Question

write a policy for a cancer registry that relates to the security of secondary data

Answer 1

Ans) All registries that submit data to the National Program of Cancer Registries (NPCR) should have a security policy that is specific to the needs of the registry and the organization in which the registry operates. This includes registries that are a part of a larger public health department, a university, or an institution that provides information technology support for several programs. The security policy of the organization in which the registry operates must meet or be modified to accommodate the specific concerns of the cancer registry.

• CDC’s Division of Cancer Prevention and Control has compiled the following information in support of CDC’s NPCR to help cancer registries create or audit their current security policy. This information is not intended establish cancer registry security policy, but to guide cancer registries as they address security issues.

- Many NPCR programs are part of a larger public health department, university, or institution that provides technical support for several programs and usually has a security policy in place. Each NPCR program and its organization’s technical support staff are responsible for making cancer registry data secure. Both will devote time to security training and monitoring, and to reviewing and updating the security document.

- Designate a CTO: The first step is to identify or designate a person who works directly with the registry director to ensure data security. This person is often called the Chief Technology Officer (CTO), and is typically a senior information technology professional supporting the cancer registry.
- Find out if you have a security policy: Next, the registry should determine if a security policy has been written. If so, the CTO should review it and identify any needed updates. If not, the CTO should lead the development of a new policy specific to the needs of the registry.
- Develop a new security policy, if needed: The CTO will obtain existing institutional security documents and work with registry staff to develop a single security document detailing national, institutional, and NPCR security policies and standards.
- Execute the policy: Technical support and registry staff should work together to execute the security plan and enforce security policies.
Review and update the policy. At a minimum, the security document should be updated annually to include advances in technology and updates to prevailing standards.