R.C.S.A. § 21a-244a-4

A hospital, in establishing the policy required by section 21a-244a-3 of the Regulations of Connecticut State Agencies, shall include: (1) a description of the electronic data processing system being used by the hospital to create and maintain records. This description shall include at least the following information: (A) the specific types of drug records being maintained electronically on the system; and (B) the hospital's patient populations and physical locations for which the electronic drug record system is being utilized; (2) the specific types of electronic identifiers, including but not limited to those listed in section 21a-244a(c) of the Connecticut General Statutes, that are utilized to access the hospital's electronic system, or used in place of written signatures or initials where required. All electronic identifiers described in the system shall be unique to an individual and shall be controlled in a secure manner; (3) the manner in which access to the electronic drug record system is controlled. This shall, at a minimum, include: (A) a description of the general levels of access into the system; and (B) the mechanism by which the hospital identifies all individuals having access to the electronic system, their level of access and a description of how this access data is maintained by the hospital; (4) the method by which individual electronic identifiers allowing access to the system are issued, maintained and terminated. This shall include, at a minimum, the following information: (A) the specific individual or group at the hospital responsible for issuing, maintaining or terminating electronic identifiers; (B) the procedure by which electronic identifiers are issued, maintained and terminated; and (C) the method by which the uniqueness of electronic identifiers is established and their security maintained; (5) the system by which electronic drug records are stored on-line, archived or maintained in some other manner that ensures that they are readily retrievable for a period of not less than three years; (6) the recovery procedure utilized to reconstruct electronic drug records in the event the system experiences unscheduled downtime; (7) the procedure utilized to routinely backup data stored on the electronic system to prevent the loss or destruction of electronic drug records; (8) the method employed to prevent or detect unauthorized alteration or erasure of electronic drug records maintained on the system; and (9) the procedure employed to ensure that all information contained in electronic drug records that is deemed to be confidential is appropriately protected from unauthorized access and dissemination. Such confidential information shall, at a minimum, include the names of patients and prescribing practitioners. The electronic data processing system shall comply with all federal and state statutes and regulations pertaining to the confidentiality of patient drug records.