LRAs Attestations of Their End Users Access to ClinicalConnect

Transcription

1 LRAs Attestations of Their End Users Access to ClinicalConnect

2 Learning Objectives This session will review: The process whereby LRAs are required to attest their organization s end users access to ClinicalConnect Attestations are performed using the Access Governance System (AGS) The escalation points if attestations are not completed in a timely manner

3 What are Attestations? Attestation refers to the practice of periodically checking and certifying that only the individuals who need certain access privileges to ClinicalConnect and/or AGS have those access privileges. This process is used so the LRA can confirm End Users (excluding Sponsored Staff) have appropriate access to ClinicalConnect within your organization.

4 Attestation Notification Schedule LRAs will receive notifications to perform attestations by every May 1 and November 1. A sample of the sent to LRAs appears below: Subject: Action Required: You Must Perform Semi-Annual ClinicalConnect Attestations Dear Sue LRA Please be advised you must log into the ClinicalConnect Access Governance System (AGS) to perform attestations. You will find your attestation requests under My Actions, then Pending Attestations. The attestation process is invoked starting every May 1 and November 1 in accordance with the ClinicalConnect Data Sharing Agreement and you are required to complete these attestations for AGS and/or ClinicalConnect users in your organization to verify they are still authorized to use one or more of the systems. Please complete these attestations as soon as possible. Regards, ClinicalConnect Administration Team at Hamilton Health Sciences

5 Completing Attestations Log into AGS, select My Actions from the menu, then select Pending Attestations. Approve or Deny the account and Save Decisions. 1 2 May add an attestation reason Optional 2 Refer to the Completing Pending Attestations in AGS elearning video available at

6 Attestation History The Attestation History shows approvals and denials within the specified date range. Log into AGS, select My Activity History from the menu, then select Attestation History. Select the date range. May change the date range, then Search to display the attestations. Optional 1

7 Attestation Schedule LRA will receive a reminder if the attestations are not complete within 2 weeks of receiving the initial notification. If attestations are not complete within 4 weeks of receiving the initial notification, an escalation is sent to your organization s Privacy Officer. If attestations are not complete within 6 weeks, LRA will receive final notification to perform attestations within the next two weeks and failure to do so will result in end user s access to ClinicalConnect being disabled.

8 Unattested/Denied Accounts After 8 weeks, accounts left unattested, or denied attestation, will be automatically disabled. LRAs will be notified of the number of accounts that were auto-disabled. Disabled accounts will appear on the LRA s Reactivate Disabled Users list and can be re-enabled by the LRA if required.

9 Additional Information Multiple LRAs within the same organization can share the attestation work; completed attestations will drop off all LRAs list of pending attestations. LRAs can export their list of pending attestations in.csv format to divide up the work. Any end user account created in the 3 months leading up to the May 1 or November 1 attestation cycle kicking off does not require attestation until the next attestation cycle; this is to avoid the attestation for recently-created accounts.

10 Additional Information Enabled and active (used at least once) and inactive (never used) accounts: if left unattested, or attestation is denied, ClinicalConnect accounts are automatically disabled. They will remain in a Disabled state unless re-enabled in the future by the LRA. An audit trail is maintained for these accounts. Accounts that are Pending Enablement : if created more than 3 months before attestation cycle kicks off, LRA(s) must attest these pending accounts. LRAs can approve/deny the attestation of the account that s been created but hasn t been enabled. Approving the attestation will keep the account in the Pending Enablement list Denying the attestation will automatically disable the account and move it to a Disabled state (without the LRA having to enable it).

11 Sponsoring Physicians Attesting Staff Physicians must attest the staff they sponsor. If sponsored staff s accounts are left unattested, or their Sponsoring Physician denies an attestation, the accounts are automatically disabled and will be on the LRA s Reactivate Disabled Users list If a physician wants to resume sponsoring the disabled staff: 1. Physician contacts the LRA at the organization at which they re credentialed 2. LRA re-enables account from the Reactivate Disabled Users list 3. LRA must contact ClinicalConnect CAM with Sponsoring Physician s CPSO#; CAM adds CPSO# back to staff s account 4. Physician will receive confirmation that staff s account has been re-enabled

12 Questions & Answers