Privacy Requirements Definition and Testing in the Healthcare Environment
|
|
|
- Harold Richardson
- 10 years ago
- Views:
Transcription
1 Definition and Testing in the Healthcare Environment Julie S. McEwen, CIPM, CIPP/G/IT/US, CISSP, PMP Julie Snyder, CIPM, CIPP/G/US Approved for Public Release. Distribution Unlimited The 2013 MITRE The Corporation. MITRE All rights All rights Reserved.
2 Problem laws and regulations articulate many privacy requirements at an abstract level It can be challenging for system developers to translate these requirements into system and application characteristics testing" refers to specific system tests that are performed to ensure that privacy requirements are implemented correctly in systems. This is an important step to ensure that systems appropriately protect Personally Identifiable Information (PII). testing is especially vital for systems that process large amounts of Protected Health Information (PHI) to reduce the likelihood of errors in care and fraud, and reduce the overall cost of error in providing healthcare services. However, there has not yet been a broader effort to articulate privacy requirements at the system/application level and address using privacy testing to verify that basic privacy controls are correctly implemented within the healthcare environment. 2
3 Definition and Testing Are NOT Separate Processes Testing as Part of Overall System Development Process Approach Integrate privacy requirements definition and testing activities into the existing system development process Have privacy testing as a rigorous and explicit activity in the system testing process testing is fundamentally the same as other types of testing performed on the system it just has a privacy focus IT&E Integration and Testing Vision & Strategy/ Principles Application /Enterprise Architecture Development Implementation of Design by Design Objective: Expand testing to ensure privacy is enforced throughout the system s development life cycle 3
4 Idea Engage with standards bodies to include healthcare-related privacy requirements and tests in standards and guidance documents that are used by the healthcare industry. Goal is to promote broad adoption of privacy testing activities within the healthcare industry. Revise the existing MITRE privacy risk management tool (PRIME) so that it can be used for privacy requirements definition and testing efforts in the healthcare environment. Goal is to make it easier for the healthcare industry to integrate privacy testing into their existing system testing processes. PRIME is becoming open source, which will make it easier for the tool to be adopted for use within the healthcare environment. 4
5 From Requirement to Test Results Example: PII Minimization System Repository Interfaces shall ensure that only predetermined PII necessary for the system purpose is accepted as input High-Level Business System Information collected by the system must be limited to the predetermined list of PII data elements Detailed Software Fail System retrieves unnecessary data elements System only retrieves necessary data elements Execute Test Plan Unit Test Plan Execute queries against a data source to verify data elements being retrieved Implemented Component Pass 5
6 Sample, Tests, & Verification Methods NIST Rev 4 App J Requirement CONSENT IP-1(d): The organization: Ensures that individuals are aware of and, where feasible, consent to all uses of PII not initially described in the public notice that was in effect at the time the organization collected the PII. HIPAA Rule 45 C.F.R (c) implies consent is obtained 45 C.F.R COMPLAINT MANAGEMENT IP-4: The organization implements a process for receiving and responding to complaints, concerns, or questions from individuals about the organizational privacy practices. 45 C.F.R C.F.R C.F.R (d)( 1) High-Level Systems that directly interface with individuals shall distinguish between mandatory and voluntary PII collection. The system shall support the tracking of disputed PII. Detailed For systems that collect PII from sources other than the individual, the system shall support a method of tracking consent when appropriate. When the individual disputes the accuracy of PII or any output based on the disputed PII, the system shall maintain a flag indicating that the PII is in dispute. Tests/Verification Methods Create test record with the consent flag enabled and one with the consent flag disabled. Attempt to execute an action that requires use of the consent flag. Submit test PII to the system. Subsequently submit a dispute of the same PII. 6
