Q&A: EHR audit log retention
HIM Connection, February 2, 2010
Want to receive articles like this one in your inbox? Subscribe to HIM Connection!
Q. Does any regulation define the retention period for EHR or electronic medical record audit logs?
A. HIPAA requires that covered entities retain their HIPAA-related audit reports for a minimum of six years. In addition, the Health Information Technology for Economic and Clinical Health Act mandates that any disclosure from an EHR be included in an accounting of disclosures for the preceding three years.
However, this requirement will not become effective for all providers for at least a year. An audit log will help track access but will not necessarily include all of the information that HHS will require for the new accounting requirement.
Two schools of thought exist regarding retention requirements for audit logs following review and audit report finalization. Some believe providers should retain all audit logs—not just the corresponding reports—for a minimum of six years. Others hold that providers only need to retain audit logs for 60–90 days following finalization of the audit report, which would then be retained for six years. This is presumably long enough to complete the investigation of any anomalies in the report.
I believe in the latter school of thought. Longer retention of audit logs increases legal risk because they are discoverable.
It also means providers are saving large amounts of data that are highly likely to be inaccessible and unusable after a few years. In addition, no specific regulatory requirement or guidance indicates providers must retain audit logs for a minimum of six years.
Editor’s note: Chris Apgar, CISSP, president of Apgar & Associates, LLC, in Portland, OR, answered this question in the February issue of Briefings on HIPAA.
Want to receive articles like this one in your inbox? Subscribe to HIM Connection!
Related Products
-
Guide to HIPAA Auditing, Second Edition
This new edition of a best-selling book delivers the hands-on tools and guidance you need to conduct effective in-house...
-
The No-Hassle Guide to HIPAA Policies: A Privacy and Security Toolkit
HIPAA regulations require extensive documentation—likely more than you've done in the past. Changing the way you look...
-
The HIPAA and HITECH Toolkit
The HIPAA and HITECH Toolkit is a valuable resource that helps both CEs and BAs understand and meet the HITECH Act's...
-
HIPAA Handbook for Nutrition, Environmental Services, and Volunteer Staff:
Train all of your staff members with this handbook and others in the 2009 HIPAA Handbook Series. Ensure they understand...
-
HIPAA Handbook for Registration and Front Office Staff
Train all of your staff members with this handbook and others in the 2009 HIPAA Handbook Series. Ensure they understand...
Most Popular
- Articles
-
- HIPAA Q&A: Flu shot requirement for hospital employees
- HealthDataInsights posts new issues for medical necessity claims
- Running an effective peer review committee meeting
- Sneak Peek: Effort underway to establish caseload benchmarks
- New FAQ posted on storing laryngoscope blades
- Q&A: Incidental disclosures and patient privacy
- Tip: Perform your own internal investigation prior to government audit
- What does case-mix index mean to you?
- HIPAA 5010 deadline extended, but threat remains, says AMA
- HHS task force: Consider privacy, security with text messages
- E-mailed
-
- Running an effective peer review committee meeting
- HIPAA Q&A: Flu shot requirement for hospital employees
- What does case-mix index mean to you?
- HHS task force: Consider privacy, security with text messages
- Featured blog post: Nurses face felony charges after reporting physician to the Texas Medical Board
- Tip: Correctly code bilateral pain management procedures
- 2012 CPT code changes for ASCs: Shoulder and knee scopes and pain management
- COT basics to best
- Documentation and coding for toxic metabolic encephalopathy
- Guidance and tact key to compliant, effective physician queries
- Searched