Q&A: Recommendations regarding retention guidelines for audit logs
Physician Practice Insider, November 3, 2015
Q: Can you tell me whether there is a resource that lists documents and required retention guidelines (i.e., audit logs)? Where would I find such a list? Do you have any recommendations about retention guidelines for audit logs based on your experience?
A: There is no resource published by OCR that documents required retention guidelines. If it relates to HIPAA compliance, documents need to be retained for six years. That means, as an example, your HIPAA-related policies need to be retained for six years. So if you update a policy, the old version needs to be retained for six years.
As far as audit logs go, there are no guidelines, and there are two schools of thought: retain the log files for six years or retain the audit log monitoring reports for six years but not the logs themselves. EHR audit logs should be retained for three years because of the yet-to-be-finalized accounting of disclosures rule and new requirements included in the HITECH Act. I am of the second school of thought for all other audit logs. In other words, document your retention requirements and maintain other audit logs for 90 days following an audit log review unless logs are needed for a security incident investigation, at which point you should religiously destroy the audit logs that were reviewed after 90 days. If the policy is strictly followed, you are also protected if you become involved in a legal battle and accusations are made that you are destroying evidence. In the end, if you don't have it, it's not discoverable.
Editor's note: Chris Apgar, CISSP, president of Apgar & Associates, LLC, in Portland, Oregon, answered this question in the October issue of Briefings on HIPAA.
Do you have questions about physician practice coding, reimbursement, safety, EHRs, compliance, HIPAA, or other topics? Send your questions to Editor Andrea Kraynak, CPC, and we’ll work with our experts to find you an answer.
Related Products
Most Popular
- Articles
-
- Don't forget the three checks in medication administration
- Residency coordinators’ responsibilities
- RPA Subscriber Exclusive: February issue of Residency Program Alert now available
- Study: Shorter shifts reduces residents’ attentional failures
- Practice the six rights of medication administration
- Editor’s note
- Nursing responsibilities for managing pain
- The consequences of an incomplete medical record
- Prevent dehydration with nursing interventions
- Note similarities and differences between HCPCS, CPT® codes
- E-mailed
-
- White Paper: Postacute CDI: An Introduction to Long-Term Acute Care Hospitals
- Use modifiers -59, -91 to "explain" duplicate codes
- Tim Porter-O'Grady sounds off
- Q: Can you clarify the reporting of dates on the plan of care for diagnosis onset and exacerbation?
- ICD-10-CM coma, stroke codes require more specific documentation
- Fracture coding in ICD-10-CM requires greater specificity
- Eight tips to improve MRI throughput
- Searched