7 Risk Management Engine (PRIME) Tool PRIME is a web-based proof-of-concept tool that: Provides modularized, organizationally tailored analysis. Supports dynamic drill-down risk analysis trees. Discrete questions (yes/no, checkboxes, etc.) to simplify analysis Drill-down questions are displayed if needed based on prior answers Supports complex risk analysis to reduce false positives Generates raw risk at different views. Detailed: Risk level, risk description, risk mitigation suggestion Program level: Risk thermometer with risk temperature PRIME Components Web Front-end Context-dependent questions Cursor-sensitive help Dashboard Risk identification, priority and metrics (Compliance) document generation Engines Dynamic Questionnaire Processing Risk Analysis Dashboard Generation Risk Management Document Creation Database Organizationallydefined elements Completed questionnaires 7
8 Approach Standards and guidance Continue work to define system-level privacy requirements and privacy tests in guidance and standards testing tool Add a healthcare instance to the existing MITRE proof of concept web-based PRIME tool so that it can be used within the healthcare environment to: Select privacy requirements and privacy tests. Document how tests will be performed and their results. Document privacy risk decisions. Engage with NIST and healthcare stakeholders to integrate the privacy tests into overall testing processes by adopting the use of the updated PRIME tool within the healthcare environment. 8
9 PRIME for and Testing SPRINT The Healthcare System and Testing (SPRINT) tool is built on MITRE s PRIME platform. Identify System and Architecture Determine Relevant Identify/ Update System Tests Sample System Testing Summary Report
10 Impact Provide healthcare organizations with a tool that they can use to help implement by Design within the healthcare environment, thus enabling organizations to address privacy as systems are designed and developed. 10
Business Associate Management Methodology
Methodology auxilioinc.com 844.874.0684 Table of Contents Methodology Overview 3 Use Case 1: Upstream of s I manage business associates 4 System 5 Use Case 2: Eco System of s I manage business associates
Department of Technology Services
Department of Technology Services 2016-2019 Strategic Plan DTS Dept. of Technology Services Utah Code 63F- 1-203 explicitly requires the Chief Information Officer (CIO) to prepare an executive branch strategic
PRIVACY IMPACT ASSESSMENT
Name of System/Application: LAN/WAN PRIVACY IMPACT ASSESSMENT U. S. Small Business Administration LAN/WAN FY 2011 Program Office: Office of the Chief Information Officer A. CONTACT INFORMATION 1) Who is
DIVISION OF INFORMATION SECURITY (DIS) Information Security Policy IT Risk Strategy V0.1 April 21, 2014
DIVISION OF INFORMATION SECURITY (DIS) Information Security Policy IT Risk Strategy V0.1 April 21, 2014 Revision History Update this table every time a new edition of the document is published Date Authored
Student Administration and Scheduling System
for the Student Administration and Scheduling System DHS/FLETC/PIA-002 February 12, 2013 Contact Point William H. Dooley Chief, Office of IT Budget, Policy, & Plans (912) 261-4524 Reviewing Official Jonathan
Realizing business flexibility through integrated SOA policy management.
SOA policy management White paper April 2009 Realizing business flexibility through integrated How integrated management supports business flexibility, consistency and accountability John Falkl, distinguished
SCDA and SCDA Member Benefits Group
SCDA and SCDA Member Benefits Group HIPAA Privacy Policy 1. PURPOSE The purpose of this policy is to protect personal health information (PHI) and other personally identifiable information for all individuals
Privacy by Design The 7 Foundational Principles Implementation and Mapping of Fair Information Practices
Privacy by Design The 7 Foundational Principles Implementation and Mapping of Fair Information Practices Ann Cavoukian, Ph.D. Information & Privacy Commissioner, Ontario, Canada Purpose: This document
Recommendations for the PIA. Process for Enterprise Services Bus. Development
Recommendations for the PIA Process for Enterprise Services Bus Development A Report by the Data Privacy and Integrity Advisory Committee This report reflects the consensus recommendations provided by
A Guide to Successfully Implementing the NIST Cybersecurity Framework. Jerry Beasley CISM and TraceSecurity Information Security Analyst
