Q&A: Recommendations regarding retention guidelines for audit logs
Physician Practice Insider, November 3, 2015
Q: Can you tell me whether there is a resource that lists documents and required retention guidelines (i.e., audit logs)? Where would I find such a list? Do you have any recommendations about retention guidelines for audit logs based on your experience?
A: There is no resource published by OCR that documents required retention guidelines. If it relates to HIPAA compliance, documents need to be retained for six years. That means, as an example, your HIPAA-related policies need to be retained for six years. So if you update a policy, the old version needs to be retained for six years.
As far as audit logs go, there are no guidelines, and there are two schools of thought: retain the log files for six years or retain the audit log monitoring reports for six years but not the logs themselves. EHR audit logs should be retained for three years because of the yet-to-be-finalized accounting of disclosures rule and new requirements included in the HITECH Act. I am of the second school of thought for all other audit logs. In other words, document your retention requirements and maintain other audit logs for 90 days following an audit log review unless logs are needed for a security incident investigation, at which point you should religiously destroy the audit logs that were reviewed after 90 days. If the policy is strictly followed, you are also protected if you become involved in a legal battle and accusations are made that you are destroying evidence. In the end, if you don't have it, it's not discoverable.
Editor's note: Chris Apgar, CISSP, president of Apgar & Associates, LLC, in Portland, Oregon, answered this question in the October issue of Briefings on HIPAA.
Do you have questions about physician practice coding, reimbursement, safety, EHRs, compliance, HIPAA, or other topics? Send your questions to Editor Andrea Kraynak, CPC, and we’ll work with our experts to find you an answer.
Related Products
-
Physician Practice Perspective
Physician Practice Perspective subscribers can find the archive of issues on the Part B News website. Find more information...
-
Medical Environment Update
A subscription to Medical Environment Update pays for itself by saving you time sorting through complex regulations and...
-
HealthLeaders Media Physician Leaders
HealthLeaders Media Physician Leaders offers commentaries that focus on the hottest issues for doctors as well as concise...
-
Medical Environment Update - Electronic and Print, 1 year
A subscription to Medical Environment Update pays for itself by saving you time sorting through complex regulations and...
-
Medical Environment Update - Electronic, 1 year
A subscription to Medical Environment Update pays for itself by saving you time sorting through complex regulations and...
Most Popular
- Articles
-
- Duke Health to begin reusing N95 masks
- Don't forget the three checks in medication administration
- Note similarities and differences between HCPCS, CPT® codes
- Increase patient satisfaction by improving your discharge process
- OB services: Coding inside and outside of the package
- Understanding nursing roles in quality improvement
- Understand and overcome language, cultural barriers
- Practice the six rights of medication administration
- Prevent dehydration with nursing interventions
- Complications from immobility by body system
- E-mailed
-
- Duke Health to begin reusing N95 masks
- Duke Health to Begin Reusing N95 masks
- 7 ways to address nurse shortage issues
- Use patient safety coaches to boost compliance
- Tip: Understand revenue codes
- Don't forget the three checks in medication administration
- Coding for biopsies in ICD-10-PCS
- CMS suspends restrictions on care venues as providers tackle COVID-19 surges
- Charging CPR and injections or infusions with critical care
- Searched
