodically monitor both the system and user activities for purposes including, but not limited to, troubleshooting, performance assessment, usage patterns, indications of attack or misuse, and the investigation of a complaint or suspected incident. Users are provided system access for the purpose of facilitating Federal, state, local, and agency public health missions.

1.5 Penalties for Non-Compliance

Users who do not comply with the prescribed Rules of Behavior are subject to penalties that can be imposed under existing policy and regulation including reprimands, suspension of system privileges, suspension from duty, termination, and criminal prosecution.

2. User Responsibilities

2.1 Ethical Conduct

Users of the HEPTLC system should be held accountable for their use of the system and the data. Users of the HEPTLC system are only able to access the data that they enter, the data that belongs to their individual organization and specific data to which they have been given rights. Using system resources to copy, release, or view data without authorization is prohibited. Altering data improperly or otherwise tampering with the system is prohibited. Staff authorized to access client-level data is responsible for the protection of confidential information and must report any breaches.

2.2 Authentication Management

Access to HEPTLC files and software must be restricted to authorized users. Users will be assigned an user account, limiting activities within the system. The Agency System Administrator will terminate access if employees leave, change jobs, or breach agency policies. Users who share the same computer must have separate logins and SDN digital certificates.

2.2.1 Granting Access

The agency system administrator grants access to staff requiring use of HEPTLC software or data. The steps in this process for HEPTLC grantees are as follows:

application for SDN Digital Certificate
include letter from agency (refer to HEPTLC System Security for copy of Digital Certificate letter)

This is done in writing through the user’s supervisor and should include a description of the user’s duties related to HEPTLC. Once a certificate is granted, the Agency System Administrator establishes an account with levels of access and permissions for that user which should only be necessary to perform their required duties. Users are assigned a user ID and a means of authenticating who they are, such as a password . An Agency System Administrator’s responsibility also includes restricting access to parts of HEPTLC according to the role of the user, modifying access within the system when a user’s duties change, and terminating access when employees leave, change jobs, or breach agency policies.

Users of HEPTLC who have access to confidential data or secured areas should sign binding, non-disclosure agreements before being given access to HEPTLC (Rules of Behavior and Memorandum of Understanding and Assurance of Confidentiality). Other trainings in the policy and procedures concerning security and confidentiality are also recommended.

2.2.2 Levels of Access

The Agency System Administrator is responsible for restricting access to parts of HEPTLC according to the role of the user and modifying access within the system when a user’s duties change. All users do not need access to all parts of the system. Access to the various parts of HEPTLC should be restricted based upon the role of the user. For example, typical roles include data entry, generating reports, system administration, and viewing information. Some staff may need to read information about clients but not enter data. Others may need to analyze aggregated data but not view case-specific information. The Agency System Administrators will assign the roles for user. Please refer to Chapter 2, Section 5 of the Security Summary for a list of core HEPTLC roles.

2.2.3 Terminating Access

As soon as it becomes known that an individual is changing duties within an agency, leaving the agency or breaches agency policies their access will be modified or terminated. The job-transition protocol of the agency should include immediate notification to the HEPTLC system administrator of any change in employee status so that the proper actions can be taken to protect the system and its data.

2.2.4 Use of Passwords

Passwords must be used to confirm the user identity. Passwords should be changed periodically (at least every 90 days) and not shared among staff. Separate passwords may also be used to protect specific data sets or applications within the system. For example, a user may need to enter their individual password to get access to the system, but then may need to enter a second, different password to get access to information about a certain set of clients. The HEPTLC password policy is that the passwords should be at least 8 characters long, contain a mix of at least three of the four types of keyboard elements (upper case letters, lower case letters, numerals, and punctuation marks), and can not be the individuals name (refer to Chapter 2, Section 4 and Chapter 4 “Security Recommendations for Your Grantee Agency”) of the Security Summary. ).

2.2.5 Administration of Proxies

HEPTLC provides the ability to identify and assign proxies, i.e., the ability to assign one person’s permissions to someone else. Although multiple users can be granted proxies for an individual, only one user can log in at a time, as a proxy of another user. Only an Agency System Administrator has permission to grant and delete a proxy. Rules should be developed at the site level to determine how long proxies may last and how they should be administered. All users will comply with the rules of proxy administration.

2.3 Information Management and Document Handling

At the local level data collection for HEPTLC variables may not only exist on the HEPTLC server. Data may also be on data collection forms or counselor notes, client files, CD-ROMS, personal digital assistants (PDAs), or other information storage media. Since all of these types of media may contain confidential information, the agency must develop policies and procedures for the use, storage, and disposal of data for each medium used to record or store HEPTLC data.