TRACESECURITY WHITE PAPER GRC Simplified... Finally. A Guide to Successfully Implementing the NIST Cybersecurity Framework Jerry Beasley CISM and TraceSecurity Information Security Analyst TRACESECURITY
Privacy Impact Assessment
M AY 2, 2013 Privacy Impact Assessment CFPB BUSINESS INTELLIGENCE TOOL Contact Point: Claire Stapleton Chief Privacy Officer 1700 G Street, NW Washington, DC 20552 202-435-7220 [email protected]
HIPAA Privacy Policies & Procedures
HIPAA Privacy Policies & Procedures This sample HIPAA Privacy Policies & Procedures document will help you with your HIPAA Privacy compliance efforts. This document addresses the basics of HIPAA Privacy
Department of the Interior Privacy Impact Assessment
Department of the Interior August 15, 2014 Name of Project: email Enterprise Records and Document Management System (eerdms) Bureau: Office of the Secretary Project s Unique ID: Not Applicable A. CONTACT
Health Insurance Portability and Accountability Act Enterprise Compliance Auditing & Reporting ECAR for HIPAA Technical Product Overview Whitepaper
Regulatory Compliance Solutions for Microsoft Windows IT Security Controls Supporting DHS HIPAA Final Security Rules Health Insurance Portability and Accountability Act Enterprise Compliance Auditing &
Data Loss Prevention Best Practices to comply with PCI-DSS An Executive Guide
Data Loss Prevention Best Practices to comply with PCI-DSS An Executive Guide. Four steps for success Implementing a Data Loss Prevention solution to address PCI requirements may be broken into four key
Zubi Advertising Privacy Policy
Zubi Advertising Privacy Policy This privacy policy applies to information collected by Zubi Advertising Services, Inc. ( Company, we or us ), on our Latino Emoji mobile application or via our Latino Emoji
WHITEPAPER. Complying with the Red Flag Rules and FACT Act Address Discrepancy Rules
WHITEPAPER Complying with the Red Flag Rules and FACT Act Address Discrepancy Rules May 2008 2 Table of Contents Introduction 3 ID Analytics for Compliance and the Red Flag Rules 4 Comparison with Alternative
APPLICATION COMPLIANCE AUDIT & ENFORCEMENT
TELERAN SOLUTION BRIEF Building Better Intelligence APPLICATION COMPLIANCE AUDIT & ENFORCEMENT For Exadata and Oracle 11g Data Warehouse Environments BUILDING BETTER INTELLIGENCE WITH BI/DW COMPLIANCE
NIST CYBERSECURITY FRAMEWORK COMPLIANCE WITH OBSERVEIT
NIST CYBERSECURITY FRAMEWORK COMPLIANCE WITH OBSERVEIT OVERVIEW The National Institute of Standards of Technology Framework for Improving Critical Infrastructure Cybersecurity (The NIST Framework) is a
Use Cases for Argonaut Project. Version 1.1
Page 1 Use Cases for Argonaut Project Version 1.1 July 31, 2015 Page 2 Revision History Date Version Number Summary of Changes 7/31/15 V 1.1 Modifications to use case 5, responsive to needs for clarification
PHI Air Medical, L.L.C. Compliance Plan
Page No. 1 of 13 Introduction: The PHI Air Medical, L.L.C. is to be used by employees, contractors and vendors to get a high level understanding of the key regulatory requirements relating to our participation
ENERGY SECTOR CYBERSECURITY FRAMEWORK IMPLEMENTATION GUIDANCE
ENERGY SECTOR CYBERSECURITY FRAMEWORK IMPLEMENTATION GUIDANCE JANUARY 2015 U.S. DEPARTMENT OF ENERGY OFFICE OF ELECTRICITY DELIVERY AND ENERGY RELIABILITY Energy Sector Cybersecurity Framework Implementation
SECURITY RISK MANAGEMENT
SECURITY RISK MANAGEMENT ISACA Atlanta Chapter, Geek Week August 20, 2013 Scott Ritchie, Manager, HA&W Information Assurance Services Scott Ritchie CISSP, CISA, PCI QSA, ISO 27001 Auditor Manager, HA&W
DOYLESTOWN FAMILY MEDICINE, P.C. IDENTITY THEFT PREVENTION PROGRAM TEMPLATE ADOPTED AND EFFECTIVE: APRIL 15, 2009 UPDATED:
DOYLESTOWN FAMILY MEDICINE, P.C. IDENTITY THEFT PREVENTION PROGRAM TEMPLATE ADOPTED AND EFFECTIVE: APRIL 15, 2009 UPDATED: I. Adoption of Identity Theft Prevention Program Doylestown Family Medicine, P.C.
U.S. DEPARTMENT OF COMMERCE UNITED STATES PATENT AND TRADEMARK OFFICE. Privacy Impact Assessment
U.S. DEPARTMENT OF COMMERCE UNITED STATES PATENT AND TRADEMARK OFFICE Privacy Impact Assessment Enterprise Software Services PTOI-020-00 July 8, 2015 Privacy Impact Assessment This Privacy Impact Assessment
CDC UNIFIED PROCESS PRACTICES GUIDE
Purpose The purpose of this document is to provide guidance on the practice of Modeling and to describe the practice overview, requirements, best practices, activities, and key terms related to these requirements.
