1. MITA Access Controls Initiative Goals of the initiative –Provide a more common set of access controls across all systems Systems currently have elements of this as part of HIPAA feature if they are enabled by the site Activation per regulatory requirements –Help to avoid excessive radiation events by providing ability for enhanced protocol change control –Provide data to sites for QA –MITA working towards a standard

2. Basics The system shall support the establishment of various access/authorization levels that can be assigned to users by the facility. –“Authorized users” and “super users”. Others? Interlock to preclude the operation of CT equipment without entry of an authorized user. –The “operator of record” shall be recorded for each exam. Interlock to preclude establishing or saving a protocol unless the operator has been assigned to have “super user” authorization. –The system shall record the operator of record and the protocol identifier including the CT conditions of operation of the changes. –Only “Super users” can identify “authorized users” Interlock to preclude clinical operation of CT equipment without entry of a patient identifier. –Provision made to allow scanning for trauma cases or other cases where the patient identifier may not be known.

3. Logon/Screen Lock Initial login by authorized user required at boot up. Ability to lock the interface without loss of system state. –However if the scan was in the confirmed/go/load status, this status shall not be maintained (i.e. system is no longer “armed” or in ready state). –Lock accomplished by an inactivity timer and by user command. Timer duration shall be able to be set by a super user Feedback requested on appropriate range for timeout duration Any authorized user shall be able to unlock the interface and become the operator of record.

4. Next steps MITA will be reaching out to the impacted Stakeholders and invite representatives to participate in the development of this initiative.