The computers (desktop and laptop), PDAs, servers, and other electronic equipment used to collect, enter, copy, store, analyze, or report HEPTLC data should be under the control of the grantee. The use of equipment related to HEPTLC, including internet connections, e-mail, photocopiers, facsimile machine, and other equipment that might be used to copy, transmit, or process HEPTLC data should be regulated by written policies and procedures. The policies should require that computers have screensaver locks that automatically engage when the computer is not used for a set time period and should require that personnel electronically lock their computers when they leave their desk. (In Windows this is done by depressing the Ctrl, Alt, and Delete keys simultaneously, then depressing the Enter key).

2.3.1 Storage

Agencies should establish policies and procedures that outline when it is appropriate to export HEPTLC data to storage media. All storage media should be clearly labeled. Removable media such as zip disks, CD-ROMS, etc., should be destroyed or sanitized with disk wiping tools before reuse or disposal. Storage media, whether removable or fixed, paper or electronic, containing HEPTLC data should be stored in a secured area. Data removed from secured areas for analysis should be de-identified first. Diskettes, laptops, thumb drives and other storage media that contain HEPTLC data should have only the minimum data necessary to perform a given task; should be encrypted or stored under lock and key when not in use; and (except for backups) be sanitized immediately following the task completion. Cleaning crews, maintenance staff, and other unauthorized personnel must be escorted into secured areas by designated staff. Encryption of data during storage is recommended.

2.3.2 Disposal

Many states have laws or regulations concerning how long client records must be stored, and when and how they must be destroyed. Agencies must develop policies and procedures that comply with these state regulations. When client records are to be destroyed, this should include not only paper records but also electronic records. Please note that “deleting” a file or record on the computer does not actually remove the information from the system. Even overwriting or formatting the media may not sanitize it; special sanitization programs or physical destruction of the storage media may be required. Agencies must be sure to sanitize or destroy hard drives of computers scheduled for disposal or transfer to staff not authorized to use HEPTLC.

2.3.3 Release of Data

Agencies must develop a written policy and procedure for releasing data. These policies should be periodically reviewed and modified to improve the protection of confidential information. Policies concerning the release of de-identified and aggregate data that prevent indirectly identifying clients through small denominators or cell sizes should also be established. Access to any data containing confidential information or case-specific data should be contingent on having a signed, current, binding non-disclosure agreement currently on file at the individual agency. These agreements must include discussion of possible employee ramifications and criminal and civil liabilities for unauthorized disclosure of information.

Reporting to the CDC: Reporting to the CDC should be done according to the schedule specified by the CDC. While data may be entered into HEPTLC at any time, it is not reported to the CDC until the appropriate files are submitted to the CDC by the authorized personnel of each agency over the SDN. There should be policies and procedures developed to specify the data quality assurance process that should be implemented and the administrative approval process that should be followed prior to reporting/submitting data to the CDC.

Releasing Data to Partners:

In order to assist other agencies in tracking referrals or for other related purposes, agencies may enter into agreements with other agencies to share limited information about specific clients. Data sharing should be based upon written agreements and clients should understand how their confidential information will be treated/shared with other agency partners. Agencies must develop policies and procedures to comply with state regulations regarding release of data.

Releasing Data to the Public:

Except under conditions specified in writing and explained to clients, only authorized staff members who have signed a binding non-disclosure agreement (and who have a need to know) should be allowed access to sensitive client identifying data. Agencies should have a policy and protocol for releasing de-identified and aggregate data for use in analysis, grant applications, reporting and administrative functions. This policy should specify what data may be released, in what form, to whom the data may be released, and who may approve the release of data.

2.3.4 Encryption

HEPTLC data are sensitive, confidential information that may have legal and personal implications for clients; therefore, the data should be protected from unauthorized access. HEPTLC data should always be encrypted during transmission and often should be encrypted during storage, such as during collection in the field. Data transmitted to the CDC through the SDN is secured through the use of several security controls (See chapter 2 of the Security Summary for detailed description of security controls). However, it is the responsibility of the grantee to assure security until the data is submitted to CDC.

If an organization decides to send data to anyone other than the CDC, the data should be encrypted. All HEPTLC data is encrypted using the Self Decrypting Archive function of PGP (Encryption software). An encrypted SDA file is generated and sent to CDC over the SDN. The data remains encrypted until it enters the CDC network and reaches the validation team at which time it is decrypted PGP meets the Federal Information Processing Standards 140-2 (FIPS 140-2) requirements and the CDC central key requirement for CDC.

