Is iKnowMed (McKesson Oncology EHR) HIPAA Compliant? A Practical Compliance Checklist

HIPAA Regulatory Overview

What “HIPAA compliant” means for an EHR

HIPAA compliance is an organizational outcome, not a product label. iKnowMed can support your program, but you must configure, manage, and monitor it to satisfy the HIPAA Privacy Rule and HIPAA Security Rule. Treat the EHR as one control within a broader administrative, physical, and technical safeguards framework.

Key requirements to cover

• Privacy governance: define permissible uses/disclosures of PHI, apply the minimum necessary standard, and document role-based access to oncology workflows.
• Security safeguards: implement access controls, unique IDs, secure authentication, automatic logoff, and healthcare data encryption for ePHI in transit and at rest.
• Breach readiness: maintain incident response and breach notification procedures, including timelines, evidence preservation, and patient communication plans.
• Business Associate Agreement: execute and retain a current BAA with the vendor covering iKnowMed hosting, support, and integrations.

ONC-ACB Certification Compliance

Why ONC-ACB Certification matters

ONC-ACB Certification confirms that an EHR meets federally recognized functionality, interoperability, and certain security criteria. While it does not equal HIPAA compliance, it indicates that iKnowMed implements baseline capabilities—such as access control, audit logging, and secure exchange—that you can map to your HIPAA controls.

What to verify and retain

• Obtain the official ONC-ACB Certification documentation and certification ID for your iKnowMed version and deployment model.
• Confirm certified capabilities relevant to security (for example, authentication, audit reports, and secure transport) are enabled in your environment.
• Validate that your build, add-ons, and interfaces match what was certified; document any variance and compensating controls.
• Store certificates, scope statements, and vendor attestations in your compliance repository and tie them to policy and procedure references.

E-Prescribing Security Standards

Baseline e-prescribing security

Require end-to-end protections that align with e-prescribing security good practices: strong user authentication, role-based authorization, message integrity, and transport-layer encryption. Ensure network connections use modern TLS and that prescription data is logged with tamper-evident audit controls.

EPCS (controlled substances) and network attestations

• Identity proofing and access governance: verify identity vetting, logical access approvals, and ongoing re-certification for prescribers.
• Multifactor authentication: enforce two different factors for signing controlled substance prescriptions.
• System and process audits: schedule periodic EPCS audits and reconcile prescribing logs against pharmacy network records.
• Surescripts Certification: request current Surescripts Certification evidence for your iKnowMed connection and retain it alongside EPCS audit reports.

Secure Mobile Access in iKnowMed

Controls to demand for mobile workflows

• Strong authentication: require SSO with MFA, short session lifetimes, and step-up authentication for sensitive actions.
• Device security: allow access only from managed devices with MDM/EMM enforcement (disk encryption, screen lock, jailbreak/root detection, remote wipe).
• Data protection: prefer no local PHI storage; if caching is unavoidable, use encrypted containers with automatic purge and clipboard/screenshot controls.
• Network safeguards: mandate TLS 1.2+ with modern cipher suites and certificate validation; block access from unsecured networks where feasible.
• Operational oversight: enable detailed mobile access logs, geo/time-based restrictions, and rapid off-boarding for lost or retired devices.

Data Privacy and Patient Confidentiality

Design for the minimum necessary

• Role-based and attribute-based access: align iKnowMed roles with oncology-specific duties (infusion, radiation, financial counseling) to minimize over-privilege.
• Sensitive data handling: use break-glass workflows with justification, alerting, and retrospective review for restricted records.
• Use/disclosure controls: standardize release-of-information processes and document patient authorizations and restrictions within the EHR.
• De-identification and pseudonymization: configure exports and analytics to remove direct identifiers unless a treatment, payment, or operations purpose applies.

Risk Management and Audit Controls

Continuous risk management

• Risk analysis: inventory iKnowMed components, interfaces, and data flows; rank threats by likelihood/impact and select reasonable, documented safeguards.
• Vulnerability management: track vendor advisories, patch schedules, and compensating controls for any deferred updates.
• Resilience: test backups, disaster recovery, and emergency access procedures; verify encryption and key management for stored backups.

Proving due diligence with audit controls

• Comprehensive logging: capture user access, viewing, printing, exporting, e-prescribing events, and administrative changes with timestamps and user IDs.
• Log integrity and retention: protect logs from tampering and retain them according to policy and legal requirements.
• Active monitoring: automate alerts for anomalous access (after-hours spikes, mass record views, VIP snooping) and document investigations to closure.

Recommendations for Compliance Verification

Your practical compliance checklist

• Obtain and file the current BAA covering iKnowMed hosting, support, and integrations.
• Collect ONC-ACB Certification documentation and confirm your deployed version and modules match the certified scope.
• Request Surescripts Certification evidence and current EPCS audit reports; verify multifactor authentication and identity proofing are enforced.
• Configure access controls aligned to job roles; review and re-certify user access at least quarterly.
• Enable healthcare data encryption for data at rest and in transit across the full stack, including backups and interfaces.
• Turn on detailed audit controls and schedule routine access monitoring with documented follow-up.
• Harden mobile access with MDM, SSO + MFA, device posture checks, and strict session management.
• Run and document a formal HIPAA risk analysis for the iKnowMed environment; track remediation to completion.
• Validate third-party attestations (for example, relevant security reports) and map them to your controls, noting any gaps.
• Train workforce members on privacy and security procedures specific to your iKnowMed workflows.
• Test incident response, breach notification, and disaster recovery at least annually and after major changes.
• Maintain a living compliance binder: policies, procedures, diagrams, certifications, risk registers, training rosters, and audit evidence.

Conclusion

iKnowMed can support a HIPAA-compliant program when it is correctly configured, governed, and monitored. Use ONC-ACB Certification, Surescripts Certification, strong e-prescribing security, robust mobile safeguards, disciplined privacy practices, and verifiable audit controls to turn this practical checklist into defensible compliance.

FAQs.

What certifications demonstrate iKnowMed’s HIPAA compliance?

No single certification makes an EHR “HIPAA compliant,” but certain attestations support your evidence base. Ask for ONC-ACB Certification for the deployed version, Surescripts Certification for e-prescribing connectivity, relevant security attestations, and current EPCS audit reports. Map each item to HIPAA Privacy and Security Rule controls in your compliance binder.

How does iKnowMed secure mobile access to patient data?

Secure mobile access depends on your configuration. Require SSO with MFA, restrict use to managed and encrypted devices, enforce short session timeouts, and block local PHI storage where possible. Log mobile activity, enable remote wipe, and review access patterns regularly to detect and deter misuse.

Is e-prescribing in iKnowMed HIPAA compliant?

It can be operated in a HIPAA-aligned manner when you enforce e-prescribing security controls: identity proofing, multifactor authentication for EPCS, secure transport, message integrity, and complete audit trails. Confirm current network certifications and run periodic audits to verify controls are functioning as designed.

Where can I find official documentation on iKnowMed’s compliance status?

Request documentation directly from the vendor and retain it internally: the BAA, ONC-ACB Certification details, Surescripts Certification, EPCS audit reports, architecture and encryption overviews, and any available security attestations. Pair these with your own HIPAA risk analysis, policies, and audit evidence to demonstrate due diligence.