Subpart C. Security Standards for the Protection of Electronic Protected Health Information

Subparagraphs and sections of
§ 164.308, Administrative safeguards (HIPAA security rule)

Netwrix Auditor capabilities:

• Enables auditing of IT changes, access attempts, and historic and current system configuration states across multiple IT systems.
• Facilitates change management, reviewing and monitoring via a change review history reporting mechanism (this mechanism should supplement internal control policies and procedures).
• Delivers auditing of disabled accounts. Provides automated de-provisioning of inactive user accounts and automated disabling and removal of such accounts.
• Provides auditing of files and folders and their permissions across the entire IT infrastructure to enable early detection of unauthorized changes to security access settings (granting of new permissions, changes of user access rights, etc.) and ensure the adequacy of technical controls.
• Enables auditing of all password changes. Provides self-service password management for end users with customizable password security settings and secure access based on user identity verification.
• Provides a mechanism for quick rollback of unauthorized and accidental changes to Active Directory objects, including restores of deleted objects without the need to reboot a domain controller.
• Ensures consolidation and archiving of audit trails. Keeps audit data secure for as long as needed, while enabling continued quick access to it.

Subparagraphs and sections of
§ 164.312, Technical safeguards (HIPAA security rule)

Netwrix Auditor capabilities:

• Detects and reports on all changes in IT systems where electronic protected health information (ePHI) can be created, held at rest or transmitted.
• Delivers information in predefined and custom reports that cover all major types of activities across the entire IT infrastructure.
• Provides the who, what, when and where details for each change or access event, along with the before and after values.
• Detects and reports on user access attempts to safeguarded resources holding ePHI.
• Tracks and reports on user account logons and logoffs.

Subparagraphs and sections of
§ 164.316, Policies and procedures and documentation requirements (HIPAA security rule)

Netwrix Auditor capabilities:

• Enables comparison of the current state of an IT system to its historic configurations or the baseline configuration.
• Delivers consolidation and archiving of audit trails, and keeps audit data secure for as long as needed, while enabling quick access to it.
• Includes scheduled reports, real-time alerts and interactive search that help you stay current on all security incidents and help with early detection of HIPAA compliance violations.

Subpart E. Privacy of Individually Identifiable Health Information

Subparagraphs and sections of
§ 164.528, Accounting of disclosures of protected health information (HIPAA privacy rule)

Netwrix Auditor capabilities:

• Holds records of all activities for 10 years or longer in a reliable two-tiered storage system, enabling you to reconstruct all activities and access attempts related to ePHI upon request.