Q&A: Recommendations regarding retention guidelines for audit logs
Physician Practice Insider, November 3, 2015
Q: Can you tell me whether there is a resource that lists documents and required retention guidelines (i.e., audit logs)? Where would I find such a list? Do you have any recommendations about retention guidelines for audit logs based on your experience?
A: There is no resource published by OCR that documents required retention guidelines. If it relates to HIPAA compliance, documents need to be retained for six years. That means, as an example, your HIPAA-related policies need to be retained for six years. So if you update a policy, the old version needs to be retained for six years.
As far as audit logs go, there are no guidelines, and there are two schools of thought: retain the log files for six years or retain the audit log monitoring reports for six years but not the logs themselves. EHR audit logs should be retained for three years because of the yet-to-be-finalized accounting of disclosures rule and new requirements included in the HITECH Act. I am of the second school of thought for all other audit logs. In other words, document your retention requirements and maintain other audit logs for 90 days following an audit log review unless logs are needed for a security incident investigation, at which point you should religiously destroy the audit logs that were reviewed after 90 days. If the policy is strictly followed, you are also protected if you become involved in a legal battle and accusations are made that you are destroying evidence. In the end, if you don't have it, it's not discoverable.
Editor's note: Chris Apgar, CISSP, president of Apgar & Associates, LLC, in Portland, Oregon, answered this question in the October issue of Briefings on HIPAA.
Do you have questions about physician practice coding, reimbursement, safety, EHRs, compliance, HIPAA, or other topics? Send your questions to Editor Andrea Kraynak, CPC, and we’ll work with our experts to find you an answer.
Related Products
-
Physician Practice Perspective
Physician Practice Perspective subscribers can find the archive of issues on the Part B News website. Find more information...
-
Medical Environment Update
A subscription to Medical Environment Update pays for itself by saving you time sorting through complex regulations and...
-
HealthLeaders Media Physician Leaders
HealthLeaders Media Physician Leaders offers commentaries that focus on the hottest issues for doctors as well as concise...
-
Medical Environment Update - Electronic and Print, 1 year
A subscription to Medical Environment Update pays for itself by saving you time sorting through complex regulations and...
-
Medical Environment Update - Electronic, 1 year
A subscription to Medical Environment Update pays for itself by saving you time sorting through complex regulations and...
Most Popular
- Articles
-
- Don't forget the three checks in medication administration
- Note similarities and differences between HCPCS, CPT® codes
- Increase patient satisfaction by improving your discharge process
- OB services: Coding inside and outside of the package
- Understanding nursing roles in quality improvement
- Practice the six rights of medication administration
- Understand and overcome language, cultural barriers
- Pneumonia with a negative chest x-ray: Clinical diagnoses, physician documentation, and coding guidelines
- Complications from immobility by body system
- Prevent dehydration with nursing interventions
- E-mailed
-
- OB services: Coding inside and outside of the package
- Use patient safety coaches to boost compliance
- Tip: Understand revenue codes
- Q&A: Obtaining documentation for patients' body mass index
- Pregnancy coding: Understanding the differences between ICD-9-CM and ICD-10-CM
- Feature: Improving the collaboration between CDI and case management
- Coding for biopsies in ICD-10-PCS
- Clear up confusion surrounding medical necessity
- Charging CPR and injections or infusions with critical care
- Case management or HIM? Finding the right home for CDI
- Searched
