We want to take digital signatures for our clinic consent forms. We've emailed our lawyer and he sent us back some things with the Ohio Revised Code. I'm having issue's with (B)2. Anyone had anything similar. Does this mean they want Laserfiche to have two-factor authentication? I can't believe that every e-sign in Ohio has 2 factor auth. I'm also not sure the Ohio Revised Code knows what they are talking about with this item as if you google "two-level access control mechanism electronic signature" you come up with the Ohio revised code and nothing else.
(B) All notes, orders, and observations entered into a health care record, including any interpretive reports of diagnostic tests or specific treatments, such as radiologic or electrocardiographic reports, operative reports, reports of pathologic examination of tissue, and similar reports, shall be authenticated by the individual who made or authorized the entry. An entry into a health care record may be authenticated by executing handwritten signatures or handwritten initials directly on the entry. An entry that is an electronic record may be authenticated by an electronic signature if all of the following apply:
- The entity responsible for creating and maintaining the health care record adopts a policy that permits the use of electronic signatures on electronic records.
- The entity's electronic signature system utilizes either a two-level access control mechanism that assigns a unique identifier to each user or a biometric access control device.
- The entity takes steps to safeguard against unauthorized access to the system and forgery of electronic signatures.
- The system includes a process to verify that the individual affixing the electronic signature has reviewed the contents of the entry and determined that the entry contains what that individual intended.
- The policy adopted by the entity pursuant to division (B)(1) of this section prescribes all of the following:
(a) A procedure by which each user of the system must certify in writing that the user will follow the confidentiality and security policies maintained by the entity for the system;
(b) Penalties for misusing the system;
(c) Training for all users of the system that includes an explanation of the appropriate use of the system and the consequences for not complying with the entity's confidentiality and security policies.