• E-mail
• Print
• RSS

Q&A: Recommendations regarding retention guidelines for audit logs

Physician Practice Insider, November 3, 2015

Q: Can you tell me whether there is a resource that lists documents and required retention guidelines (i.e., audit logs)? Where would I find such a list? Do you have any recommendations about retention guidelines for audit logs based on your experience?

A: There is no resource published by OCR that documents required retention guidelines. If it relates to HIPAA compliance, documents need to be retained for six years. That means, as an example, your HIPAA-related policies need to be retained for six years. So if you update a policy, the old version needs to be retained for six years.

As far as audit logs go, there are no guidelines, and there are two schools of thought: retain the log files for six years or retain the audit log monitoring reports for six years but not the logs themselves. EHR audit logs should be retained for three years because of the yet-to-be-finalized accounting of disclosures rule and new requirements included in the HITECH Act. I am of the second school of thought for all other audit logs. In other words, document your retention requirements and maintain other audit logs for 90 days following an audit log review unless logs are needed for a security incident investigation, at which point you should religiously destroy the audit logs that were reviewed after 90 days. If the policy is strictly followed, you are also protected if you become involved in a legal battle and accusations are made that you are destroying evidence. In the end, if you don't have it, it's not discoverable.

Editor's note: Chris Apgar, CISSP, president of Apgar & Associates, LLC, in Portland, Oregon, answered this question in the October issue of Briefings on HIPAA.

Do you have questions about physician practice coding, reimbursement, safety, EHRs, compliance, HIPAA, or other topics? Send your questions to Editor Andrea Kraynak, CPC, and we’ll work with our experts to find you an answer.

• E-mail to a Colleague
• Print
• RSS
• Archive