Instructions for Revalidation of Users of LCU Reporting November 2014 Harvard Pilgrim Health Care Page 1
Table of Contents Overview..3 Account Revalidation email. 4 How to Revalidate Users of LCU Reporting.. 5 Harvard Pilgrim Health Care Page 2
Overview Introduction Role of Data Access Liaison Account Revalidation Time Frame The Health Insurance Portability and Accountability Act (HIPAA) and other state and federal regulations require robust user access controls and processes for users who have access to protected health information (PHI). Regular validation of user account access is a key process in safeguarding PHI. Account revalidation is a regular review of user accounts to ensure that access is limited to only those functions which are needed to accomplish the user s job. The Data Access Liaison will perform an annual revalidation of all user accounts from their provider organization attached to an online account in HPHConnect for providers or accessing the HPHC secure server. Delete user accounts for all those who no longer require access (i.e., any users who have changed positions or who have left the organization) Validate that any remaining user accounts have been attached to the correct roles and LCU reporting resources The annual account revalidation process should be completed within a 30-day timeframe. Failure to complete account revalidation by the due date will result in lock-out of provider access to HPHConnect for all users attached to the account. The following details the revalidation activity that will occur. Send Date Due Date Send Date +1 wk Late Notice Send Date +2 wks Overdue Notice Send Date +3 wks Lock Out Date Send Date +4 wks HPHC Provider Analytics will send an email notice and revalidation tool to the Data Access Liaison The Data Access Liaison completes the revalidation of users from their provider organization within one week (adds/deletes/modifies users and their access to specific reports and extracts). HPHC Provider Analytics, HPHC Provider Analytics will send a friendly reminder email to the Data Access Liaison. HPHC Provider Analytics, HPHC Network Contracting will reach out to the counterpart in provider organization to determine reason for delay and to identify submission date. HPHC Provider Analytics, all user access to LCU Reporting on HPHConnect will be locked. Harvard Pilgrim Health Care Page 3
Sample email The following is a sample of the notification email that HPHC Provider Analytics will send to the Data Access Liaison prior to the annual account validation due date: Dear [Data Access Liaison], You are receiving this notification as a reminder that the annual Account Revalidation of LCU Reporting Users (via HPHConnect or Secure Server) is now underway. We have supplied an easy-to-use validation tool, with appropriate pick lists for indicating changes. We ask that you return this to HPHC within 1 week. Account Revalidation is a regular review of user accounts by the Data Access Liaison. Using the attached spreadsheet, you should review all active users for whom you are the Data Access Liaison to ensure that access is limited to only those LCU Reporting Resources which are needed to accomplish the user's job. This is done by confirming the role each user has is appropriate for their job. You should also identify and delete any users who have the left the organization or who no longer require access to HPHConnect. The Account Revalidation policy and instructions for completing the Account Revalidation process are located in the Provider Manual and are also posted on www.harvardpilgrim.org/lcureporting. If you have any questions regarding this process please contact HPHC Provider Analytics at HPHC_Provide_Analytics@HarvardPilgrim.org Sincerely, Provider Analytics Harvard Pilgrim Health Care Harvard Pilgrim Health Care Page 4
How to Revalidate Users of HPHConnect LCU Reporting Step Action 1 Review the spreadsheet sent by HPHC Provider Analytics. This spreadsheet contains the most current information from the user database. 2 The spreadsheet is pre-populated to display for each user within the provider organization: Name of Provider Organization Name of User to be revalidated Their role/title email HPHConnect User ID Flag if the person is the Data Access Liaison Revalidation date Revalidation of User Status The data access liaison should make corrections to this information, as necessary. Resources for access (pre-populated with Y for current access) 1. LCU Reporting (pdf output reports) 2. Provider Analytics Interactive Dashboard [PAID] 3. Provider Analytics Self Service [PASS] 4. Quality Measures Reporting [QMR] 5. Authorizations & Notifications [ANR] 6. IP Discharge [IPDC] 7. IP Census [IPC] 8. Care Management/Disease Management Participation [CMDM] 9. SFTP Claims Downloads 10. SFTP HEDIS Quality Extracts The spreadsheet contains a pick list for user access for each of these reports Y (the default for the user with this access) 1=Add access for this user to this report 0=Remove access for this user to this report 3 Sample Spreadsheet 4 When completed, return the form to: HPHC_Provider_Analytics@HarvardPilgrim.org Harvard Pilgrim Health Care Page 5