Identity: The Key to the Future of Healthcare
Identity: The Key to the Future of Healthcare Chief Medical Officer Anakam Identity Services July 14, 2011 Why is Health Information Technology Critical? Avoids medical errors. Up to 98,000 avoidable hospital
Best Practices in Identity and Access Management (I&AM) for Regulatory Compliance. RSA Security and Accenture February 26, 2004 9:00 AM
Best Practices in Identity and Access Management (I&AM) for Regulatory Compliance RSA Security and Accenture February 26, 2004 9:00 AM Agenda Laura Robinson, Industry Analyst, RSA Security Definition of
Federal Trade Commission Privacy Impact Assessment. for the: Analytics Consulting LLC Claims Management System and Online Claim Submission Website
Federal Trade Commission Privacy Impact Assessment for the: Analytics Consulting LLC Claims Management System and Online Claim Submission Website January 2015 Page 1 of 14 1 System Overview The Federal
Lessons Learned in Security Measurement. Nadya Bartol & Brian Bates Booz Allen Hamilton
Lessons Learned in Security Measurement Nadya Bartol & Brian Bates Booz Allen Hamilton Contents Overview Lessons Learned Case Studies Summary Reasons Behind Security Metrics Information security measurement
The Impact of HIPAA and HITECH
The Health Insurance Portability & Accountability Act (HIPAA), enacted 8/21/96, was created to protect the use, storage and transmission of patients healthcare information. This protects all forms of patients
PRIVACY IMPACT ASSESSMENT (PIA) For the
PRIVACY IMPACT ASSESSMENT (PIA) For the Integrated Visual and Auditory Continuous Performance Test (IVA-AE) US Army Medical Command - Defense Health Program (DHP) Funded Application SECTION 1: IS A PIA
DISCLAIMER HEALTH INFORMATION PRIVACY POLICIES & PROCEDURES
DISCLAIMER This web site is provided for information and education purposes only. No doctor/patient relationship is established by your use of this site. No diagnosis or treatment is being provided. The
Partnering for Project Success: Project Manager and Business Analyst Collaboration
Partnering for Project Success: Project Manager and Business Analyst Collaboration By Barbara Carkenord, CBAP, Chris Cartwright, PMP, Robin Grace, CBAP, Larry Goldsmith, PMP, Elizabeth Larson, PMP, CBAP,
Digital Signatures The Law and Best Practices for Compliance. January 2014
Digital Signatures The Law and Best Practices for Compliance January 2014 Electronic/Digital Signature Legislation Disclaimer: ARX is not is not a law firm and does not provide legal advice. We make no
Nonprofit Data Management Checklist
Nonprofit Data Management Checklist The integration of cross-functional data and application of business intelligence will soon be a practice of not only the most strategic nonprofits, but of any nonprofit
[FACILITY NAME] IDENTITY THEFT PREVENTION PROGRAM. Effective May 1, 2009
![[FACILITY NAME] IDENTITY THEFT PREVENTION PROGRAM. Effective May 1, 2009](/thumbs/29/13346234.jpg "[FACILITY NAME] IDENTITY THEFT PREVENTION PROGRAM. Effective May 1, 2009")
[FACILITY NAME] IDENTITY THEFT PREVENTION PROGRAM Effective May 1, 2009 Because [FACILITY NAME] offers and maintains covered accounts, as defined by 16 C.F.R. Part 681 (the Regulations ), [FACILITY NAME]
Using DeployR to Solve the R Integration Problem
DEPLOYR WHITE PAPER Using DeployR to olve the R Integration Problem By the Revolution Analytics DeployR Team March 2015 Introduction Organizations use analytics to empower decision making, often in real
OSAC Committees are as follows: Threats and Information Sharing; Country Council and Outreach; and Security Awareness and Innovation.