In addition to HEPTLC data being encrypted with a Secure Socket Layer (SSL) during transit, some information remains encrypted within the database, visible only to the agency that entered it. The system encrypts all sensitive client-identifying variables and includes (in the online help) an encryption indicator for each variable. The online help also includes a warning to users that information entered in specific data fields will not be encrypted. The following is a list of client variables that will be encrypted in HEPTLC:

Minimum Test-Level Data Variables

Data Element:	Comments:
Test Site Information
Name of test site
Type of test site	(IDU, CHC, Other)
Contact information of test site	Address, Phone #, Fax #
Demographic Information
Patient ID
Patient's state of residence
Country of origin/county of birth
Date of Birth/Age	00/00/0000, Age (month, year)
Gender (Current Gender Identity)	Male, Female, Transgender
Race	AA, W, Asn, NH/PI, AI/AN, Oth
Ethnicity	Hsp, Non-Hsp, Oth
Vaccination History
Hep A vaccine	Ever, # of dose
Hep B vaccine	Ever, # of dose
Lab Information
Lab Name (The lab that performed the test)
Patient ID
Date of test
Test Technology
Test Results
Hep C
Hepatitis C antibody (HCV Ab)	Date, Positive, Negative, Indeterminate, Invalid
Hepatitis C RNA (HCV-RNA)	Date, Positive, Negative, Indeterminate, Invalid
Quantitative HCV RNA	Result, Date (Category B - ECHO option)
HCV Genotype	Result, Date (Category B - ECHO option)
Hep B
Hepatitis B core antibody	Data, Positive, Negative, Indeterminate, Invalid
Hepatitis B surface antigen	Data, Positive, Negative, Indeterminate, Invalid
Diagnosis	Chronic HBV, Chronic HCV

Post-Test Follow -Up
Test results provided	yes, no. If yes, date. If no, why?
post-test counseling provided	yes, no. If yes, date. If no, why?
Linkage to care	yes, no, date*
Antiviral Therapy (AVT)	Regimen, Date (Category B - ECHO option)
Reported to surveillance	yes, no, date*
Risk Factors
Hep C
Persons Who Inject Drugs (PWIDs) and persons who use non-injection drugs
Persons born from 1945 through 1965
HIV-positive [Self-Report Positive (SRP)]
Hep B
Persons born in countries with intermediate or high prevalence of HBV infection
Other at-risk populations, including PWID and MSM
Contacts of hepatitis B positive person
HIV-positive (SRP)
If female, is client pregnant?	yes, no, don't know, declined, not asked

*NOTE*
All personal identifying information, such as Name (FN, LN, MN), SSN, Address at Diagnosis and/or Current Address, Phone # should NOT be submitted to CDC

2.3.5 Backing up data

CDC will regularly back up all HEPTLC data stored on CDC database servers. HEPTLC data that are not yet transmitted, either because they have not yet been entered in the system or because the data are not being stored on CDC servers (HEPTLC) must be backed up periodically by the grantee. Frequency of backup should depend upon how often the data changes and how significant those changes are, but should be done based on a fixed schedule that is part of the normal maintenance of the system. Backup copies should be tested to make sure they are actually usable and stored under lock and key in a secure area and a separate copy of data kept at a secure off-site location if possible.

2.4 System Access and Usage

2.4.1 Portable equipment

While the use of portable computers has its advantages, it also creates additional security risks, such as loss or theft of the portable computer and data it stores. If computers are used outside the office, agencies should establish policies regarding physical security (the computer should be locked to an immovable object), and digital security (the computer should be protected with a unique username, complex password, and sensitive data should be encrypted). Laptop computers and other portable hardware that contain HEPTLC data should store those data in encrypted formats. Laptops should employ whole disk encryption in order to protect any sensitive data that may be stored on the hard drive.

2.4.2 Physical Security of equipment

HEPTLC Agency System Administrators should maintain an inventory of all system hardware and software provided to system users, and periodic audits should be conducted to account for all assets. Visitors or unauthorized personnel should not be allowed access to areas containing computers holding HEPTLC data without an escort. All computer equipment should be protected by surge suppressors and emergency battery power to prevent data loss in case of fluctuations in the power supply. All computers and other equipment used for HEPTLC should be housed or stored in secure areas and physically attached to an immovable object, if possible. All rooms where HEPTLC data are stored, either on paper, computer or other storage media should be locked at all times when not in use and it should be known with whom the keys reside.

2.4.3 Offsite Access

The grantee must develop a policy regarding dial-up or other offsite access to their work location computer system for the purposes of accessing HEPTLC data. When working outside the office, since the HEPTLC system contains sensitive, confidential information, dial-up or other access to the system from outside is strongly discouraged as this creates more opportunities for unauthorized intrusion into the system. If offsite access is permitted, it should be restricted to the fewest persons possible and additional security measures should be taken to ensure identification and authentication to obtain access in addition to restricting access to as few as possible.

2.4.4 Locking Workstations

All users should secure their workstations before leaving them. Automatic screen saver locks should also be set to engage whenever the system is left idle (15 minutes of inactivity). In order to unlock the screensaver, the system should require entry of the user’s ID and password.

