University of Arkansas for Medical Sciences - Operating Policy

Access to computer systems and proprietary data (including, but not limited to, research, patient, student, and employee data), is determined by the job responsibilities of the individual seeking access and is to be controlled and monitored through management oversight and identification authentication practices. Access to computer information systems is to be controlled at a minimum, by the use of individualized and confidential user sign-on/password codes.

Federal and state laws addressing confidentiality of data as well as the policies and regulations of oversight and accreditation agencies will be observed. It is the responsibility of managers and educators to ensure that staff and students are adequately informed about relevant laws and regulations.

Commitment of Confidentiality
UAMS staff, employees, students, contracted personnel, and other agents of UAMS who will have access to confidential information through normal job functions or use of UAMS systems, will be issued confidential and individualized sign-on codes and must sign a Confidentiality Agreement which acknowledges their commitment to protect and maintain the confidentiality of the following:

• their sign-on code,
• all patient, employee, and student information, and
• all proprietary information to which they have access in the course of their work.

When users sign the Confidentiality Agreement they attest that they understand the consequences of violating the agreement.

Consequences of Violation of Confidentiality
The consequences of violating the confidentiality of patient, student, employee or research data, a user sign-on code, or other UAMS proprietary data may result in discipline up to and including immediate termination. Violation of confidentiality may also create civil and criminal liability.

Monitoring Access to Patient and Other Confidential Data
UAMS departments which support computer information systems will monitor use of the systems and will report access or confidentiality violations immediately to the appropriate manager and to the Chairman of the appropriate Steering Committee. All staff and employees are responsible for immediately reporting any apparent violations of this confidentiality policy to their Managers for action.