1. Contact Information Department of State Privacy Coordinator Margaret P. Grafeld Bureau of Administration Global Information Services Office of Information Programs and Services 2. System Information
PII Compliance Guidelines
Personally Identifiable Information (PII): Individually identifiable information from or about an individual customer including, but not limited to: (a) a first and last name or first initial and last
HEALTH INSURANCE PORTABILITY AND ACCOUNTABILITY ACT (HIPAA): FACT SHEET FOR NEUROPSYCHOLOGISTS Division 40, American Psychological Association
HEALTH INSURANCE PORTABILITY AND ACCOUNTABILITY ACT (HIPAA): FACT SHEET FOR NEUROPSYCHOLOGISTS Division 40, American Psychological Association DISCLAIMER This general information fact sheet is made available
PRIVACY IMPACT ASSESSMENT (PIA) For the
PRIVACY IMPACT ASSESSMENT (PIA) For the Assistance Reporting Tool (ART) Defense Health Agency (DHA) SECTION 1: IS A PIA REQUIRED? a. Will this Department of Defense (DoD) information system or electronic
Department of Veterans Affairs VA DIRECTIVE 6510 VA IDENTITY AND ACCESS MANAGEMENT
Department of Veterans Affairs VA DIRECTIVE 6510 Washington, DC 20420 Transmittal Sheet VA IDENTITY AND ACCESS MANAGEMENT 1. REASON FOR ISSUE: This Directive defines the policy and responsibilities to
Systems Development Life Cycle (SDLC)
DEPARTMENT OF BUDGET & MANAGEMENT (SDLC) Volume 1 Introduction to the SDLC August 2006 Table of Contents Introduction... 3 Overview... 4 Page 2 of 17 INTRODUCTION 1.0 STRUCTURE The SDLC Manual consists
Automatic vs. Manual Code Analysis
Automatic vs. Manual Code Analysis 2009-11-17 Ari Kesäniemi Senior Security Architect Nixu Oy [email protected] Copyright The Foundation Permission is granted to copy, distribute and/or modify this
Requirements Management Database
Project Whitepaper Compliance with Pragmatic Marketing s That Work, LLC Project Whitepaper - Pragmatic Marketing's That Work Page 1 of 16 Introduction The Database has been designed for maximum flexibility
IT Security & Compliance. On Time. On Budget. On Demand.
IT Security & Compliance On Time. On Budget. On Demand. IT Security & Compliance Delivered as a Service For businesses today, managing IT security risk and meeting compliance requirements is paramount
Program Management: Opportunity or CLM?
Program Management: Opportunity or CLM? Agenda It s a game do you know the rules? So who wants to be a Program Manager? Definitions Check list for what it REALLY takes Questions 2 It s a game do you know
POLICY. on the Protection of Personal Data of Persons of Concern to UNHCR DATA PROTECTION POLICY
POLICY on the Protection of Personal Data of Persons of Concern to UNHCR DATA PROTECTION POLICY CONTENTS 2 DATA PROTECTION POLICY 1 GENERAL PROVISIONS... 6 1.1 Purpose... 7 1.2 Rationale... 7 1.3 Scope...
PRIVACY IMPACT ASSESSMENT (PIA) For the
PRIVACY IMPACT ASSESSMENT (PIA) For the Call Management System (Microlog ServiceFirst ) US Army Medical Command - Defense Health Program (DHP) Funded Application SECTION 1: IS A PIA REQUIRED? a. Will this
CLOUD COMPUTING ISSUES FOR SCHOOL DISTRICTS. Presented to the 2013 BRADLEY F. KIDDER LAW CONFERENCE. October 2, 2013
CLOUD COMPUTING ISSUES FOR SCHOOL DISTRICTS Presented to the 2013 BRADLEY F. KIDDER LAW CONFERENCE October 2, 2013 By: Diane M. Gorrow Soule, Leslie, Kidder, Sayward & Loughman, P.L.L.C. 220 Main Street
igrc: Intelligent Governance, Risk, and Compliance White Paper
igrc: Intelligent Governance, Risk, and Compliance White Paper 2013 2013 Edgile, Inc. All Rights Reserved Executive Overview This whitepaper discusses the business needs addressed by Edgile s igrc solution,
Information Security for Managers
Fiscal Year 2015 Information Security for Managers Introduction Information Security Overview Enterprise Performance Life Cycle Enterprise Performance Life Cycle and the Risk Management Framework Categorize
Computer Security Incident Response Plan. Date of Approval: 23- FEB- 2015
Name of Approver: Mary Ann Blair Date of Approval: 23- FEB- 2015 Date of Review: 22- FEB- 2015 Effective Date: 23- FEB- 2015 Name of Reviewer: John Lerchey Table of Contents Table of Contents... 2 Introduction...
