Wiki @ Stanford Medicine

Wiki for PHI

We also offer a secure instance of Wiki to allow PHI safe collaboration.  

Important Note

Do not store Protected Health Information (PHI) or any other High Risk Data in MedWiki; Stanford Moderate Risk Data can only be stored in MedWiki-Secure. MedWiki-Secure enables HIPAA compliance; it does not guarantee it. It is the responsibility of all wiki users to use MedWiki in a HIPAA-compliant manner.

To learn more about Low, Moderate and Hight Risk Data please see the Stanford document Data Classification, Access, Transmittal and Storage. 

Use of MedWiki and MedWiki-Secure is governed by Stanford Medicine Web Policies and Design Standards, including Privacy and Security, and HIPAA.

The Health Insurance Portability and Accountability Act (HIPAA) governs the collection, storage, use and destruction of patient health records. The most relevant sections of HIPAA, in relation to MedWiki, are the Privacy Rule and the Security Rule. The Privacy Rule mandates patients' access to their own records and an accounting of every person who has accessed the records in the previous six years. The Security Rule mandates that records must be stored and served securely, and that access only occur as necessary.

• Know what type of information you are storing and whether it is Restricted or Confidential (see the Stanford document Data Classification, Access, Transmittal and Storage)
• Do not store Prohibited information in any wiki
• Do not store Restricted information in MedWiki; it can only be stored in MedWiki-Secure
• You should not use MedWiki-Secure for PHI unless you have received basic HIPAA training as mandated by Stanford; ask your supervisor or department administrator what kinds of training are required for your position
• Understand the specific policies and procedures that apply to your use of MedWiki-Secure; if your wiki will contain PHI, consult with the IRB compliance officer, or HIPAA compliance officer for your unit
• All computers used to interact with wikis containing PHI should be secured and free of viruses.
• Make the least possible use of PHI to accomplish your purpose; restrict access to users who need it
• Don't exchange documents or text containing PHI via regular email; email is not secure without extra steps to encrypt it
• Make sure all documents containing PHI are properly secured on your local computer, before and after uploading to MedWiki
• To connect with MedWiki-Secure from off-campus, you must use VPN

In addition to the above responsibilities, Primary Authors are required to:

• Ensure that only HIPAA-trained users have access to wikis containing PHI
• Inform new users of their responsibilities under HIPAA (you can send them the URL of this page, plus any additional instructions needed)
• Monitor activity in the wiki to ensure it is used in a HIPAA-compliant manner; quickly report any suspected problem or breach
• Assist users to restrict access to pages and attachments so a minimal number of approved users have access to PHI
• Ensure that users who have left the group associated with the wiki are removed from access in a timely manner.

Responsibilities

Primary Authors have responsibilities in addition to those of MedWiki and MedWiki-Secure users. A Primary Author is:

• Administrator of the wiki, providing access to new users and removing access for users who leave the organization.
• Responsible for ensuring the wiki s used in compliance with HIPAA.
• Will be the primary contact for the wiki.

How to Become a Primary Author

• To become a Primary Author for an existing wiki, request access via the Web Help form, and indicate you will be a Primary Author for the wiki; please provide the wiki space name or URL, and your supervisor's name and contact information, in case we need to validate your authority for this role
• To become a Primary Author of a new wiki, request the new wiki and indicate you will be the Primary Author

Primary Author Role 

Review requests for access to the MedWiki or MedWiki-Secure space for appropriateness, and manage users in and out of the space in a timely manner. 

• Be a primary contact for the wiki.
  • Web Help will forward access requests to you.
  • Publicize the existence of the space to your group's appropriate members.
  • Answer basic questions about how to do things, refer users to training materials, and forward requests you can't resolve yourself to Web Help.
• Monitor HIPAA compliance for the space; no PHI should be stored in MedWiki, only in MedWiki-Secure
• In MedWiki-Secure, ensure that users have received basic HIPAA training, and any additional training appropriate for the specific uses of PHI in the space in question

Additional Primary Authors

• Several Primary Authors can share the duty of administering users
• It should be a small group, ideally less than five per wiki
• All should be qualified (see above) to be a Primary Author
• Contact Web Help to request the addition of new Primary Authors

Things a Primary Author Should Not Do

• Add new administrators to the control workgroup using Workgroup Manager; IRT must record all space administrators to ensure compliance -- request addition of new admins via the Web Help form.

How to Manage Users:

• Log into Workgroup Manager using your SUNet ID and password
• Click the name of the workgroup associated with your MedWiki space.
  • It will take the form "med-intranet:wikispacekey," where "wikispacekey" is you're wiki's home URL, i.e. http://medwiki.stanford.edu/display/wikispacekey
• Use the Workgroup Manager interface to add and remove users.
• Wait 5-10 minutes before sending users the MedWiki link.
• If users report access problems, ask them to wait a few minutes, quit from the browser they have been using to view MedWiki, then try again; if they still can't get in, contact Web Help.

IRT provides MedWiki (SUNet ID required) and MedWiki-Secure (members only) for secure collaboration and document sharing with Stanford School of Medicine groups. 

What your Team Can Do with MedWiki

• Easily store and share content and documents, with anyone with a SUNet ID, or, just with your work group
• Access content securely anytime from anywhere through a browser
• Securely store and share private documents and information
• Share, manage, and comment on information
• Easily make edits that update instantly
• Track every change or rollback to a previous version
• Find stored information quickly, unlike emails
• Limit access to pages and documents to specific people

What your Team Can Do with MedWiki-Secure

• Store and share Moderate Risk Data, including Patient Health Information (PHI) as governed by HIPAA

What Your Team Cannot Do with MedWiki or MedWiki-Secure

• Store or share Stanford High Risk Data, such as:
  • Social Security Numbers
  • Credit Card Numbers
  • Financial Account Numbers, such as checking or investment account numbers
  • Driver’s License Numbers
  • Health Insurance Policy ID Numbers
  • For more details, please see Secure Computing's Data Classification, Access, Transmittal and Storage page
• MedWiki-Secure can't be reached from off-campus without VPN
• Fully public pages; a SUNet ID is required to view and edit
• Wikis restricted to all School of Medicine users, or a simple group like a department

Qualifications for Using MedWiki

• A SUNet ID is required to view and edit in MedWiki
• Some MedWiki spaces can be viewed and edited by anyone with an ID, including:
  • The Dashboard
  • Everyone: MedWiki Help & Training
  • Everyone: Practice Space
• MedWiki's main users are faculty, staff and students of the School of Medicine, and the Stanford people who collaborate with them

Qualifications for using MedWiki-Secure

• A SUNet ID is required to view and edit in MedWiki-Secure
• All wiki members must have appropriate HIPAA training; check with the Primary Author for the space if you are not sure if you have the right training.