MedWiki Usage & Conditions

IRT provides MedWiki (SUNet ID required) for secure collaboration and document sharing with Stanford School of Medicine groups. 

What your Team Can Do with MedWiki

• Easily store and share content and documents, with anyone with a SUNet ID, or, just with your work group
• Access content securely anytime from anywhere through a browser
• Securely store and share private documents and information
• Share, manage, and comment on information
• Easily make edits that update instantly
• Track every change or rollback to a previous version
• Find stored information quickly, unlike emails
• Limit access to pages and documents to specific people
• Store and share Moderate Risk Data, including Patient Health Information (PHI) as governed by HIPAA
•  

What Your Team Cannot Do with MedWiki

• Store or share Stanford High Risk Data (other than PHI), such as:
  • Social Security Numbers
  • Credit Card Numbers
  • Financial Account Numbers, such as checking or investment account numbers
  • Driver’s License Numbers
  • Health Insurance Policy ID Numbers
  • For more details, please see Secure Computing's Data Classification, Access, Transmittal and Storage page
• Fully public pages; a SUNet ID is required to view and edit
• Wikis restricted to all School of Medicine users, or a simple group like a department

Primary Administrators are required to:

• Ensure that only HIPAA-trained users have access to wikis containing PHI
• Inform new users of their responsibilities under HIPAA (you can send them the URL of this page, plus any additional instructions needed)
• Monitor activity in the wiki to ensure it is used in a HIPAA-compliant manner; quickly report any suspected problem or breach
• Assist users to restrict access to pages and attachments so a minimal number of approved users have access to PHI
• Ensure that users who have left the group associated with the wiki are removed from access in a timely manner.

Responsibilities

Primary Administrators have responsibilities in addition to those of MedWiki users. A Primary Administrators is:

• Administrator of the wiki, providing access to new users and removing access for users who leave the organization.
• Responsible for ensuring the wiki s used in compliance with HIPAA.
• The primary contact for the wiki.

How to Become a Primary Administrators

• To become a Primary Administrators for an existing wiki, request access via the Web Help form, and indicate you will be a Primary Administrators for the wiki; please provide the wiki space name or URL, and your supervisor's name and contact information, in case we need to validate your authority for this role
• To become a Primary Administrators of a new wiki, request the new wiki and indicate you will be the Primary Administrators

Primary Administrators Role 

Review requests for access to the MedWiki space for appropriateness, and manage users in and out of the space in a timely manner. 

• Be a primary contact for the wiki.
  • Web Help will forward access requests to you.
  • Publicize the existence of the space to your group's appropriate members.
  • Answer basic questions about how to do things, refer users to training materials, and forward requests you can't resolve yourself to Web Help.
• Monitor HIPAA compliance for the space

Additional Primary Administrators

• Several Primary Administrators can share the duty of administering users
• It should be a small group, ideally less than five per wiki
• All should be qualified (see above) to be a Primary Administrators
• Contact Web Help to request the addition of new Primary Administrators

Things a Primary Administrators Should Not Do

Add new administrators to the control workgroup using Workgroup Manager; IRT must record all space administrators to ensure compliance -- request addition of new admins via the Web Help form.

MedWiki is safe for both Low and Moderate Risk Data, as well as PHI. 

Important Note

MedWiki enables HIPAA compliance; it does not guarantee it. It is the responsibility of all wiki users to use MedWiki in a HIPAA-compliant manner.

To learn more about Low, Moderate and High Risk Data please see the Stanford document Data Classification, Access, Transmittal and Storage. 

Use of MedWiki is governed by Stanford Medicine Web Policies and Design Standards, including Privacy and Security, and HIPAA.

The Health Insurance Portability and Accountability Act (HIPAA) governs the collection, storage, use and destruction of patient health records. The most relevant sections of HIPAA, in relation to MedWiki, are the Privacy Rule and the Security Rule. The Privacy Rule mandates patients' access to their own records and an accounting of every person who has accessed the records in the previous six years. The Security Rule mandates that records must be stored and served securely, and that access only occur as necessary.

• A SUNet ID is required to view and edit in MedWiki
• Some MedWiki spaces can be viewed and edited by anyone with an ID, including:
  • The Dashboard
  • Everyone: MedWiki Help & Training
  • Everyone: Practice Space
• MedWiki's main users are faculty, staff and students of the School of Medicine, and the Stanford people who collaborate with them
• If your wiki contains PHI, all wiki members must have appropriate HIPAA training; check with the Primary Author for the space if you are not sure if you have the right training.

• Know what type of information you are storing and whether it is Low, Moderate, or High Risk (see the Stanford document Data Classification, Access, Transmittal and Storage)
• Do not store High Risk data, other than PHI,  in any wiki (examples include, but are not limited to, credit card information and social security numbers)
• You should not use MedWiki for PHI unless you have received basic HIPAA training as mandated by Stanford; ask your supervisor or department administrator what kinds of training are required for your position
• Understand the specific policies and procedures that apply to your use of MedWiki; if your wiki will contain PHI, consult with the IRB compliance officer, or HIPAA compliance officer for your unit
• All computers used to interact with wikis containing PHI should be secured and free of viruses.
• Make the least possible use of PHI to accomplish your purpose; restrict access to users who need it
• Don't exchange documents or text containing PHI via regular email; email is not secure without extra steps to encrypt it
• Make sure all documents containing PHI are properly secured on your local computer, before and after uploading to MedWiki

How to Manage Users

• Log into Workgroup Manager using your SUNet ID and password
• Click the name of the workgroup associated with your MedWiki space.
  • It will take the form "med-intranet:wikispacekey," where "wikispacekey" is you're wiki's home URL, i.e. http://medwiki.stanford.edu/display/wikispacekey
• Use the Workgroup Manager interface to add and remove users on the Members tab.
• After you have added new members, you or someone else who is already a member, needs to do a fresh login to your wiki making sure you pass thru WebAUTH (easiest is to open in a new browser or incognito window).  This action adds the new users to your wiki.  Wait 5-10 minutes before sending users the MedWiki link to ensure they have been added.
• If users report access problems, ask them to wait a few minutes, quit from the browser they have been using to view MedWiki, then try again; if they still can't get in, contact Web Help.