21 CFR 1311.215 - Internal audit trail.

§ 1311.215 Internal audit trail.
(a) The pharmacy application provider must establish and implement a list of auditable events. The auditable events must, at a minimum, include the following:
(1) Attempted unauthorized access to the pharmacy application, or successful unauthorized access to the pharmacy application where the determination of such is feasible.
(2) Attempted or successful unauthorized modification or destruction of any information or records required by this part, or successful unauthorized modification or destruction of any information or records required by this part where the determination of such is feasible.
(3) Interference with application operations of the pharmacy application.
(4) Any setting of or change to logical access controls related to the dispensing of controlled substance prescriptions.
(5) Attempted or successful interference with audit trail functions.
(6) For application service providers, attempted or successful annotation, alteration, or destruction of controlled substance prescriptions or logical access controls related to controlled substance prescriptions by any agent or employee of the application service provider.
(b) The pharmacy application must analyze the audit trail at least once every calendar day and generate an incident report that identifies each auditable event.
(c) The pharmacy must determine whether any identified auditable event represents a security incident that compromised or could have compromised the integrity of the prescription records. Any such incidents must be reported to the pharmacy application service provider, if applicable, and the Administration within one business day.

Title 21 published on 2013-04-01

no entries appear in the Federal Register after this date.

This is a list of United States Code sections, Statutes at Large, Public Laws, and Presidential Documents, which provide rulemaking authority for this CFR Part.

This list is taken from the Parallel Table of Authorities and Rules provided by GPO [Government Printing Office].

It is not guaranteed to be accurate or up-to-date, though we do refresh the database weekly. More limitations on accuracy are described at the GPO site.


United States Code