Difference between revisions of "Template:LIMSpec for Cannabis Testing/Information privacy"
From CannaQAWiki
Jump to navigationJump to searchShawndouglas (talk | contribs) m (Renumbered.) |
Shawndouglas (talk | contribs) (Formatting) |
||
| Line 5: | Line 5: | ||
! colspan="2" style="text-align:left; padding-left:20px; padding-top:10px; padding-bottom:10px;"| | ! colspan="2" style="text-align:left; padding-left:20px; padding-top:10px; padding-bottom:10px;"| | ||
|- | |- | ||
! style="color:brown; background-color:#ffffee; width: | ! style="color:brown; background-color:#ffffee; width:175px;"| Regulation, Specification, or Guidance | ||
! style="color:brown; background-color:#ffffee; width:700px;"| Requirement | ! style="color:brown; background-color:#ffffee; width:700px;"| Requirement | ||
|- | |- | ||
| style="padding:5px; | | style="padding-left:5px; padding-top:5px; padding-bottom:5px;" |▪ [https://www.law.cornell.edu/cfr/text/45/part-164/subpart-E 45 CFR Part 164 Subpart E]<br />▪ [https://www.astm.org/Standards/E1578.htm ASTM E1578-18 S-5-1] | ||
| style="background-color:white;" |'''27.1''' The system shall comply with privacy protection compliance like that found in HIPAA provisions (e.g., when handling medical marijuana user data). | | style="background-color:white; vertical-align: text-top;" |'''27.1''' The system shall comply with privacy protection compliance like that found in HIPAA provisions (e.g., when handling medical marijuana user data).<br /> <br /><hr style="width:95%; margin: auto;"><br /> <br /> | ||
|- | |- | ||
| style="padding:5px; | | style="padding-left:5px; padding-top:5px; padding-bottom:5px;" | | ||
[https://www.law.cornell.edu/cfr/text/45/164.105 45 CFR Part 164.105]<br /> | ▪ [https://www.law.cornell.edu/cfr/text/45/164.105 45 CFR Part 164.105]<br /> | ||
[https://www.law.cornell.edu/cfr/text/45/part-164/subpart-C 45 CFR Part 164 Subpart C]<br /> | ▪ [https://www.law.cornell.edu/cfr/text/45/part-164/subpart-C 45 CFR Part 164 Subpart C]<br /> | ||
[https://www.law.cornell.edu/cfr/text/45/170.315 45 CFR Part 170.315 (d)]<br /> | ▪ [https://www.law.cornell.edu/cfr/text/45/170.315 45 CFR Part 170.315 (d)]<br /> | ||
[https://www.astm.org/Standards/E1578.htm ASTM E1578-18 S-5-2] | ▪ [https://www.astm.org/Standards/E1578.htm ASTM E1578-18 S-5-2] | ||
| style="background-color:white;" |'''27.2''' The system should be provisioned with enough security to prevent personally identifiable information in the system from being compromised. | | style="background-color:white; vertical-align: text-top;" |'''27.2''' The system should be provisioned with enough security to prevent personally identifiable information in the system from being compromised.<br /> <br /><hr style="width:95%; margin: auto;"><br /> <br /> | ||
|- | |- | ||
| style="padding:5px; | | style="padding-left:5px; padding-top:5px; padding-bottom:5px;" |▪ [https://www.law.cornell.edu/cfr/text/45/164.514 45 CFR Part 164.514] | ||
| style="background-color:white;" |'''27.3''' The system shall allow authorized individuals to de-identify select data in the system, including but not limited to names, geographic locations, dates, government-issued identification numbers, telephone numbers, email addresses, full-face photos, and other personal identifiers. | | style="background-color:white; vertical-align: text-top;" |'''27.3''' The system shall allow authorized individuals to de-identify select data in the system, including but not limited to names, geographic locations, dates, government-issued identification numbers, telephone numbers, email addresses, full-face photos, and other personal identifiers.<br /> <br /><hr style="width:95%; margin: auto;"><br /> <br /> | ||
|- | |- | ||
| style="padding:5px; | | style="padding-left:5px; padding-top:5px; padding-bottom:5px;" |▪ [https://www.law.cornell.edu/cfr/text/45/part-164/subpart-E 45 CFR Part 164 Subpart E]<br /> | ||
[https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf NIST 800-53, Rev. 4, AC-6] | ▪ [https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf NIST 800-53, Rev. 4, AC-6] | ||
| style="background-color:white;" |'''27.4''' The system shall be able to verify and ensure that users authorized to view de-identified data are also not a member of a role that permits access to information that re-identifies the data, i.e., segregate duties. | | style="background-color:white; vertical-align: text-top;" |'''27.4''' The system shall be able to verify and ensure that users authorized to view de-identified data are also not a member of a role that permits access to information that re-identifies the data, i.e., segregate duties.<br /> <br /><hr style="width:95%; margin: auto;"><br /> <br /> | ||
|- | |- | ||
|} | |} | ||
|} | |} | ||
Revision as of 17:36, 30 January 2021
| ||||||||||||