White Paper. An Overview of the Kalido Data Governance Director Operationalizing Data Governance Programs Through Data Policy Management
White Paper An Overview of the Kalido Data Governance Director Operationalizing Data Governance Programs Through Data Policy Management Managing Data as an Enterprise Asset By setting up a structure of
Certificate Policies and Certification Practice Statements
Entrust White Paper Certificate Policies and Certification Practice Statements Author: Sharon Boeyen Date: February 1997 Version: 1.0 Copyright 2003 Entrust. All rights reserved. Certificate Policies and
Windows 2000 Active Directory Configuration Guide
Windows 2000 Active Directory Configuration Guide 24-4-2003 1 Windows 2000 Active Directory Configuration Guide Table of Contents Chapter 1 Introduction 2 1 About Metatude 2 2 About this manual 3 3 The
INTRODUCTION. The HIPAA Privacy Rule and Electronic Health Information Exchange in a Networked Environment
INTRODUCTION This guidance is composed of a series of fact sheets that clarify how the HIPAA Privacy Rule applies to, and can be used to help structure the privacy policies behind, electronic health information
Redhawk Network Security, LLC 62958 Layton Ave., Suite One, Bend, OR 97701 [email protected] 866-605- 6328 www.redhawksecurity.
Planning Guide for Penetration Testing John Pelley, CISSP, ISSAP, MBCI Long seen as a Payment Card Industry (PCI) best practice, penetration testing has become a requirement for PCI 3.1 effective July
Strategic Outcome- Based Metrics for the Federal Government
RG Perspective Strategic Outcome- Based Metrics for the Federal Government 11 Canal Center Plaza Alexandria, VA 22314 HQ 703-548-7006 Fax 703-684-5189 www.robbinsgioia.com 2013 Robbins Gioia, Inc. 1. Introduction
COMPLIANCE WITH LAWS AND REGULATIONS (CLR)
Principle: Ensuring compliance with applicable laws, regulations and professional standards of practice implementing systems and processes that prevent fraud and abuse. 91 Compliance with Laws and Regulations
A. SYSTEM DESCRIPTION
NOTE: The following reflects the information entered in the PIAMS website. A. SYSTEM DESCRIPTION Authority: Office of Management Budget (OMB) Memorandum (M) 03-22, OMB Guidance for Implementing the Privacy
Process Assessment and Improvement Approach
Process Assessment and Improvement Approach June 2008 The information contained in this document represents the current view of Virtify on the issues discussed as of the date of publication. Virtify cannot
Voice Over IP Network Solution Design, Testing, Integration and Implementation Program Overview
Voice Over IP Network Solution Design, Testing, Integration and Implementation Program Overview 1/1 Table of Contents 1. Introduction...3 2. Executive Summary...4 3. Program Definition...5 3.1. Program
Sarbanes-Oxley: Beyond. Using compliance requirements to boost business performance. An RIS White Paper Sponsored by:
Beyond Sarbanes-Oxley: Using compliance requirements to boost business performance The business regulatory environment in the United States has changed. Public companies have new obligations to report
CLOUD MIGRATION STRATEGIES
CLOUD MIGRATION STRATEGIES Faculty Contributor: Dr. Rahul De Student Contributors: Mayur Agrawal, Sudheender S Abstract This article identifies the common challenges that typical IT managers face while
Best Practices for DLP Implementation in Healthcare Organizations
Best Practices for DLP Implementation in Healthcare Organizations Healthcare organizations should follow 4 key stages when deploying data loss prevention solutions: 1) Understand Regulations and Technology
WHITE PAPER Mapping Organizational Roles & Responsibilities for Social Media Risk. A Hootsuite & Nexgate White Paper
WHITE PAPER Mapping Organizational Roles & Responsibilities for Social Media Risk A Hootsuite & Nexgate White Paper Mapping Organizational Roles & Responsibilities for Social Media Risk Executive Summary
GxP Process Management Software. White Paper: Ten Most Common Reasons for FDA 483 Observations and Warning Letter Citations
GxP Process Management Software : Ten Most Common Reasons for FDA 483 Observations and Warning Letter Citations Most FDA violations involve one of the following: Not having procedures in a regulated area
Health Sciences Compliance Plan
INDIANA UNIVERSITY Health Sciences Compliance Plan 12.18.2014 approved by University Clinical Affairs Council Table of Contents Health Sciences Compliance Plan I. INTRODUCTION... 2 II. SCOPE... 2 III.