2.4.5 Disable Browser Password Caching

All HEPTLC users will be accessing the application through a web browser (i.e. Internet Explorer) and should disable the ability of their web browser to cache (save) their passwords. This will prohibit others who use your computer to have access to passwords and other personal information that the web browser has cached for you. To disable this option, open a new Web browser, and select Internet Options from the Tools menu.

2.5 Incident Reporting

2.5.1 Breaches of Confidentiality

A breach of confidentiality is any failure to follow confidentiality protocols, whether or not information is actually released. This includes a security infraction that results in the release of private information, with or without harm to one or more individuals. All suspected breaches of confidentiality or security (e.g., possible viruses, hackers, password divulgence, lost or misplaced storage media) should be reported immediately to the HEPTLC Agency System Administrator. This administrator will determine the cause, develop and implement process improvements and/or determine if the incident should be reported to the HEPTLC Security Coordinator via the HEPTLC Service Support Center.

At the local level, sanctions for violations of confidentiality protocols should be established in writing, as part of the organizational policies and should be consistently enforced.

2.5.2 Unauthorized Intrusions

Any computer attached to the Internet, such as a HEPTLC system computer is subject to unauthorized intrusions, such as hackers, computer viruses, and worms. In addition, authorized users may attempt to access parts of the system for which they do not have access authority. Grantees must take all reasonable precautions to protect their systems from these types of unauthorized penetrations. A plan must be developed and implemented to prevent and, if necessary, recover from changes to the system caused by unauthorized penetrations of the computer system. Typical precautions include using effective passwords, installing firewalls (HEPTLC) and anti-virus software, making backup copies of software (HEPTLC), saving data at regular intervals so that the system can be restored to a previous state (HEPTLC), and training staff in basic computer security (such as keeping passwords secret and not downloading materials from the Internet or other unauthorized software onto computers that have HEPTLC access).

2.6 Training and Awareness

All agency staff dealing with HEPTLC system should be trained on policies and procedures established by the agency, the legal aspects of data collection, and the ethics of their responsibility to the clients. Training should cover state regulations and the agency’s policies concerning confidentiality, computer security, and legal obligations under non-disclosure agreements. Grantee staff should be aware of common threats to confidentiality and security, contingency plans for breaches of confidentiality and security, and the penalties associated with breaches of confidentiality and security. Each agency staff member with access to HEPTLC data should receive HEPTLC training including security updates.

Personnel are as much a part of a data collection and reporting system as computer hardware and collection forms. People are usually the weakest link in any security system. All personnel dealing with HEPTLC data should be trained on the policies and procedures established by the agency, the legal aspects of the data collection, and the ethics of their responsibility to the clients. Furthermore, they should also be aware of the penalties associated with breaches of confidentiality or security. Each agency should have a policy on confidentiality and security. The confidentiality and security policy must make clear that authorized users are responsible for knowing the confidentiality and security policies and procedures, challenging unauthorized users, reporting possible breaches, and protecting equipment and data. Staff should be required to sign a statement acknowledging that they have been made aware of the confidentiality and security requirements for the agency. The signed statement should be kept in the employee’s file.

2.7 HEPTLC Security Agreements

In an effort to provide maximum protection of the data that is entered into HEPTLC, in addition to the physical and system security measures explained in this document, there will also be a Rules of Behavior for HEPTLC Agency System Administrators covering all of the additional duties of the System Administrator. CDC also will be executing a Memorandum of Understanding (MOU) with each directly funded grantee organization. The process for completion of security agreements is described in Technical Guidance for Hepatitis Testing and Linkage to Care Monitoring and Evaluation System (HEPTLC) Grantee Security Guidelines.

3. User Assistance and Additional Resources

For assistance in using HEPTLC, contact your local HEPTLC administrator, the HEPTLC Service Center through the CCID Informatics Customer Support Help Desk via e-mail at xxx.

4. Revisions and Renewal

Revisions to this document will be released as needed. Notifications of the availability of the revised documents will be made through the HEPTLC announcement function and other established communication channels. Unless notified otherwise, it will be assumed that all grantees using HEPTLC accept the revisions. Comments and concerns should be sent to the HEPTLC Service Center via the CCID Informatics Customer Support Help Desk at [email protected].

5. Acknowledgement and Agreement of Rules of Behavior for HEPTLC Agency Users

I have read and agree to comply with the terms and conditions governing the appropriate and allowed use of HEPTLC as defined by this document, applicable agency policy, and state and Federal law, and the Security Summary.

I agree to abide by the procedures stated in these documents.

____________________________________________

(Signature / Date)

_______________________________

(Printed Name)

(Title)

(Agency Name)

File Type	application/vnd.openxmlformats-officedocument.wordprocessingml.document
Author	Bonds, Constance (CDC/OID/NCHHSTP)
File Modified	0000-00-00
File Created	2021-01-30